1. Introduction

Welcome to Markubees. This Privacy Policy explains how Markubees ("we," "us," or "our") collects, uses, discloses, and protects your personal information when you use our peer-to-peer platform (the "Platform"), where any User can book a paid Session with, or offer a Session to, any other User; there are no fixed roles.

We are committed to protecting your privacy and ensuring transparency in our data practices. This policy is designed to comply with applicable data protection laws including the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and other relevant Indian regulations.

By accessing or using our Platform, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree with this policy, please do not use our Platform.

2. Definitions

• "Personal Information" means any information that relates to a natural person, which can identify such person directly or indirectly.
• "Sensitive Personal Data" includes financial information (credit/debit card, bank account details), passwords, biometric information, and any other information classified as sensitive under Indian law.
• "Platform" refers to the Markubees website, mobile applications, and all related services.
• "Services" refers to the Session booking, video consultations, and related features provided through the Platform.
• "User" means any person who accesses or uses the Platform, whether booking a Session, offering a Session, or participating in an Organisation.

3. Information We Collect

3.1 Information You Provide to Us

Account Registration:

• Full name, email address, phone number
• Username and password (encrypted)
• Profile photograph (optional)
• Date of birth (for age verification)
• Country of residence

Information for Users Offering Sessions:

• Professional background, work experience, and career history
• Educational qualifications and certifications
• Areas of expertise and specialization
• Previous startup exits, funding rounds, or achievements
• LinkedIn profile, portfolio links, or professional websites
• Hourly rate and availability schedule
• Bank account details or payment information for receiving payouts (Sensitive Personal Data)
• Tax information including PAN (Permanent Account Number) and GST registration details

Organisation Profile Information:

• Startup or organisation name, logo, banner, and description
• Industry sector, stage of business, and connected team affiliations
• Build updates, milestones, insights, and posts published to The Hive
• Areas of interest for collaboration and Session booking
• Goals and objectives for using the Platform

Payment Information:

• Credit/debit card information (processed securely by Razorpay or authorized payment partners)
• UPI ID, wallet information, or other payment method details
• Billing address and GST information (if applicable)
• Transaction history and payment records

Communication and Session Data:

• Messages exchanged between Users through the Platform
• Session booking details, scheduling information, and session notes
• Reviews, ratings, and feedback provided by Users
• Video session metadata (duration, participants, timestamps) - Note: We do NOT record or store video/audio content unless explicitly consented to
• Support inquiries and correspondence with our customer service team

3.2 Information We Collect Automatically

When you access or use the Platform, we automatically collect certain information:

• Device Information: IP address, browser type and version, operating system, device type, unique device identifiers
• Usage Information: Pages viewed, features used, time spent on pages, click-through rates, search queries
• Location Data: Approximate geographic location based on IP address
• Cookies and Tracking Technologies: We use cookies, web beacons, pixels, and similar technologies (see Section 10)
• Performance Data: Error logs, performance metrics, system diagnostics

3.3 Information from Third Parties

• Social Media: If you sign up or log in using Google, LinkedIn, or other social media accounts, we receive basic profile information (name, email, profile picture) as permitted by your privacy settings
• Payment Processors: Transaction confirmation and payment status from Razorpay
• Identity Verification: Information from third-party verification services to authenticate profile credentials
• Public Sources: Information from publicly available sources (LinkedIn, company websites) to verify profile claims

4. How We Use Your Information

We use the collected information for the following purposes:

4.1 Platform Operation and Service Delivery

• Create and manage User accounts
• Facilitate connections and Session bookings between Users
• Process bookings and schedule Sessions
• Enable video conferencing and real-time communication
• Provide customer support and respond to inquiries
• Send transactional emails and notifications (booking confirmations, session reminders, payment receipts)

4.2 Payment Processing and Financial Operations

• Process payments from the booking User to the Platform
• Facilitate payouts to the User who offered a completed Session
• Generate invoices and payment receipts
• Comply with tax obligations including TDS deduction and GST reporting, where applicable
• Detect and prevent payment fraud
• Manage refunds, disputes, and chargebacks

4.3 Platform Improvement and Analytics

• Analyze usage patterns to improve Platform functionality
• Conduct research and development for new features
• Perform A/B testing and user experience optimization
• Generate aggregated, anonymized statistics and insights

