Calmtree logoCalmtree

Legal & Compliance

Our policies, terms and disclosures to ensure a safe, transparent and responsible experience on Calmtree.

Privacy Policy

Last updated: 20 Oct 2026

This page is not final. 5 details are still to be confirmed, and it has not yet been reviewed by legal counsel. It is published so it can be checked, not relied upon.

1. Who we are

Calmtree Pvt Ltd operates calmtree.in and its related services. Our registered office is at to be confirmed before launch, Mumbai, Maharashtra, India.

This policy covers everyone who uses Calmtree: people who take assessments for themselves, and people invited to take one by their employer. Where the two differ, it says so.

2. You must be 18 or older

Calmtree is for adults. You confirm that you are 18 or older when you accept the assessment consent notice, and we do not knowingly collect data from anyone younger.

If you believe someone under 18 has given us data, tell us at grievance@calmtree.in and we will delete it.

3. What we collect

  • Account details: your email address, and anything you choose to add to your profile.
  • Assessment answers: the option you chose for each question, and the result those produce.
  • How you answered: how long each question was on screen. This is used to judge how much weight a set of responses can carry, and to check our assessments are working as intended. It is behavioural data about you, it is never shown to anyone else including an employer, and it is not used to identify you.
  • Consent records: which version of which notice you accepted, and when. We keep the wording of every past version so that record stays meaningful.
  • Purchases: what you bought and when. Card and account details are handled by our payment provider and never reach us.
  • Usage data: pages visited and features used, only if you accept analytics on the cookie banner. See the Cookie Policy.
  • Messages: anything you send us.

There is no free-text field in any assessment. Every answer is a scale value or an option, so there is nowhere to enter personal detail even by accident.

4. Why we use it

To score your assessment and show you a result; to store that result if you asked us to; to take payment; to answer you when you write to us; to produce confidential group reporting for organisations, described in section 6; to improve the assessments; and to meet legal obligations.

We do not sell your data. We do not share it with advertisers. We do not use your answers to train anything, and we do not use them to target advertising anywhere.

5. Assessments you take for yourself

Your result is yours. Nobody else sees it. If you take an assessment without an account, it is held in your browser for that visit and is not sent to us unless you create an account to keep it.

You can delete any result, download everything we hold, choose which emails you get, or delete your account, from Your data once signed in. Deleting a result removes its answers with it.

6. Surveys your employer invited you to take

Workplace surveys work differently, and have their own notice: the workplace privacy notice. In short, your employer never sees your individual answers, your comment or how long you took; it sees group results only for groups of at least 7 people. Your workplace answers are never linked to a personal Calmtree account.

7. Who else processes your data

We use these providers to run the service. They act on our instructions and cannot use your data for their own purposes.

ProviderWhat forData stored in
SupabaseDatabase, authentication and file storageto be confirmed before launch
VercelWebsite hosting and content deliveryglobal edge network
PostHogProduct analytics: page views and feature events, no session recordingUnited States
RazorpayPayment processing. Card details are handled by Razorpay and never reach CalmtreeIndia
CloudinaryImage and media deliveryto be confirmed before launch
ResendSending email: survey invitations and reminders, receipts, account notices and organisation alertsto be confirmed before launch
SentryError reports from our servers, which may carry an account or organisation id but never answers or resultsto be confirmed before launch
GoogleSigning in with a Google account, only for people who choose it; Google tells us your name and email addressglobal

Some of these store data outside India, which is noted in the table. We may also disclose data where the law requires it, and we will tell you when we are permitted to.

8. How long we keep it

  • Your results: until you delete them or close your account.
  • After you close your account: 30 days, then deletion is irreversible.
  • Employer-invited responses: 24 months, or until the organisation's account closes.
  • Analytics: 14 months.

Records we are required to keep for tax or legal reasons are kept for as long as the law requires, and for nothing else.

9. Security

Data is encrypted in transit and at rest. Access is enforced by rules in the database itself rather than by application code alone, so your data stays yours even if a query is wrong. Staff access is restricted to named administrator accounts.

No system is perfectly secure, and we do not claim to be. If a breach affects your data, we will tell you and the Data Protection Board of India without undue delay.

10. Your rights, and who to contact

You can see, correct, download or delete what we hold, withdraw consent, nominate someone to act for you, and complain. How to do each of those, our response times, and Alok Jha's contact details as grievance officer are on the Your Data and Rights page.

11. Changes

We may update this policy. Changes are posted here with a new effective date. Where a change affects what you consented to, we ask again rather than assuming your previous answer carries over.