Privacy Policy

1. Who we are

Dehurdle is run by Thriving Billions Private Limited (“Dehurdle”, “we”, “us”), a private limited company registered in India (CIN U80301HR2022PTC100862). Our registered address is Flat 802, Tower C, Ireo Uptown, Sector 66, Gurugram, Haryana 122001, India.

This policy explains how we handle personal data when you use our website, the Dehurdle web app, the speech check, and our WhatsApp and Slack features (together, the “Services”). Our Data Protection and Grievance Officer is Vishal Verma (reach@dehurdle.com).

2. Our role: controller or processor

Who decides how your data is used depends on how you use Dehurdle.

• Individual accounts (Free and Pro), website visitors, speech check users and people who fill in our forms: Dehurdle is the controller, called a “data fiduciary” under India's Digital Personal Data Protection Act, 2023 (the “DPDP Act”). This policy is our notice to you.
• Organization accounts (Team, Scale and Enterprise): your organization is the controller and Dehurdle is its processor. We use your data only on the organization's instructions, under our Data Processing Addendum. Your employer's own privacy notice explains why it uses Dehurdle and on what legal basis, and requests about your data go to your organization admin. This policy still describes what Dehurdle does with the data.

3. What we collect

Some of this applies only if you use a particular feature.

Account data

• Your name, email address, the organization you belong to, your preferred language, and your answers during onboarding, such as your role, industry, experience level and how you heard about us.
• Sign-in details. Sign-in, including your password or single sign-on, is handled by WorkOS. If your organization sets up directory sync, your account is created and updated from your organization's identity provider through WorkOS.
• Billing details for paid plans. At checkout we send Razorpay the payer's name and email address, pre-filled, with the organization and plan details. Card details go directly to Razorpay, not to us.
• Your phone number, if you choose to add one.

Practice data

• Audio: used for the live conversation and not stored after the session ends. Speech check recordings and uploads (up to 25 MB) and WhatsApp voice notes are held in memory, sent to Google for analysis, and not stored.
• Transcripts: the text of each practice conversation, on the web or in a WhatsApp call. Before a transcript is saved, an automatic filter replaces email addresses, phone numbers, payment card numbers and some national ID numbers with “[REDACTED]”. It does not remove names or addresses. It isn't applied to audio or text while they are sent to Google during the live conversation. We also keep the raw spoken words from each session, without redaction, for voice analysis; they are deleted together with the transcript. Avoid sharing real personal details about yourself or others while you practice.
• Scores and feedback: scores, written feedback and your progress across sessions. Scores and feedback are produced by Google's Gemini models.
• Speaking metrics: pace in words per minute and pauses, measured from the timing of your words. Volume, pitch and voice steadiness aren't measured.
• Camera metrics (optional): the camera is off by default. It works only if your organization allows it and you turn it on. The analysis runs in your browser: no video or images leave your device, and nothing is recorded. Only these numbers are sent to us and stored with your scorecard: eye-contact ratio, seconds of direct gaze, head movement, number of rapid movements, nods, smile count, a facial expressiveness score (how much your face moves) and a composure score (how steady your head is). Some of them are also broken down by turn in the conversation.
• Coach chats: messages you exchange with the in-app AI coach. From October 10, 2026, the same automatic filter replaces email addresses, phone numbers, payment card numbers and some national ID numbers before a message is saved; messages saved before then are kept as written. Coach chats are deleted together with transcripts and written feedback after your organization's retention period, and when your organization is deleted.
• Documents you upload to create scenarios: playbooks, decks, notes or call recordings are sent to Google to build the scenario. They are held in memory, or in a temporary cache for up to an hour while a training track is built, and are not stored after that. The scenario that is generated from them is stored in your account.

WhatsApp, Slack and email

• WhatsApp (if you add your phone number): we use your number for WhatsApp practice and calls, reminders, scorecard summaries and sign-in codes, which expire after 5 minutes. Messages go through Meta's WhatsApp Cloud API. We don't store the content of WhatsApp messages. We keep short-lived conversation state for up to 30 days, linked to a hashed version of your phone number. Reply STOP to opt out.
• Slack (only if your organization connects it): we use your work email address to find your Slack account. We send you reminders and scorecard summaries as Slack direct messages, and in Slack you can browse the scenario catalog, see your recent scores and minute balance, and get AI coaching replies in a thread. Slack receives these messages.
• Email: emails from us are sent through Amazon SES in Mumbai, India.