4.4 Security and Fraud Prevention

• Verify User identity and prevent impersonation
• Detect, investigate, and prevent fraudulent transactions
• Monitor for suspicious activity and security threats
• Enforce our Terms of Service and prevent abuse
• Maintain audit logs for compliance and dispute resolution

4.5 Marketing and Communication (with consent)

• Send promotional emails about new features, notable profiles, and special offers (you can opt-out anytime)
• Display personalized recommendations for Users and Sessions
• Conduct surveys and gather feedback
• Send newsletters and platform updates

4.6 Legal Compliance and Protection

• Comply with applicable laws, regulations, and legal processes
• Respond to lawful requests from government authorities
• Protect our rights, property, and safety, and that of our Users
• Resolve disputes and enforce agreements

5. Legal Basis for Processing (India & International)

We process your personal information based on the following legal grounds:

• Consent: You have explicitly consented to the processing for specific purposes (e.g., marketing communications, optional profile features)
• Contract Performance: Processing is necessary to fulfill our contractual obligations to you (e.g., providing the Platform services, processing payments)
• Legal Obligation: We are required to process your data to comply with legal requirements (e.g., tax laws, KYC regulations, court orders)
• Legitimate Interests: Processing is necessary for our legitimate business interests (e.g., fraud prevention, security, platform improvement) provided it does not override your fundamental rights

6. Data Sharing and Disclosure

We do NOT sell your personal information to third parties. We share your information only in the following circumstances:

6.1 With Other Users

• Bookable Profiles: A User's bookable profile information (name, photo, experience, expertise, ratings) is visible to all Users browsing the Platform
• Session Details: When one User books a Session with another, we share each User's name and contact information with the other
• Reviews: Reviews and ratings you post are publicly visible and associated with your profile name

6.2 With Service Providers

We engage trusted third-party service providers to perform functions on our behalf:

• Payment Processors: Razorpay (for processing payments and payouts)
• Cloud Hosting: Supabase, Cloudflare (for hosting, database, and CDN services)
• Email Services: Resend, ZeptoMail (for transactional and promotional emails)
• Video Infrastructure: TURN server providers (for WebRTC video sessions)
• Analytics: Analytics tools to understand Platform usage (data is anonymized where possible)
• Customer Support: Help desk and support tools

These service providers have access to your personal information only to perform tasks on our behalf and are obligated to protect your data in accordance with this Privacy Policy and applicable data protection agreements.

6.3 Business Transfers

If Markubees is involved in a merger, acquisition, asset sale, or bankruptcy, your personal information may be transferred to the acquiring entity. We will provide notice before your information is transferred and becomes subject to a different privacy policy.

6.4 Legal Requirements and Protection

We may disclose your information if required to do so by law or in response to:

• Valid legal processes (subpoenas, court orders, warrants)
• Government or regulatory authority requests
• National security or law enforcement requirements
• Situations involving potential threats to public safety or illegal activities
• Protection of our legal rights, prevention of fraud, or enforcement of our Terms of Service

6.5 With Your Consent

We may share your information with third parties when you have given us explicit consent to do so.

7. Data Retention

We retain your personal information for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law.

• Active Accounts: We retain your information while your account is active
• After Account Deletion: We may retain certain information for up to 7 years for legal, tax, and accounting compliance (e.g., transaction records, TDS certificates)
• Session Records: Booking history and payment records are retained for 7 years for tax and dispute resolution purposes
• Marketing Data: If you opt-out of marketing communications, we retain your email address to honor your opt-out preference
• Anonymized Data: We may retain aggregated, anonymized data indefinitely for analytics and research

When information is no longer needed, we securely delete or anonymize it in accordance with data protection best practices.

8. Data Security

We implement industry-standard technical and organizational security measures to protect your personal information from unauthorized access, disclosure, alteration, and destruction:

• Encryption: Data in transit is encrypted using TLS/SSL protocols; sensitive data at rest is encrypted
• Authentication: Secure password hashing (bcrypt/Argon2), multi-factor authentication options
• Access Controls: Role-based access controls (RBAC), least privilege principle, Row-Level Security (RLS) policies in our database
• Infrastructure Security: Secure cloud hosting with reputable providers (Supabase, Cloudflare)
• Payment Security: PCI-DSS compliant payment processors; we do NOT store complete credit card details
• Monitoring: Continuous security monitoring, intrusion detection, audit logging
• Vulnerability Management: Regular security assessments, dependency updates, penetration testing
• Employee Access: Limited employee access to personal data, confidentiality agreements, security training

Important: While we take reasonable steps to protect your information, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials.

