Privacy Policy

This Privacy Policy explains how Plato ("we", "us", or "our") collects, uses, discloses, and protects personal information when you use the Plato platform, including our website, applications, and related services (collectively, the "Platform").

Plato is a community-management platform that helps organizers and members run events, track attendance, generate certificates, and collaborate. The Platform is operated by Blear and related entities ("we"). If you have questions about how your data is handled, you can reach us at hello@blear.in.

This Policy applies to personal information we process when you:

• create or use an account on the Platform;
• join or manage a community;
• create, register for, or attend events;
• generate or verify certificates;
• communicate through the Platform; or
• otherwise interact with the Platform or its administrators.

This Policy does not apply to third-party services you access through the Platform, unless we say otherwise.

We collect information that is necessary to operate the Platform and to provide the features you use. We aim to collect only what is needed for a legitimate purpose (data minimization).

• Account and profile information — such as your name, email address, and profile image, as well as any organization/community details you choose to add.
• Community and event information — community names and descriptions, event details, member rosters you manage, announcements, and similar content you submit.
• Communications — messages you send through the Platform, email communications, and responses to event forms.
• Certificates and files — information needed to generate certificates and files you upload to the Platform.

We do not require government-issued identity documents. You are not asked to provide an Aadhaar number, PAN, passport, driving licence, voter ID, or similar identity document to create an account or to use the Platform.

Account authentication is handled by our authentication provider, Clerk. When you sign up or sign in, Clerk processes the credentials you provide (such as email and password, or a social login) on our behalf and supplies us with an authenticated user identifier and basic profile information (such as your name and email). We do not store your password, and account ownership verification relies on the authenticated session established with our authentication provider — not on identity documents.

When you use the Platform, we may collect limited technical information about how you use it, including:

• the pages or sections you visit;
• the date and time of visits;
• browser type, operating system, and device type;
• coarse location data (such as country, region, or city) derived from your network connection, where we are able to derive it; and
• referrer information.

This information is used for product analytics and to understand how the Platform is used so we can improve it.

As part of handling network requests, the servers that operate the Platform receive the IP address of the device connecting to them. This is ordinary network processing and is not unique to Plato.

We do not store your raw IP address in our product-analytics records. For analytics purposes, we may store a privacy-preserving identifier derived from your IP using a server-side keyed hash (an HMAC). This means the identifier cannot be reversed to recover your IP address, and it is used only for limited correlation purposes. The key used to derive this identifier is kept secret and is never exposed to browsers or users.

Where the Platform records location information (for example, in analytics), it stores only coarse location data such as country, region, or city. We do not collect precise real-time geolocation (such as GPS coordinates) unless a specific feature you are using requires it and you have chosen to provide it.

We and our service providers use cookies and similar technologies to keep you signed in, remember preferences, and understand how the Platform is used. The authentication provider and hosting providers may set their own cookies necessary for their services. You can usually control cookies through your browser settings, though some Platform features may not work if you disable them.

We use personal information to:

• provide, operate, and maintain the Platform;
• authenticate users and protect accounts;
• manage communities, events, memberships, and certificates;
• send notifications, announcements, and service communications;
• process privacy requests (access, correction, export, deletion, grievances);
• improve and analyze the Platform;
• detect, prevent, and respond to abuse, fraud, and security incidents; and
• comply with applicable legal obligations.

We do not sell your personal information, and we do not use your data for unrelated purposes without an appropriate basis or notice.

We design the Platform to collect only the personal information reasonably needed for the purposes described in this Policy. We do not collect unnecessary personal data, and we do not require identity documents, date of birth, or other sensitive identifiers to use the Platform.

We design and operate the Platform with applicable Indian data-protection and cybersecurity requirements in mind, including the Digital Personal Data Protection Act, 2023, and applicable rules and regulations once they are applicable to the processing described here. Depending on the activity, we process personal data to provide the service you requested, to fulfill a contract, to comply with legal obligations, to protect legitimate interests (such as security and fraud prevention), or on the basis of consent where we ask for it. This Policy is not a legal certification, and nothing in it should be read as a claim of certification or compliance with a specific statute.

We do not sell your personal information. We share personal information only as needed to operate the Platform, including with service providers who process data on our behalf, with community organizers who administer the communities you join, or where required by law. Sharing with a community is limited to the information needed to operate that community (for example, your name and email so organizers can manage membership and events).

The Platform relies on third-party service providers for core operations. These providers process data on our behalf subject to appropriate arrangements. The principal providers include:

Clerk provides authentication and account management. Clerk processes sign-in credentials, sessions, and basic profile information on our behalf. Account deletion is coordinated with Clerk as part of our deletion workflow. You can review Clerk's privacy practices at clerk.com/privacy.

Turso / LibSQL provides our primary database. Our database is hosted in the ap-south-1 (Mumbai) region. Data stored in the database includes account records, community and event data, messages, analytics, audit records, and privacy-request records.