Speech check, forms, logs and cookies

• Speech check (no account needed): your audio is held in memory, sent to Google for analysis, and not stored. We save the result: the transcript, with email addresses, phone numbers and payment card numbers replaced with “[REDACTED]”, and your scores and tips. Names and other details you say are not removed. The result isn't linked to an account. Anyone with the result link can open it and can delete it from the result page. It is deleted automatically 30 days after the check.
• Forms: when you request a demo or apply as a partner or for a job, we collect your name, email address, phone number, company and message.
• Feedback: when you send feedback from the app, we keep your message with your name, email address and phone number so we can follow up.
• Logs: our server logs and rate limiting use IP addresses. Actions by administrators are logged with their IP address.
• Country and currency: when you open the pricing or billing page, or check out, our server works out your country from your IP address to show prices in your currency. The lookup runs on our own server with a built-in table: your IP address isn't sent anywhere else or stored for this. This site includes IP2Location LITE data available from lite.ip2location.com.
• Cookies: we set marketing attribution cookies only if you accept analytics cookies. If you have accepted them by the time you sign up, the details they hold are sent with your sign-up so we know how you found us. See our Cookie Policy.

4. How we use your data and our lawful bases

Where Dehurdle is the controller, we rely on these lawful bases under the EU and UK GDPR:

• To provide the Services you ask for (your account, practice sessions, scoring and feedback, the coach, the speech check, and payments for paid plans): performance of our contract with you (Article 6(1)(b)).
• Optional features you turn on (camera metrics, WhatsApp, public sharing of scorecards) and attribution cookies: your consent (Article 6(1)(a)). You can withdraw it at any time by turning the feature off, replying STOP on WhatsApp or changing your cookie choice.
• To answer forms (demo requests, partner and job applications): steps you ask us to take before a contract (Article 6(1)(b)), or our legitimate interest in replying to you (Article 6(1)(f)).
• To keep the Services secure and prevent abuse (server logs, rate limiting, logs of administrator actions): our legitimate interests (Article 6(1)(f)).
• To meet our legal obligations: legal obligation (Article 6(1)(c)).

Under India's DPDP Act, we process your personal data with your consent, which you can withdraw at any time as easily as you gave it, or for a legitimate use the Act allows, such as data you give us voluntarily for a specific purpose. Withdrawing consent doesn't affect processing that happened before.

If you use Dehurdle through an organization, the organization decides why your data is used and on what legal basis. We process it only on the organization's instructions.

5. Who can see your data and who we share it with

• You.
• Your organization's admins, if you use an organization account. Depending on what your organization chooses, they see company-wide figures only, each member's progress and scores, or also session transcripts. The app shows you which applies.
• Authorized Dehurdle staff, when needed for support and security.
• Anyone with the link, if you share. If you turn on sharing, anyone with the link can open your scorecards, including your name and transcript. Speech check results, including the transcript, can be opened by anyone with the result link until they are deleted.
• Our subprocessors, which process data for us to run the Services.

Our subprocessors

• Amazon Web Services: hosting, database, cache and email, in India (Mumbai).
• Google Cloud (Vertex AI and Speech-to-Text): the live AI conversation, transcription, scoring and the coach. Receives practice audio and transcripts, coach messages, speech check uploads and WhatsApp messages. USA (live voice), India (scoring and coach) and Google's global speech-to-text service.
• Meta Platforms (WhatsApp Cloud API): only if you use WhatsApp. WhatsApp practice, calls, reminders and sign-in codes. Receives your phone number and your WhatsApp messages and calls. Global, including the USA.
• WorkOS: sign-in, single sign-on and, for organizations that set it up, directory sync. Receives your name, email address and sign-in details. USA.
• Razorpay: payments. Receives the payer's name and email address and the organization and plan details; card details go directly to Razorpay. India.
• Slack: only if your organization connects Slack. Reminders and scorecard summaries by direct message, plus the scenario catalog, recent scores, minute balance and AI coaching replies in Slack. Receives those messages and your work email address. USA.

The full list is on our Subprocessors page. We give organization customers 30 days' notice before we add a new subprocessor.

We don't sell personal data. Apart from the people and companies listed above, we disclose personal data only when the law requires us to.