Security Incident Response: In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and relevant authorities as required by applicable law, typically within 72 hours of becoming aware of the breach.

9. Your Rights and Choices

You have the following rights regarding your personal information:

9.1 Access and Portability

• Request a copy of the personal information we hold about you
• Receive your data in a structured, machine-readable format (data portability)
• Access your account dashboard to view profile information, session history, and payment records

9.2 Correction and Update

• Update inaccurate or incomplete information through your account settings
• Request correction of any errors in your personal data

9.3 Deletion (Right to be Forgotten)

• Request deletion of your account and associated personal information
• Note: We may retain certain information for legal compliance (tax records, transaction history) even after account deletion
• Publicly posted reviews may remain visible but will be anonymized

9.4 Restriction and Objection

• Object to processing of your information for direct marketing purposes
• Request restriction of processing in certain circumstances (e.g., while we verify accuracy)
• Opt-out of non-essential cookies through your browser settings

9.5 Withdraw Consent

• Withdraw consent for marketing communications (unsubscribe link in emails)
• Withdraw consent for optional features or data processing
• Note: Withdrawal does not affect the lawfulness of processing before withdrawal

9.6 Lodge a Complaint

If you believe we have not handled your personal information properly, you have the right to lodge a complaint with:

• Our Data Protection Officer: privacy@markubees.com
• Indian Authorities: Indian Computer Emergency Response Team (CERT-In) or relevant sectoral regulators

9.7 How to Exercise Your Rights

To exercise any of these rights:

• Email us at privacy@markubees.com with your request
• Use the account settings in your dashboard for profile updates and account deletion
• We will respond to your request within 30 days (as required by Indian law)
• We may verify your identity before processing your request for security purposes

10. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to enhance your experience on the Platform:

10.1 Types of Cookies We Use

• Essential Cookies: Required for Platform functionality (authentication, session management, security). These cannot be disabled.
• Performance Cookies: Help us understand how visitors use the Platform (page views, session duration, error tracking)
• Functional Cookies: Remember your preferences and settings (language, timezone)
• Targeting/Advertising Cookies: Used to deliver relevant advertisements and measure campaign effectiveness (you can opt-out)

10.2 Managing Cookies

You can control cookies through:

• Browser settings: Most browsers allow you to refuse or delete cookies
• Cookie consent banner: Adjust your preferences when you first visit our Platform
• Note: Disabling essential cookies may affect Platform functionality

10.3 Third-Party Tracking

Third-party service providers (analytics, payment processors) may also use cookies and tracking technologies. Their use of your information is governed by their respective privacy policies.

11. Children's Privacy

Our Platform is not intended for individuals under the age of 18. We do not knowingly collect personal information from children under 18.

If you are a parent or guardian and believe your child has provided us with personal information, please contact us at privacy@markubees.com. We will take steps to delete such information from our systems.

12. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence, including India, the United States, and the European Union, where our service providers operate.

These countries may have data protection laws that differ from your jurisdiction. When we transfer personal information internationally, we ensure appropriate safeguards are in place:

• Data Processing Agreements with service providers containing Standard Contractual Clauses (SCCs)
• Ensuring service providers maintain adequate security measures
• Compliance with Indian cross-border data transfer requirements

By using our Platform, you consent to the transfer of your information to countries outside of your residence.

13. Third-Party Links and Services

Our Platform may contain links to third-party websites, services, or applications (e.g., LinkedIn profiles, portfolio websites) that are not operated by us.

We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies before providing any personal information. This Privacy Policy applies only to information collected by Markubees.

14. Video Session Privacy and Recording

Important Information About Video Sessions:

• No Recording by Default: Markubees does NOT record, store, or monitor video or audio content from Sessions by default
• WebRTC Technology: Video sessions use peer-to-peer WebRTC connections, meaning audio/video streams are transmitted directly between the two Users
• Metadata Collection: We collect session metadata (start time, end time, duration, participants) for billing and quality assurance
• User-Initiated Recording: If either party wishes to record a session, they MUST obtain explicit consent from all participants before recording. Any recording is the sole responsibility of the recording party
• Third-Party Recording: We are not responsible for recordings made by Users using third-party screen capture or recording software
• Privacy Expectations: We encourage all Users to communicate clearly about recording preferences and respect each other's privacy

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or Platform features.

