Privacy Policy

This Privacy Policy explains how hotomol(“we”, “our”, “us”) collects, uses, stores, and discloses your personal data when you use hotomol.com and related services (the “Service”).

We aim to comply with India's Digital Personal Data Protection Act, 2023 (DPDP Act), the EU/UK General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and similar laws in other jurisdictions where our users are located.

1. Who we are

hotomol is operated by Advaith Sankar Mohan, a sole proprietor doing business under the name “hotomol” in India. Because a sole proprietorship is not a separate legal entity from its owner, Advaith Sankar Mohan is personally the Data Fiduciary(under India's Digital Personal Data Protection Act, 2023) and Data Controller (under the EU and UK GDPR) for your personal data.

For any privacy-related request, question, or complaint, reach us at support@hotomol.com.

2. What data we collect

You provide:

• Email address — used to send you magic sign-in links and service notices
• Username — public, permanent, part of your page URLs
• HTML files you upload — hosted and displayed at URLs of the form hotomol.com/u/username/slug
• Visibility setting for each page (public or unlisted)

We observe automatically:

• Technical logs — IP address, user agent, timestamps, HTTP status of requests. Used for security, debugging, and abuse prevention.
• Session cookie — a signed JWT named hotomol_session that keeps you logged in. Strictly necessary for the Service to function.

We do NOT currently use:

• Third-party analytics
• Advertising cookies or trackers
• Cross-site tracking pixels
• Data brokers or enrichment services

If this changes, we will update this Policy and, where required, obtain your consent.

3. Why we process your data (lawful basis)

• To provide the Service(email, username, pages): performance of a contract with you (GDPR Art. 6(1)(b); DPDP Sec. 7(a))
• Security, fraud, and abuse prevention(logs): our legitimate interests (GDPR Art. 6(1)(f)), balanced against your rights
• Compliance with law(responding to legitimate legal requests): legal obligation (GDPR Art. 6(1)(c))

4. Who we share data with

We do not sell your personal data. We share it only with processors that help us run the Service, each bound by contractual data protection obligations:

• Railway (railway.app) — application hosting, managed PostgreSQL database, and persistent volume storage for uploaded files
• Resend (resend.com) — transactional email delivery for sign-in links

We may also disclose data to comply with law, enforce our Terms, or protect the rights, property, or safety of our users or the public. Where legally permitted, we will notify you of any such requests.

5. Where your data lives (international transfers)

Our processors may store data outside your country, including in the United States and the European Union. Where applicable we rely on Standard Contractual Clauses or equivalent safeguards for transfers outside India, the EEA, or the UK.

6. How long we keep data

• Account & pages — until you delete them, or until you delete your account
• Magic-link tokens — expire after 15 minutes; purged shortly after
• Server logs — typically 30 days
• Backups — up to 30 days after deletion, then expired on rolling schedule

7. Your rights

Depending on your jurisdiction, you have rights over your personal data, which may include:

• Access — get a copy of the data we hold about you
• Rectification — correct inaccurate data
• Erasure— delete your account and associated data (“right to be forgotten”)
• Portability — receive your data in a machine-readable format
• Restriction — limit how we use your data
• Objection — object to processing based on legitimate interests
• Withdraw consent — where processing is based on consent
• Not be subject to automated decision-making (we do not make any)
• Lodge a complaint with your supervisory authority (e.g., the Data Protection Board of India, or your EU/UK DPA)

You can exercise erasureat any time by clicking “Delete account” in your dashboard. For other requests, email support@hotomol.com and we will respond within 30 days.

8. Cookies

We currently use only one strictly-necessary cookie:

• hotomol_session — a signed JWT that authenticates your browser after you click a magic link. Lasts 30 days. Without this cookie, the Service cannot keep you logged in.

Under the EU ePrivacy Directive, strictly-necessary cookies do not require consent. We do not use analytics, advertising, or tracking cookies.

9. Children

The Service is not intended for children under 13. If you become aware that a child under 13 has provided us with personal data, please contact support@hotomol.com and we will delete it. In some jurisdictions (including the EU under GDPR), the minimum age without parental consent is 16.

10. Security

We take reasonable technical and organisational measures to protect your data, including encryption in transit (HTTPS), HTTP-only secure cookies, server-side input validation, sandboxed iframes for user-hosted content, rate-limiting, and restricted access to production systems. However, no service can guarantee perfect security.

In the event of a personal data breach likely to result in risk to your rights and freedoms, we will notify the relevant supervisory authority and affected users within 72 hours of becoming aware, as required by law.

11. California (CCPA) disclosures

If you are a California resident, you have the right to know what personal information we collect, request deletion, request a copy, and not be discriminated against for exercising these rights. We do not sell or share your personal information for cross-context behavioural advertising. To exercise CCPA rights, email support@hotomol.com.

12. Changes to this policy

We may update this Privacy Policy to reflect changes in our practices or for legal, operational, or regulatory reasons. We will revise the “Last updated” date at the top and, for material changes, notify you by email or an in-app notice.

13. Contact

For any privacy-related question, request, or complaint, email support@hotomol.com.

This Policy has not been reviewed by a lawyer. If you are the operator of hotomol, please obtain qualified legal advice before publishing it.