1. DATA FIDUCIARY & CORE PRINCIPLES

Under the Digital Personal Data Protection Act, 2023 (“DPDPA”) of India, Thenikflow (represented by founder Nikhil Jaiswal) operates as the Data Fiduciary responsible for determining the purpose and means of processing digital personal data collected through thenikflow.com.

2. PERSONAL DATA WE COLLECT

We collect information in the following transparent categories:

• Contact Form Submissions: When you submit an inquiry through our Contact Us page, we collect your Name, Email Address, WhatsApp Phone Number, the Topic/Category selected, and the Description of your inquiry.
• Article Submissions & Author Profiles: If you write or submit an article for publication, we collect your author name, email address, biographical summary, social profile URLs, avatar image, and the text of your submitted manuscript.
• User Account Authentication: When you register or sign in via Supabase Auth, we process your email address, hashed authentication credentials, and account metadata.
• Weekly Newsletter Subscriptions: When you subscribe to our Sunday Newsletter, we collect your email address, subscription timestamp, and active/unsubscribed status.
• Technical Server Logs: Standard web server requests automatically capture IP addresses, browser types, operating systems, referring URLs, and access timestamps to detect and prevent security threats, bot spam, and denial-of-service attempts.

3. ANALYTICS, HEATMAPS & COOKIES

To understand how visitors engage with our content and continuously optimize site usability, Thenikflow employs modern, privacy-conscious measurement tools:

• Google Analytics 4 (GA4): We use Google Analytics (Property ID: G-XEL3TGNR68) to analyze aggregated traffic trends, page views, and geographic demographics. GA4 operates with IP anonymization enabled. You may opt out of Google Analytics tracking via Google's browser opt-out add-on.
• Microsoft Clarity: We utilize Microsoft Clarity (Project ID: xpgxj03a9m) to capture session metrics, heatmaps, and scrolling behavior to identify layout flaws and improve user reading experiences. Clarity automatically masks keystrokes and sensitive form inputs so no personal passwords or confidential text are ever recorded.
• Essential Cookies: We utilize minimal, necessary cookies to maintain secure administrator and authenticated user sessions. We do not use cross-site behavioral advertising cookies.

4. LAWFUL GROUNDS & PURPOSES OF PROCESSING

Under Section 4 and Section 7 of the DPDPA 2023, we process personal data based on:

• Explicit Consent: Provided voluntarily when you subscribe to our newsletter, submit a contact form, or submit an article for public dissemination.
• Legitimate Uses: Responding to your direct inquiries, providing technical administration, securing our servers from fraud and unauthorized access, and complying with statutory legal obligations under Indian law.

5. TRUSTED DATA PROCESSORS & THIRD PARTIES

We partner only with reputable cloud infrastructure providers bound by rigorous confidentiality and data protection standards:

• Supabase: Cloud database infrastructure for secure data persistence, protected by PostgreSQL Row-Level Security (RLS) policies and TLS 1.3 encrypted data transmission.
• Resend: Transactional email service provider utilized for sending weekly Sunday digests and delivering contact form inquiries to administrators and user acknowledgments.
• YouTube (Google LLC): Embedded video streaming for podcast episodes of “Aam Aadmi Ki Soch”, subject to Google's privacy policies.
• Amazon Associates: Outbound product links in our Affiliate Products section utilize Amazon referral identifiers to track qualifying purchases in accordance with Amazon's operating agreement.

6. DATA RETENTION & SECURITY MEASURES

We retain personal data only for the duration necessary to satisfy the specific purpose for which it was collected:

• Contact submissions are retained until reviewed and resolved by our administrative team.
• Newsletter emails are retained until you elect to unsubscribe via the 1-click unsubscribe option.
• Published articles remain live unless an author formally requests removal or revision.

All communications between your browser and Thenikflow are encrypted using modern Transport Layer Security (HTTPS/TLS). Access to administrative dashboards is protected by HMAC-SHA256 authenticated sessions.

7. RIGHTS OF THE DATA PRINCIPAL (YOUR RIGHTS)

Under Chapter III of the Digital Personal Data Protection Act, 2023 (and equivalent principles under GDPR/CCPA), you enjoy comprehensive rights over your personal data:

• Right to Access: You may request a summary of the personal data being processed about you and the processing activities undertaken.
• Right to Correction & Erasure: You may request correction of misleading or inaccurate personal data, completion of incomplete data, or total erasure of your personal data and published submissions.
• Right of Grievance Redressal: You have the right to readily accessible grievance redressal mechanisms regarding any act or omission of the Data Fiduciary.
• Right to Nominate: You have the right to nominate an individual to exercise your data rights in the event of death or incapacity.

To exercise any of these rights, email your request to contact@thenikflow.com.

8. CHILDREN'S PRIVACY

Thenikflow is not intended for individuals under 18 years of age without parental or legal guardian consent. In compliance with Section 9 of the DPDPA, we do not knowingly process personal data of children that is likely to cause detrimental effects on their well-being, nor do we track or engage in targeted behavioral advertising directed at minors.