Privacy Policy

Access Code: A unique credential issued by InvincibleYOU for a Participant to access and complete one Assessment submission.

DRIFT Assessment: A behavioural and organizational assessment measuring Performance, Innovation, Talent, Accountability, Strategic, and Cultural Drift at the organizational level, and Benevolence, Reciprocity, Information Velocity, Dependability, Goal Alignment, and Ethical Standards Drift at the team level.

Participant: An individual invited by a Sponsoring Organization to complete the DRIFT Assessment through the Tools Website.

Sponsoring Organization: The employer, institution, or client entity that engages InvincibleYOU to administer the DRIFT Assessment and identifies intended Participants.

Supabase: The database and backend infrastructure used to store and process assessment data. For purposes of this Policy, the relevant DRIFT project is hosted in India (ap-south-1, Mumbai).

Tools Website: The web application located at tools.invincibleyou.world through which the DRIFT Assessment is administered.

This Privacy Policy (“Policy”) describes how InvincibleYOU, a product/service operated by Vedanga Solutions Private Limited (“InvincibleYOU,” “Company,” “We,” “Us,” or “Our”), collects, uses, processes, stores, and discloses information in connection with the DRIFT Assessment and related assessment tools made available through the Tools Website.

This Policy applies to individuals who access the Tools Website, including Participants who complete the DRIFT Assessment using an Access Code. Provisions concerning Assessment responses, demographic information, Access Codes, and Sponsoring Organizations apply specifically to Participants. This Policy should be read together with the InvincibleYOU Privacy Policy and applicable Terms of Use governing the broader InvincibleYOU ecosystem.

Before commencing the Assessment, Participants are presented with the applicable notice and consent choices and must provide the required consent before processing that requires consent begins.

Access to the DRIFT Assessment is made available through an organization-sponsored engagement. InvincibleYOU’s internal authorized personnel provision Participant records and Access Codes based on information supplied by the Sponsoring Organization.

Each Access Code is intended for one Participant and one completed submission. Participants do not create an independent password-based account through the Tools Website.

The Sponsoring Organization receives only the aggregated and appropriately suppressed reports described in this Policy. Individual response data is not disclosed to the Sponsoring Organization as an individually attributed report.

We collect the following categories of information:

• Credential data: email address and Access Code, used to authorize and administer an Assessment session.
• Demographic data: gender, age group, industry, and function/role, together with an optional free-text “about” field.
• Assessment responses: 48 Likert-scale (1-5) ratings across the organization-level and team-level DRIFT dimensions.
• Subjective feedback: up to 2 optional open-ended responses concerning execution barriers and recommendations.
• Technical data: IP address, browser type, device information, timestamps, access-code validation attempts, and error/security logs collected in connection with operation and security of the Tools Website.

The Tools Website may use strictly necessary cookies or similar technologies for security, session functionality, fraud prevention, and operation. If analytics or non-essential tracking technologies are introduced, the applicable notice and consent mechanism will be updated before such technologies are deployed where required by law.

Gender, age group, industry, and function/role are used for statistical analysis and segmentation of aggregate assessment results. The optional “about” field is not mandatory and is used only to provide additional qualitative context.

To reduce the risk of inference from small groups, demographic or other segmented results will not be displayed to the Sponsoring Organization where the relevant reporting cell contains fewer than five Participants, unless a higher threshold is required by applicable law or the reporting methodology.

Assessment responses are stored at the individual submission level for assessment administration, scoring, security, and related operational purposes. Individual responses may therefore exist within InvincibleYOU’s systems and should not be understood as technically anonymous merely because reports supplied to the Sponsoring Organization are aggregated.

Reports provided to the Sponsoring Organization are generated on an aggregated basis and are subject to the minimum reporting threshold described above. The Sponsoring Organization does not receive an individually attributed response report through the DRIFT reporting interface.

Before commencing the Assessment, Participants are presented with the applicable consent and assessment notice. Consent choices are presented separately where required by applicable law, and withdrawal of consent is provided through a mechanism that is reasonably accessible and comparable to the manner in which consent was given.

The Tools Website does not create a persistent password-based account for a Participant. Authentication is limited to validation of the email address and Access Code against the assessment records maintained for the engagement. Participants cannot change a password because no password-based account is created.

• Verifying authorization to participate in the Assessment.
• Preventing duplicate or unauthorized submissions.
• Administering, scoring, and generating aggregated organizational and team-level DRIFT reports.
• Providing authorized users with aggregated assessment results through applicable InvincibleYOU reporting interfaces.
• Statistical analysis, service quality, security, fraud prevention, troubleshooting, and product improvement.

