Privacy Policy

1. Scope

This Policy explains how HCDI GLOBAL PTE. LTD. (UEN 202644036M, registered office 68 Circular Road, #02-01, Singapore 049422) handles personal data when you use HCDI Platform (the "Service"), as a Firm member, a Deal-Workspace-scoped Respondent completing a pulse survey, or a platform administrator.

2. What we collect

This is an accurate inventory of what the current system stores, not a generic list:

• Account data: name, email address, a bcrypt password hash (never the plaintext password), and your interface language preference.
• SSO-provisioned account data: if your Firm enables single sign-on, your name and email are read from your organization's own identity provider at first login and stored the same way as a password account.
• Security/audit logs: who did what, when, including the acting user, the action, before/after snapshots of the changed record, and the request's IP address.
• Evidence files you or your Firm upload to a Deal Workspace. These may contain personal data of third parties (e.g. target-company employees) if your Firm includes it; that's your Firm's data, uploaded under your Firm's responsibility (see Terms of Service §6).
• Survey response data: for Respondents, a numeric 1–5 rating per question, tied to your Respondent account; no free-text responses are collected by the current survey format.
• Billing data: if your Firm subscribes to the Pro plan, Stripe (see §5) processes and stores payment method details; we store your Firm's Stripe customer/subscription identifiers and subscription status, never card numbers.

3. How we use it

To provide the Service (authenticate you, scope your access to your Firm's data, generate reports, run scoring calculations), to secure it (audit logging, rate limiting, fraud/abuse prevention), to bill Pro subscriptions, to communicate operational and security notices, and to comply with legal obligations. Personal data is used for nothing else, and is never sold.

4. Cookies

The Service sets exactly one cookie: a strictly-necessary, httpOnly session cookie that keeps you signed in. It is not used for tracking or analytics, and no third-party advertising or analytics cookies are set by the Service.

5. Sub-processors

The third parties that process data on the platform's behalf, what each receives and where it is located are listed on the Sub-processors page, the single list this Policy and the Data Processing Agreement both refer to.

6. Data residency

Deal Workspaces have an optional "data residency region" field intended to record where a Firm wants that Deal Workspace's data associated with a region. As of this version, that field is descriptive metadata only; it is not technically enforced to actually restrict where the underlying database or file storage physically resides. Don't rely on it as a data-residency guarantee until this is explicitly confirmed for your deployment.

7. Retention

The current system has no automated data-retention or deletion schedule: data is retained until account or Firm deletion is requested (see §8). You can ask what we hold about you, and how long we will keep it, at privacy@hcdindex.com.

8. Your rights

Depending on where you're located, you may have rights to access, correct, export, or delete your personal data, or to object to certain processing. The Service does not yet have a self-service export or account deletion feature. To exercise these rights today, contact privacy@hcdindex.com and we will handle the request by hand.

9. Security

Passwords are hashed with bcrypt, never stored in plaintext. Firm SSO client secrets are encrypted at rest (AES-256-GCM). Sessions use httpOnly, SameSite cookies. Access to another Firm's data is blocked at the application layer on every request. No system is perfectly secure; report suspected vulnerabilities to security@hcdindex.com.

10. Children's privacy

The Service is a B2B tool not directed at or intended for use by children.

11. International transfers

The Service is hosted on Amazon Web Services in Frankfurt, Germany (region eu-central-1). Videos and images are delivered through Amazon CloudFront's edge network. Where personal data reaches a provider in another country, it is for the purposes in §3, and the Sub-processors page says which provider and where.

12. Changes to this Policy

We'll update the "Last updated" date above and give reasonable notice of material changes.

13. Contact

Questions or requests regarding this Policy: privacy@hcdindex.com. See also our Terms of Service.