Privacy Policy

Version 1.0 · Effective 29 October 2026

This policy explains what personal information CWI Studio collects, why, who sees it, and the choices you have. It covers this website (cwistudio.in) and the tools we host under it: Karya (karya.cwistudio.in), Setu (setu.cwistudio.in), Parakh (parakh.cwistudio.in), and the staff admin consoles of EdZen and HrZen. Some products have their own policy, which applies instead of this one: Taar (taar.cwistudio.in/privacy) and the HrZen employee app (hrzen.in/privacy).

1. Who we are

CWI Studio is the product studio of RSI Software, B-14, Sector-3, Devendra Nagar, Raipur 492001, Chhattisgarh, India (“we”, “us”).

Our tools are used by organisations. That changes who is responsible for what:

• Content inside an organisation’s workspace (work items, CRM records, candidate profiles, school and HR records): the organisation that gave you access decides what goes in and why. It is the Data Fiduciary under the Digital Personal Data Protection Act, 2023. We process that content for the organisation, on its instructions, as its Data Processor.
• Your account, sign-in and security records, and anything you send us directly (the contact form, a job application, an email): we decide how these are used and are responsible for them.

Today we follow the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. We follow the Digital Personal Data Protection Act, 2023 and its Rules as they come into force.

2. What we collect

On this website

• Contact form: your name, email address and message. They are emailed to our team inbox.
• Hiring form: the details you enter: name, email, phone, city, college, course, links to your work and your answers. They are stored in a Notion database our team reviews.
• The website sets no advertising or analytics cookies and contains no third-party tracking code.

In our tools

• Account: your name, email address, profile picture and display settings. Accounts are created by invitation from an organisation; you cannot sign up on your own.
• Sign-in: a one-time code sent to your email, a password (stored only as a one-way hash), or Sign in with Google. We keep a session record (browser, IP address, time) to keep you signed in and to protect your account.
• Content you or your organisation create: whatever you type, upload or record in the tool.
• Voice in Karya Go: if you speak a ticket, the recording is sent to Sarvam AI for transcription and drafting. We do not store the recording; only the ticket you approve is saved.
• Server logs: IP addresses, browser details and errors, for security and troubleshooting.

3. Sign in with Google

If you choose “Continue with Google”, Google tells us your name, email address, profile picture and Google account ID. We ask for nothing more: we cannot read your Gmail, Drive, Contacts, Calendar or any other Google data, and we never see your Google password.

We use this information only to sign you in to the account that matches your email address and to show your name and picture inside the tool. If no account exists for that email, sign-in is refused; Google sign-in never creates an account by itself. We do not sell it, use it for advertising, or use it to train AI models. Our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

You can remove our access at any time at myaccount.google.com/permissions. You can still sign in with an email code.

4. Why we use it

• to provide the tools to your organisation and let you sign in securely;
• to send you sign-in codes, invitations and notifications you have asked for;
• to answer your messages and consider your job application;
• to keep the service running, secure and backed up, and to fix problems;
• to meet our legal obligations.

We do not sell or rent personal information, do not use it for advertising, and do not use your organisation’s content to train AI models.

5. Who can see it

• Your organisation: the people it authorises, according to the roles it sets.
• Our team: a small number of authorised people, only to run, secure or support the service.
• Service providers who run parts of the service for us and are bound to protect it:

• Authorities, where Indian law requires it.

6. Where it is stored and how it is protected

Our main servers are in India. Some providers above work outside India; we send information abroad only to run the service, only to providers bound to protect it, and never to a country the Government of India restricts. Traffic is encrypted in transit (HTTPS), backups are encrypted, and access to production systems is limited to a few authorised people.

No system is perfectly secure. If a breach affects your information we will tell the affected organisation without delay, tell you directly for information we control, and report to CERT-In as Indian law requires.

7. How long we keep it

• Workspace content: while the organisation uses the tool. After it stops, it can export its data; we then delete it within 90 days unless the law requires us to keep something longer.
• Your account: until your organisation removes you or you ask us to delete it.
• Contact messages: as long as needed to answer you, and at most two years.
• Job applications: up to one year after we decide, unless you ask us to delete yours sooner.
• Server logs: only as long as needed for security and troubleshooting, and at most one year.
• Backups: encrypted copies kept up to 12 months, then deleted automatically.

8. Your rights

You can ask for a summary of your information and who it was shared with, and ask us to correct, complete, update or delete it. You can withdraw consent you gave, and nominate someone to act for you if you die or cannot act yourself. For content in an organisation’s workspace, contact that organisation first; if you write to us instead, we will pass your request to it within 7 days and tell you. We may ask you to confirm your identity before acting on a request.

9. Children

Our tools are for adults acting for organisations. We do not knowingly collect personal information from anyone under 18 without verifiable consent from a parent or lawful guardian.

10. Changes

We publish every change here with a new version number and date. For significant changes we will tell the organisations that use our tools at least 15 days in advance. If our business moves to a successor company, your information moves with it under this policy, and we will tell organisations first.

11. Contact and grievances

Email hello@cwistudio.in.

Grievance Officer: Aniket Ranjan, for RSI Software · B-14, Sector-3, Devendra Nagar, Raipur 492001, Chhattisgarh, India · hello@cwistudio.in · +91 95471 25520

We acknowledge every grievance within 48 hours and resolve it within 30 days. If you are not satisfied, you may complain to the authorities Indian law provides, including the Data Protection Board of India once the relevant provisions are in force.