How Utivana collects, uses, stores and shares your data — including the AI providers we transmit tool inputs to, retention periods, and your rights over your data.
Version: v1 · Effective date: 2026-07-19 · Operated by Tribex Digital Pvt Ltd
Utivana ("Utivana", "we", "us", "our") operates a hub of free everyday utility tools and a sign-in-only tier of AI-assisted HR utilities. This Privacy Policy explains what personal data we collect, why we collect it, the legal basis for each use, who processes it on our behalf, how long we keep it, and the rights you have.
It is written to meet the notice requirements of the EU and UK General Data Protection Regulation (GDPR Art. 13/14), India's Digital Personal Data Protection Act 2023 (DPDPA §5), and US state privacy laws including the California Consumer Privacy Act as amended (CCPA/CPRA).
Controller / Data Fiduciary / Business: Tribex Digital Pvt Ltd Registered address: No 29, Hari Krupa, 3rd Cross, Aswath Nagar, RMV 2nd Stage, Bangalore 560094, Karnataka, India Privacy contact: [email protected] Data Protection Officer / privacy lead: Not appointed. We are not a Significant Data Fiduciary under the DPDPA and our processing does not meet the GDPR Art. 37 threshold, so no DPO is required. Privacy matters go to the Grievance Officer below. Grievance Officer (India, DPDPA §13): Hemant Bharati — [email protected]
| Free tools (converters, calculators, text and image utilities) | Usable without an account. Most run entirely in your browser and send us nothing. |
| PDF compression | Your file is uploaded, processed, and deleted. The input file is deleted immediately after processing; the output is deleted within one hour. |
| AI HR utilities | Require a free account. The text you submit is sent to an AI provider, processed, and returned to you. We do not store the text you submit or the AI's output. |
| What we do store | Your email address, your sign-in identifier, and a per-request ledger of AI usage (which tool, tokens, cost, whether it succeeded). |
| Marketing | We may email you about Utivana's own features and tools. We never sell, share, rent, or otherwise disclose your email address to any third party for their marketing. |
| Advertising | Any advertising we show is our own, served by us, on our own site. We do not run third-party ad networks or ad-tech tracking. |
| Tracking | No analytics, no advertising pixels, no third-party fonts, no cross-site tracking. |
This Policy covers the Utivana website and its tools.
One important exception. When you use the AI HR utilities to process information about other people — for example pasting a candidate's résumé or interview feedback — you, not Utivana, decide why and how that information is processed. In data-protection terms you are the controller (Data Fiduciary) and Utivana is your processor (Data Processor). Our handling of that data is governed by our Data Processing Agreement, not by this Policy, and the duty to inform those individuals sits with you. See section 9.
Most free tools — image resizing and conversion, calculators, unit converters, text utilities — execute entirely inside your browser. The file or text never leaves your device and never reaches our servers.
For any page you load, our servers necessarily receive the technical information every web server receives in order to return a response: your IP address, the requested URL, your browser's user-agent string, and the time of the request. We use this only to serve the site, keep it available, and detect abuse.
We do not operate any analytics product, advertising pixel, session recorder, or third-party font service on this site.
The PDF compression tool is the one free tool that processes your file on our server. When you use it:
A PDF can contain anything, including highly sensitive documents. Please do not upload anything you are not comfortable transmitting to a third-party service.
Accounts are required only for the AI HR utilities. Sign-in is handled by our identity service. We store, in our own database:
Your password is never seen or stored by Utivana; it is held by the identity service.
When you run an AI HR utility, the text you type or paste into the form is combined with a fixed instruction and sent to the AI provider that is active at that time. The response is streamed back to you.
Utivana does not store the text you submit or the output you receive. There is no database table in which they could be kept. They exist only in memory for the duration of the request. Section 6 explains exactly what the AI provider does with the text.
For every AI request we record a billing and abuse-control entry containing: which tool was used, the provider and model, the number of input and output tokens, the estimated cost, how long the request took, whether it succeeded, any error message, the pseudonymous account identifier of the person who made the request, and the timestamp.
This ledger contains no part of your input and no part of the AI's output. It exists so that we can enforce the free daily credit allowance, control cost, and investigate abuse and outages.
We do not knowingly collect special-category or sensitive personal data about our own users (health, biometric, genetic, racial or ethnic origin, political opinions, religious beliefs, trade-union membership, sex life or sexual orientation), and we do not ask for it. We do not collect payment card details. We do not build behavioural profiles, and we do not perform cross-context behavioural advertising.
