Privacy Policy

1. Who we are

This Privacy Policy applies to the website and online services operated by Himalayan Performance Labs (“HPL”, “we”, “us”, or “our”), based in Solan, Himachal Pradesh, India. Contact: [email protected].

We provide automotive reverse-engineering and related technical services (for research and off-road use) through our website at himalayanperformance.com and related subdomains (including client and admin portals).

2. Scope and applicable law

This Policy explains how we process personal data when you visit our site, create an account, submit a service request, or make a payment. We process personal data in accordance with applicable Indian law, including the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023 (DPDP Act), to the extent in force and applicable to us, and other rules that may apply.

By using our services, you acknowledge this Policy. Where consent is required, we will obtain it (for example at account signup or before optional communications).

3. Data we collect

Depending on how you use our services, we may collect:

• Identity and contact data: name, email address, phone number, company name, and country.
• Account data: login credentials (passwords are stored hashed by our authentication provider), account status, and password-reset records.
• Service data: vehicle / ECU details, notes, files or binaries you upload, and submission status.
• Transaction data: order identifiers, amounts, currency, payment method, and payment status (we do not store full card numbers; card payments are processed by our payment partners).
• Technical data: IP address, browser type, device information, and basic usage logs needed for security and reliability.

We do not intentionally collect sensitive personal data except where you voluntarily provide information necessary for a service request.

4. Why we use your data

We use personal data to:

• Create and manage client accounts and authenticate users.
• Provide reverse-engineering / binary services you request.
• Process payments and prevent fraud.
• Send transactional emails (OTP, passwords, order or status notices).
• Respond to support requests and enforce our Terms of Service.
• Maintain security, debug issues, and improve our website.
• Comply with legal, tax, accounting, and regulatory obligations.

We do not sell your personal data. We do not use your uploaded ECU binaries or project files for marketing to third parties.

5. Legal bases (where required)

We process data where one or more of the following apply:

• You have given consent (e.g., creating an account).
• Processing is necessary to perform a contract with you or to take steps at your request before a contract.
• Processing is necessary for legitimate uses such as security, fraud prevention, and service improvement, balanced against your rights.
• Processing is required to comply with law.

6. Sharing and processors

We use trusted service providers who process data on our behalf, under appropriate contractual and security terms, including for example:

• Hosting and content delivery (e.g., Cloudflare).
• Authentication and database hosting (e.g., Supabase).
• Transactional email delivery (e.g., Resend).
• Payment processing (e.g., Razorpay and, where used, other payment or transfer providers you choose).

Some providers may process data outside India. Where cross-border transfer occurs, we take steps consistent with applicable law and provider safeguards. We may also disclose data if required by court order, government authority, or to protect rights, safety, or security.

7. Retention

We retain personal data only as long as needed for the purposes above, including to provide services, resolve disputes, enforce agreements, and meet legal retention requirements. Service files and submission records may be retained for the life of the project relationship and a reasonable period afterward for support and compliance, unless a shorter period is agreed in writing or required by law. You may request deletion subject to Section 9 and legal exceptions.

8. Security

We use reasonable technical and organisational measures to protect personal data (including encrypted transport, access controls, and authentication). No method of transmission or storage is completely secure; you use the services at your own residual risk. Notify us promptly at [email protected] if you suspect unauthorised access to your account.

9. Your rights

Subject to applicable law, you may request access, correction, updating, or erasure of your personal data, withdrawal of consent (where processing is consent-based), and grievance redressal. To exercise these rights, email [email protected] with sufficient detail to verify your identity. We may refuse or limit requests where permitted by law (for example, legal retention or overlapping rights of others).

10. Children

Our services are directed to businesses and adults. We do not knowingly collect personal data from children. If you believe a child has provided data, contact us and we will take appropriate steps.

11. Cookies and similar technologies

We use essential cookies or local storage required for login sessions and security. We do not use third-party advertising cookies on the core service pages. Your browser settings may allow you to block cookies; some features (such as login) may not work without them.

12. Changes

We may update this Policy from time to time. The “Last updated” date at the top will change when we do. Continued use of the site after an update constitutes acceptance of the revised Policy, except where additional consent is required by law.

13. Grievance / contact

For privacy questions or complaints, contact Himalayan Performance Labs, Solan, Himachal Pradesh, India, at [email protected]. We will aim to respond within a reasonable period.