Privacy Policy

1. Scope and data fiduciary

This Policy applies to the HyteMax website, waitlist, checkout, app, and support interactions. For applicable privacy laws, HyteMax is responsible for deciding why and how your personal data is processed.

2. Information we collect

• identity and contact data, such as name, email, phone, region, and age range;
• purchase data, order references, payment status, and consent records;
• app activity, protocol progress, habits, measurements, goals, and preferences;
• device, browser, IP address, approximate location, logs, and security data;
• support communications and feedback; and
• photos, camera frames, posture inputs, or body-scan information only when you choose to use those features and grant permission.

Cashfree processes payment credentials. HyteMax does not store full card, UPI, or bank credentials. Camera-based posture information is an educational wellness input, not a medical diagnosis or medical record created by a healthcare provider.

3. Why we use personal data

• create accounts, maintain the waitlist, and deliver purchased access;
• personalize educational content, reminders, progress, and app features;
• provide optional posture visualizations and AI-assisted educational guidance;
• process orders, prevent fraud, secure the service, and enforce terms;
• respond to support, privacy, and grievance requests;
• send product communications where permitted; and
• analyze and improve performance using aggregated or de-identified information.

4. Consent and choices

Where consent is required, you may withdraw it by contacting us or using available settings. Withdrawal does not affect processing already completed and may prevent features that require the relevant data. Camera, photo, notification, and marketing permissions are optional and can be disabled.

5. Body-scan images and sensitive wellness information

We will not use posture images or body-scan inputs for facial recognition, identity verification, advertising profiles, or sale to data brokers. Where technically feasible, analysis occurs on-device or uses minimized inputs. Before you enable these features, HyteMax will provide an in-product notice explaining whether images are uploaded, why they are processed, applicable retention periods, and available deletion controls. We will obtain any additional consent required by applicable law.

6. Sharing and service providers

We may share necessary data with contracted providers that support hosting, databases, payments, email, analytics, customer support, security, and legal compliance. Providers may use data only for agreed services and must protect it. We may disclose data when required by law, to protect safety or rights, or as part of a business transaction with appropriate safeguards. We do not sell personal data.

7. International processing

Providers may process data outside your region. Where required, we use contractual, technical, and legal safeguards and comply with applicable restrictions on cross-border transfers.

8. Retention and deletion

We retain data only as long as needed for the purposes described, legal obligations, fraud prevention, dispute resolution, and enforcement. Retention periods differ by data type. Account and optional image data will be deleted or de-identified after a valid request unless retention is legally required.

9. Security

We use reasonable administrative, technical, and organizational safeguards, including access controls and restricted service credentials. No system is perfectly secure. Notify us immediately if you suspect unauthorized access. We will provide breach notices where required by applicable law.

10. Your privacy rights

Depending on applicable law, you may request access, correction, updating, deletion, withdrawal of consent, or grievance redressal. We may verify your identity before completing a request. You may also nominate another person to exercise rights where applicable law permits.

11. Children's privacy

Users under 18 require verifiable parent or guardian involvement where required. We do not knowingly use children's data for targeted advertising or harmful tracking. Guardians may contact us to review or delete a minor's data.

12. Cookies and analytics

HyteMax may use necessary storage for security and functionality and, with appropriate notice or consent, analytics technologies to understand product use. A production cookie-consent tool and detailed cookie list should be implemented before enabling non-essential trackers.

13. Updates to this Policy

We may update this Policy as the service or law changes. We will post the revised date and provide additional notice for material changes when required.

14. Privacy and grievance contact

Legal entity: HyteMax
Address: Business address to be updated before launch
Privacy and grievance email: support@hytemax.app

This draft should be reviewed by qualified privacy counsel and updated with the actual entity, address, processors, retention periods, and app behavior before launch.

15. Legal grounds for processing

Depending on the applicable law and activity, we process personal data to perform a contract or provide a requested service, with your consent, to comply with legal obligations, and for legitimate interests such as security, fraud prevention, support, and service improvement where those interests are not overridden by your rights. You may withdraw consent at any time for future processing that relies on consent.

16. Service-provider categories

Current provider categories may include Vercel for hosting and delivery, Supabase for database services, Cashfree for payment processing, and Resend for transactional email. Each provider processes only the data needed for its role and operates under its own privacy terms. We will update this Policy before introducing a materially different use or provider category.

17. Retention schedule

• waitlist and transactional communication records are retained while the waitlist is active and for a reasonable period afterward;
• order, payment-status, consent, tax, and dispute records are retained for periods required by applicable financial and consumer laws;
• security logs are retained only as long as reasonably needed to detect, investigate, and prevent abuse; and
• optional images and wellness inputs are deleted or de-identified after their stated feature-specific retention period or a valid deletion request, unless continued retention is legally required.

18. Marketing, automated decisions, and opt-out

Transactional emails are necessary to confirm signups, purchases, access, or security events. Marketing messages, if sent, will include an unsubscribe method where required. HyteMax does not make decisions producing legal or similarly significant effects solely through automated processing. You can object to marketing or request privacy assistance using the contact above.