6. Where your data is stored and international transfers

• Our application servers, database, cache and email service run on Amazon Web Services in Mumbai, India (ap-south-1).
• Live voice conversations are processed by Google in the USA (us-central1, Iowa).
• Scoring, the coach, the speech check and understanding of WhatsApp messages run on Google in Mumbai, India (asia-south1).
• Speech-to-text, used for the AI persona's speech and for voice messages to the coach, runs on Google Cloud's global endpoint, which isn't tied to one country.
• WorkOS and Slack process data in the USA, Meta globally including the USA, and Razorpay in India.

We don't offer hosting in the EU, the UK or the USA, and the data region setting on an organization doesn't change where its data is stored.

If you are in the EU or UK, your personal data is therefore transferred to India and, for live voice, to the USA. India has no adequacy decision from the European Commission, so these transfers rely on the EU Standard Contractual Clauses (Commission Decision 2021/914): Module 2 between an organization customer and Dehurdle, and Module 3 for onward transfers to our subprocessors, with the UK Addendum for UK data. Our subprocessors have their own terms based on the Standard Contractual Clauses. We give customers the information they need for their transfer impact assessments. The terms are in our Data Processing Addendum.

7. How long we keep data

• Audio: not stored after the session ends.
• Transcripts, feedback and coach chats: each organization has a retention period in days. The default is 365 days; Dehurdle sets a different period, of at least 1 day, when the organization asks. Individual accounts use the default. Every day, an automatic job deletes transcripts (including the raw spoken words kept for voice analysis), coach chats and written feedback that are older than the retention period. Scores and summary metrics are kept so you can track your progress.
• WhatsApp: conversation state is kept for up to 30 days. Sign-in codes expire after 5 minutes.
• Speech check results: deleted automatically 30 days after the check. You can delete a result sooner from the result page.
• Form submissions: an automatic job deletes demo requests and partner applications 24 months after you send them, and job applications 12 months after. You can ask us to delete them sooner.
• Feedback and administrator action logs: an automatic job deletes them 24 months after they were written.
• Billing records: kept for as long as tax law requires.
• Attribution cookies: 90 days for your first visit and 30 days for your latest visit.
• Backups: deleted data can remain in our encrypted database backups for up to 7 days.

Deleting your account

When you delete an individual account, we delete your workspace with all its practice sessions, transcripts, scores, coach chats and custom scenarios, remove your name, email address and phone number, and delete your sign-in account at WorkOS. When an organization deletes a member's account, we remove the member's name, email address and phone number, delete their sign-in account at WorkOS and delete their own individual workspace if they have one; their practice records in the organization stay with it without those identifiers. In both cases, feedback the person sent is kept without their name, email address and phone number, and billing records are kept as tax law requires.

If you have an individual account, you can delete it in the app's privacy settings or by emailing reach@dehurdle.com. If you are a member of a Team, Scale or Enterprise organization, ask your organization admin. Deleting an organization deletes all of its data, and the accounts of people who belonged only to that organization.

8. Your rights

Depending on where you live, you have these rights over your personal data.

How to use your rights

• Email reach@dehurdle.com. We may ask you to confirm your identity before we act. We reply within the time the law sets, which under the GDPR is one month.
• If you use Dehurdle through an organization, the organization handles your request. Contact your organization admin; we help the organization respond.
• For a copy of your data, use the export in the app's privacy settings. It downloads your personal data as a JSON file: your profile, phone number, transcripts, scores, written feedback, speaking and camera metrics, coach chats and preferences.

Complaints

You can complain to the data protection supervisory authority where you live or work in the EU, or to the Information Commissioner's Office in the UK. In India, if we don't resolve your grievance, you can complain to the Data Protection Board of India.

9. Security

• Connections to Dehurdle use HTTPS, so data is encrypted in transit.
• Our database and cache are encrypted at rest and in transit, and can't be reached from the public internet.
• Only authorized Dehurdle staff can access customer data, and only for support and security.
• Transcripts are redacted automatically before they are saved, as described in section 3.
• Administrator actions are logged with the administrator's IP address.

10. Data breaches

If a personal data breach affects data we process for an organization, we tell that organization without undue delay and within 72 hours of becoming aware of it, with the information it needs. The organization, as controller, notifies supervisory authorities and the people affected as the law requires.

Where Dehurdle is the controller, we notify the relevant authority and the people affected as the law requires.

11. Children

The Services are not meant for anyone under 18, and we don't knowingly collect personal data from children. If you think a child has given us personal data, email reach@dehurdle.com and we will delete it.

12. Changes to this policy

When we change this policy, we publish the new version on this page and update the date at the top.