Note that a résumé submitted to the HR utilities may itself contain sensitive information about a third party. That is content you supply as controller, and section 9 sets out your responsibilities for it.
| Purpose | Data used | Legal basis (GDPR / UK GDPR Art. 6) | Basis under DPDPA |
|---|---|---|---|
| Serving the website and its free tools | Technical request data (§3.1) | Legitimate interests (Art. 6(1)(f)) — operating and securing the service | Legitimate use — providing the service you requested (§7) |
| Compressing a PDF you upload | The uploaded file (§3.2) | Performance of a contract (Art. 6(1)(b)) — you asked for the file to be processed | Consent / legitimate use — you initiated the request (§6, §7) |
| Creating and operating your account | Account data (§3.3) | Performance of a contract (Art. 6(1)(b)) | Consent given at sign-up (§6) |
| Running an AI HR utility you requested | Your submitted text (§3.4) | Performance of a contract (Art. 6(1)(b)) | Consent / legitimate use (§6, §7) |
| Metering free credits, controlling cost, detecting abuse | Usage ledger (§3.5) | Legitimate interests (Art. 6(1)(f)) — preventing abuse and keeping a free service viable | Legitimate use (§7) |
| Sending you Utivana product and marketing email | Email address, display name | Consent (Art. 6(1)(a)), or legitimate interests where permitted for existing users of a similar service | Consent (§6) |
| Meeting legal, tax and regulatory obligations | Account data, usage ledger | Legal obligation (Art. 6(1)(c)) | Legal obligation (§7) |
Where our basis is legitimate interests, we have considered the impact on you and concluded that the processing is limited to what is necessary and is what a user of a free tool site would reasonably expect. You may object at any time — see section 10.
We may use the email address associated with your account to tell you about Utivana: new tools, changes to existing tools, service notices, and offers relating to our own products.
Three commitments, stated plainly:
We will not use your email address for any purpose materially different from those described here without telling you first and, where the law requires it, obtaining your consent.
We keep our processor list deliberately short. Each of the following processes data only on our instructions and for no purpose of its own.
| Sub-processor | What it processes | Why |
|---|---|---|
| OpenAI | The text you submit to an AI HR utility, when OpenAI is the active provider | Generating the AI output you requested |
| Anthropic | The text you submit to an AI HR utility, when Anthropic is the active provider | Generating the AI output you requested |
| The text you submit to an AI HR utility, when Google is the active provider | Generating the AI output you requested | |
| Our identity service (self-hosted Keycloak) | Email address, display name, credentials | Authenticating you |
| Our hosting provider | All data at rest and in transit on our infrastructure | Running the servers and database |
| AI provider configuration — this is important and specific. For each AI provider account we use, | ||
| we have enabled the provider's zero data retention and no training settings. This means that, | ||
| under our API agreements with them: |
We want to be precise about what this does and does not mean. Your text is transmitted to that provider's servers in order to be processed — it is not processed only on Utivana's own infrastructure. What we have contracted for is that it is not kept and not learned from once your response has been produced.
Only one AI provider is active at any given time. If we change the active provider or add a new one, we will update this list.
We may also disclose personal data where we are legally required to do so — for example in response to a valid order from a court or a competent authority — or where necessary to establish, exercise or defend legal claims. We will resist requests that are overbroad or unlawful.
Utivana is operated from India, and our infrastructure is hosted in Hetzner Online GmbH, in their Nuremberg, Germany data centre (EU).
The AI providers named in section 6 process data on servers outside the EU/EEA, the UK, and India, principally in the United States. So when you use an AI HR utility, the text you submit crosses an international border.
For those transfers we rely on the Standard Contractual Clauses approved by the European Commission (and the UK International Data Transfer Addendum for UK transfers), which are incorporated into our agreements with each provider, together with the zero-retention and no-training configuration described in section 6. For transfers out of India we rely on the transfers permitted under DPDPA §16, subject to any country restrictions notified by the Central Government from time to time.
You can request a copy of the transfer safeguards we rely on by writing to [email protected].
| Data | Retention |
|---|---|
| Text you submit to an AI utility, and the AI's output | Not retained. Held in memory for the duration of the request only. |
| Uploaded PDF (input) | Deleted immediately after processing. |
| Compressed PDF (output) | Deleted automatically within one hour. |
| Account record (email, display name, identifier, credits) | Kept while your account is open. Deleted or irreversibly anonymised after you close your account, other than what we must keep by law. |
| AI usage ledger | Kept for 12 months, after which the entries are aggregated into non-identifying statistics. The pseudonymous account identifier on ledger entries is irreversibly pseudonymised when you delete your account, so the cost record survives without pointing to you. |
| Marketing opt-out record | Kept indefinitely, because we need it to keep honouring your opt-out. |
| Server logs | Rotated daily and kept for 14 days, then deleted. |
We do not keep personal data "just in case". Where the purpose is exhausted, the data is deleted or irreversibly anonymised.