Under the Digital Personal Data Protection Act, 2023 (India), personal data is processed on the basis of consent where consent is required, together with processing necessary for lawful purposes permitted under applicable law. Consent is obtained through a clear affirmative action after the relevant notice is made available.

Where the GDPR applies, processing may additionally rely on the legal bases applicable to the particular processing activity, including consent under Article 6(1)(a), legitimate interests under Article 6(1)(f) for security and duplicate-submission prevention where appropriate, and legal obligation under Article 6(1)(c).

DRIFT responses are processed using statistical scoring methodologies to calculate dimension-level scores across the twelve DRIFT dimensions. No artificial intelligence or large language model is used to generate, interpret, or influence an individual Participant’s DRIFT score. Reports supplied to the Sponsoring Organization are generated from statistical and aggregated outputs.

We may share the minimum information necessary with service providers that support operation of the Tools Website, subject to appropriate contractual and security safeguards.

• Supabase — database and backend infrastructure for storing and processing assessment data; the relevant DRIFT project is hosted in India.
• Resend — transactional email delivery, including processing of email addresses for assessment-related communications and reminders.
• Next.js hosting/infrastructure provider — hosting and delivery of the Tools Website and associated technical services.

We do not sell Participant personal data to third parties for monetary consideration or commercial exploitation.

We maintain commercially reasonable administrative, technical, and organizational safeguards appropriate to the nature of the data and the Services, including HTTPS/TLS encryption in transit, encryption at rest where supported by the relevant infrastructure, access controls, authentication controls, logging, and security measures designed to restrict access to authorized personnel and systems.

Access controls and database security mechanisms are configured to support least-privilege access. No security measure can guarantee complete security.

We retain personal data only for as long as necessary for the purposes for which it was collected, including assessment administration, security, fraud prevention, legal compliance, and legitimate operational requirements.

Identifiable Participant records, including email addresses and Access Codes, will not be retained beyond two years after the end of the relevant assessment cycle or employer engagement, unless a longer period is required by applicable law or necessary to establish, exercise, or defend legal claims.

Assessment responses may be retained in aggregated or appropriately de-identified form after the identifiable retention period where the data is no longer reasonably capable of being attributed to an identifiable Participant.

Participants may request deletion of their personal data by contacting the Grievance Officer. Requests will be handled in accordance with applicable law and will not be conditioned merely on the Sponsoring Organization’s operational preference.

Subject to applicable law, Participants may exercise rights including access, correction/rectification, erasure, withdrawal of consent, grievance redressal, and the right to nominate another individual to exercise specified rights in the event of death or incapacity, where provided by applicable law.

Where the GDPR applies, Participants may additionally exercise rights including restriction of processing and objection, as applicable.

Requests may be submitted to the Grievance Officer through the contact details below. We may request reasonable information necessary to verify the identity or participation of the requester.

A Participant who is dissatisfied with the response may pursue any escalation or complaint mechanism available under applicable data protection law, including before the Data Protection Board where applicable.

The DRIFT Assessment is intended for working professionals and is not directed at individuals under 18 years of age. We do not knowingly seek to collect children’s personal data through the Assessment. If we become aware that children’s data has been collected in circumstances requiring deletion or other action under applicable law, we will take appropriate steps.

Information may be processed or stored in jurisdictions outside a Participant’s country of residence where necessary for the Services or where service providers maintain infrastructure. Under the Digital Personal Data Protection Act, 2023, transfers are permitted except to countries or territories notified as restricted by the Government of India. Where the GDPR applies, we use applicable safeguards such as Standard Contractual Clauses, adequacy decisions, or equivalent lawful mechanisms.

We maintain administrative and security logs, including submission timestamps, access-code validation attempts, security events, and error logs, for security, fraud prevention, troubleshooting, and compliance purposes. Security logs are retained only for as long as reasonably necessary for these purposes and applicable legal requirements.

Where a personal data breach occurs, InvincibleYOU will assess and respond to the incident in accordance with applicable law and will provide required notifications to the Data Protection Board and affected Data Principals within the applicable statutory timelines and in the manner prescribed by law.

We may amend this Policy to reflect legal, operational, or technological developments. Where a change materially affects consent-based processing or introduces a new purpose requiring consent, the Company will obtain any additional consent required by applicable law rather than treating continued use alone as consent.

InvincibleYOU Privacy, Security, and Compliance Department

Grievance Officer: Mary D’Souza

Address: InvincibleYOU / Vedanga Solutions Private Limited, Bengaluru, Karnataka, India

Email: mary@invincibleyou.world

Helpline: +91 9844023428

This notice is intended to be made available in English and, where required by applicable law, in any of the languages specified in the Eighth Schedule to the Constitution of India.