Cloudflare provides edge hosting and infrastructure. Cloudflare may process data as part of serving and protecting the Platform, in accordance with its own terms and privacy practices.

Cloudflare R2 provides object storage for files you upload to the Platform, such as avatars, banners, event assets, and certificate-related files. During an approved account deletion, files owned by your account are deleted where they can be identified as yours. Community-owned or shared files are not deleted when one member leaves.

Resend is used to send transactional and notification emails, such as event invitations, attendance confirmations, announcements, and certificate emails. We provide Resend only the information needed to deliver the message (such as the recipient email address and relevant message content).

Grafana Cloud is used for observability, including operational metrics, traces, and logs used to keep the Platform reliable and secure. We configure this so that sensitive content — such as passwords, tokens, cookies, and personal message contents — is not included in telemetry.

Some of the third-party services we use may process or store data outside India as part of providing their services, in accordance with their service terms and applicable contractual arrangements. For example, our authentication provider, email provider, and observability provider operate global infrastructure. We do not represent that all data remains within India at all times. Where processing occurs outside India, it is subject to the provider's applicable safeguards and our arrangements with them.

We retain personal information only as long as necessary for the purposes described in this Policy or as required by law. Retention differs by category:

• Account data — retained while your account is active and processed for deletion when you submit an approved account-deletion request.
• Product / navigation activity — page-visit analytics are retained for approximately 90 days.
• Security / ICT logs — security-relevant events are retained for approximately 365 days.
• Admin audit records — privileged administrative actions are retained for approximately 730 days for accountability.
• Temporary data exports — generated exports and download links expire within approximately 7 days.
• Certificates and attendance — retained for verification and operational purposes in accordance with applicable requirements.
• Backups — backup copies may persist for the backup lifecycle and expire according to the backup retention schedule; data is not instantaneously removed from every backup copy when you delete it from the live Platform.

You can request deletion of your account from the Privacy area of your Settings. Account deletion is a request/approval workflow:

• you submit an account-deletion request while signed in;
• the request is reviewed by a platform administrator; a Super Admin is responsible for approving or rejecting deletion requests;
• once approved, our deletion service removes or anonymizes your records in stages — including database records, your authentication account with our authentication provider, OAuth/integration credentials, and user-owned files stored with our file provider.

Some records may be retained where necessary for security, fraud prevention, legal obligations, dispute resolution, or audit accountability. Certain shared records (such as community events, certificates, attendance history, and audit logs) are retained — where appropriate, personal identifiers are anonymized. Backups may expire according to the backup retention lifecycle rather than disappearing instantaneously.

You can request an export of your personal information from the Privacy area of your Settings. Generated exports are temporary and expire after a short period.

Exports include your relevant personal information held by the Platform and never include passwords, authentication secrets, access or refresh tokens, API keys, internal security information, or other users' personal data.

You can update your profile and account information directly in your settings. Where you identify information that is inaccurate, you may request a correction through the Platform's privacy request mechanism, and we will review and process eligible correction requests.

You may use the Platform's privacy request mechanism to raise supported requests, including access, correction, export, deletion, and privacy grievances. Requests are processed through the Platform's privacy workflow and, where applicable, reviewed by platform administrators. You can track the status of your request from the Privacy area of your Settings.

If you have a privacy concern or grievance, you can raise it through the Platform's privacy request mechanism or contact us at hello@blear.in. We will review your concern and respond in a reasonable time. For security-related concerns, you may contact us at security@blear.in.

We implement reasonable technical and organizational measures to protect personal information against unauthorized access, disclosure, alteration, and loss, including:

• encryption in transit;
• authenticated access and role-based authorization;
• audit logging of privileged administrative actions;
• security logging and monitoring;
• rate limiting and abuse controls; and
• regular backups and an incident-response process.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

In the event of a security incident affecting personal data, we will follow our internal incident-response process, take reasonable steps to contain and remediate the incident, and — where required by applicable law or our obligations — notify affected users and relevant authorities. Where Indian regulations (such as CERT-In directions) require specific reporting, we will follow those requirements as applicable.

The Platform is not designed for children. Users are required to be at least 18 years old. We do not knowingly collect personal information from children, and we do not build profiles of or target children for behavioral advertising. If you believe a child has provided us personal information, please contact us so we can take appropriate action.

Plato is intended for users who are at least 18 years old. During onboarding, users are asked to confirm they are 18 or older. We do not collect your date of birth and do not use government-issued identity documents to verify age.

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date and, where appropriate, notify users. Continued use of the Platform after changes take effect constitutes acceptance of the updated Policy.

If you have questions about this Privacy Policy or how your data is handled, please contact us:

• Email: hello@blear.in
• Security: security@blear.in

If additional details such as a registered business address or a designated grievance officer are required, these will be published here once confirmed by the operating entity.