This section matters if you use the AI HR utilities to process information about someone else — a candidate's résumé, an interviewer's feedback, a profile to be analysed.
Depending on where you live, you have some or all of the following rights over the personal data we hold about you as a Utivana user:
If you are a US state resident (California, Colorado, Connecticut, Virginia and other states with comparable laws), you also have the right to know the categories of personal information we collect and the purposes for which we use them (set out in sections 3 and 4), the right to opt out of the sale or sharing of personal information, the right to opt out of targeted advertising, the right to limit the use of sensitive personal information, and the right not to be discriminated against for exercising any of these rights.
We want to be clear about the opt-out rights: we do not sell personal information, we do not share it for cross-context behavioural advertising, and we do not use it for targeted advertising by third parties. There is therefore nothing for you to opt out of — but if that ever changes we will update this Policy and provide the opt-out mechanism the law requires before the change takes effect.
How to exercise a right. For two of these you do not need to contact us at all — while signed in to your account you can download a copy of your data and delete your account directly from your account settings. Deletion is immediate and irreversible: your account record is removed, and the pseudonymous identifier on our AI usage ledger is irreversibly scrambled so the cost record survives without pointing to you.
For any other right — correction, restriction, objection, withdrawal of consent, nomination, or a grievance — write to [email protected] from the email address associated with your account. We will verify that the request comes from you (or from an authorised agent acting for you) and respond within 30 days, or within the shorter period your local law requires. If we need longer because a request is complex, we will tell you why. Exercising any of these rights is free of charge unless a request is manifestly unfounded or excessive.
Complaints. If you are unhappy with how we have handled your data, please tell us first — we would rather fix it. You also have the right to complain to your data protection regulator: your local supervisory authority in the EU/EEA (GDPR Art. 77), the Information Commissioner's Office in the UK, the Data Protection Board of India, or your state Attorney General in the United States.
Utivana does not set advertising or analytics cookies, and does not use any third-party tracking technology.
When you sign in, our application stores your authentication tokens in your browser's local storage — not in cookies. This is a technical distinction worth stating precisely: local storage is a browser feature that keeps data on your own device and, unlike a cookie, is not transmitted automatically with every request. These tokens are strictly necessary to keep you signed in, and are therefore exempt from consent requirements. They are cleared when you sign out, and you can clear them yourself at any time through your browser settings.
Our identity service may set a session cookie during the sign-in process. That cookie is also strictly necessary for authentication.
If we ever introduce analytics or any non-essential storage, we will ask for your consent first, before that storage is set or that request is made, and we will update this section.
Utivana is not directed at children. You must be at least 18 years old to create an account. The free tools are general-purpose utilities and are not designed for, marketed to, or targeted at children.
We do not knowingly collect personal data from children. We do not carry out behavioural tracking or monitoring of children, and we do not direct advertising at children. If you believe a child has created an account or provided us with personal data, contact [email protected] and we will delete it.
We protect personal data with technical and organisational measures appropriate to the risk (GDPR Art. 32; DPDPA §8):
No system is perfectly secure. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours of becoming aware of it (GDPR Art. 33), notify the Data Protection Board of India and each affected person as the DPDP Rules require, and notify you directly without undue delay where the risk to you is high (GDPR Art. 34).
Security contact: [email protected] — if you believe you have found a vulnerability, please report it to us there and give us a reasonable opportunity to fix it before disclosing it publicly.
The AI HR utilities produce analysis and suggestions to help a human make a decision. They are not designed to make decisions about people automatically, and their output must not be used as the sole basis for a decision that has a legal or similarly significant effect on someone — including a hiring, shortlisting or rejection decision.
Utivana does not use automated decision-making to make decisions about you as our user, and we do not profile you.
If you use our HR utilities in relation to other people, you are responsible for ensuring a competent human being reviews the output and makes the actual decision. Our Terms of Service make this binding, and section 9 explains why the obligation sits with you.
We will update this Policy whenever our data practices change — for example if we add a sub-processor, begin using a new category of data, or introduce advertising or analytics. The version number and effective date at the top will change, and for material changes we will take reasonable steps to notify signed-in users before the change takes effect. Where a change requires your consent, we will ask for it rather than assume it.
Past versions are retained so you can see what applied when.
| Privacy questions and rights requests | [email protected] |
| Data Protection Officer / privacy lead | Not appointed (not required) — contact the Grievance Officer |
| Grievance Officer (India, DPDPA §13) | Hemant Bharati — [email protected] |
| Security reports | [email protected] |
| Postal address | No 29, Hari Krupa, 3rd Cross, Aswath Nagar, RMV 2nd Stage, Bangalore 560094, Karnataka, India |
| Operating entity | Tribex Digital Pvt Ltd |