When we make material changes:

• We will update the "Last Updated" date at the top of this policy
• We will notify you via email or a prominent notice on the Platform
• For significant changes, we may request your renewed consent

We encourage you to review this Privacy Policy periodically. Your continued use of the Platform after changes are posted constitutes your acceptance of the updated policy.

16. Grievance Officer (India Compliance)

In accordance with the Information Technology Act, 2000 and the rules made thereunder, we have appointed a Grievance Officer to address any concerns or complaints regarding personal data:

17. Additional Rights for International Users

17.1 European Union (EU) and United Kingdom (UK) Users - GDPR Rights

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have additional rights under the General Data Protection Regulation (GDPR):

Enhanced Rights:

• Right to Access: Obtain confirmation of whether we process your data and receive a copy in a portable format
• Right to Rectification: Correct inaccurate or incomplete personal data
• Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data when it is no longer necessary, processed unlawfully, or you withdraw consent
• Right to Restriction: Restrict processing in certain circumstances (e.g., while verifying accuracy)
• Right to Data Portability: Receive your data in a structured, machine-readable format and transmit it to another controller
• Right to Object: Object to processing based on legitimate interests or for direct marketing purposes
• Right to Withdraw Consent: Withdraw consent at any time without affecting prior processing
• Right to Lodge a Complaint: File a complaint with your local supervisory authority (Data Protection Authority)
• Automated Decision-Making: Right not to be subject to decisions based solely on automated processing (we do not currently use automated decision-making)

GDPR Legal Basis: We process EU/UK personal data based on:

• Your explicit consent (withdrawable at any time)
• Performance of our contract with you (providing Platform services)
• Compliance with legal obligations (tax, accounting, KYC)
• Legitimate interests (fraud prevention, security, platform improvement) where not overridden by your rights

EU Representative: Markubees does not have an establishment in the European Union, and our processing of EU personal data does not trigger the Article 27 GDPR representative requirement. EU, UK, and Swiss residents can reach us directly for any GDPR-related request at privacy@markubees.com.

Data Protection Authority Contacts:

• EU: Find your local DPA at https://edpb.europa.eu
• UK: Information Commissioner's Office (ICO) - https://ico.org.uk

17.2 California Residents - CCPA/CPRA Rights

If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

Your California Rights:

• Right to Know: Request disclosure of categories and specific pieces of personal information we collect, use, disclose, and sell
• Right to Delete: Request deletion of your personal information (subject to legal exceptions)
• Right to Opt-Out: Opt-out of the "sale" or "sharing" of personal information (Note: We do NOT sell your personal information)
• Right to Correct: Request correction of inaccurate personal information
• Right to Limit Use of Sensitive Personal Information: Limit use of sensitive data (financial info, precise geolocation) - we only use this for legitimate business purposes
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights

CCPA Categories of Personal Information We Collect:

• Identifiers (name, email, IP address)
• Commercial information (transaction history, payment records)
• Financial data (payment method, bank account for payouts)
• Internet/network activity (browsing history, Platform usage)
• Geolocation data (approximate location from IP address)
• Professional information (work history, credentials, for Users offering Sessions)
• Inferences (preferences, characteristics derived from usage)

How to Exercise California Rights: Email privacy@markubees.com with "California Privacy Request" in the subject line. We will respond within 45 days.

Authorized Agent: You may designate an authorized agent to make requests on your behalf. The agent must provide written authorization and we may verify your identity directly.

17.3 Other International Users

Users in other jurisdictions may have additional privacy rights under local laws:

• Canada (PIPEDA): Right to access, correct, and challenge compliance. Contact the Office of the Privacy Commissioner of Canada
• Australia (Privacy Act): Right to access and correct personal information. Contact the Office of the Australian Information Commissioner (OAIC)
• Brazil (LGPD): Rights similar to GDPR including access, correction, deletion, and portability. Contact ANPD (National Data Protection Authority)
• Singapore (PDPA): Right to access and correct personal data. Contact the Personal Data Protection Commission (PDPC)
• Other jurisdictions: Please contact us to exercise your rights under applicable local data protection laws

17.4 Response Time for International Requests

• GDPR (EU/UK): 30 days (extendable to 60 days for complex requests)
• CCPA (California): 45 days (extendable to 90 days with notice)
• Other jurisdictions: As required by applicable law, typically 30-45 days

18. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: