Privacy Policy

This Privacy Policy explains how Expitech (“we”, “our”, “us”) collects, uses, shares, and protects information when you visit or subscribe to just99.club (the “Service”).

We are committed to processing your personal data lawfully and transparently in line with the Digital Personal Data Protection Act, 2023 (DPDP Act) and other applicable Indian law.

1. Information we collect

1.1 Information you give us

• Account: email address; optional full name.
• Payment: when you subscribe, you provide payment details directly to Razorpay. We do not see or store your card or UPI credentials. We do receive transaction metadata (Razorpay order ID, subscription ID, amount, status, last 4 digits of card if applicable).
• Support: if you write to us, the contents of your message and your email address.

1.2 Information we collect automatically

• Usage: pages you visit on just99.club, which Bot URLs you accessed, timestamps.
• Device: browser type, operating system, approximate location (city level) derived from IP.
• Cookies: a small number of first-party cookies for authentication and basic analytics. See “Cookies” below.

1.3 Information from third parties

• Razorpay shares payment status and subscription events with us via webhooks.
• OpenAI does not share data with us about how you use the Bot URLs — those interactions stay between you and OpenAI.

2. How we use information

• To operate the Service and deliver Bot URLs to active subscribers;
• To send transactional email (welcome, new URL notification, payment failure, cancellation confirmation, GST invoice);
• To respond to your support requests;
• To detect, prevent, and address fraud, abuse, and security incidents;
• To comply with legal obligations, including tax and GST record-keeping;
• To improve the Service (e.g. understanding which Bots are most popular).

3. Who we share information with

We share personal data only with the following categories of recipients, and only as needed to provide the Service:

Recipient	Purpose	Country
Razorpay	Payment processing, subscription billing	India
Supabase	Database hosting (users, subscriptions)	Singapore
Resend	Transactional email delivery	United States
Vercel	Application hosting	United States

We may also disclose information when required by law, in response to a valid legal process, or to enforce these Terms.

We do not sell your personal data, and we do not share it with advertisers.

4. Cookies

We use a small number of cookies, all first-party (set by just99.club, not by third parties):

• Authentication cookies — required to keep you signed in.
• Session cookies — required for payment and subscription flows.
• Analytics cookies — aggregated visit counts, no individual tracking.

You can clear cookies in your browser settings. Doing so will sign you out of the Service.

5. Data retention

• Account data: retained while your account is active. If you request deletion, retained for up to 30 days for backup recovery, then permanently deleted.
• Subscription & payment records: retained for at least 8 years as required under Indian tax law.
• Support emails: retained for up to 3 years.

6. Your rights

Under the DPDP Act and applicable Indian law, you have the right to:

• Access the personal data we hold about you;
• Correct inaccurate or incomplete data;
• Request deletion of your account and associated personal data (subject to legal retention requirements);
• Withdraw consent for processing where consent is the basis;
• Lodge a complaint with the Data Protection Board of India.

To exercise any of these rights, write to support@just99.club. We will respond within 30 days.

7. Security

We take reasonable technical and organisational steps to protect your data, including encryption in transit (HTTPS), encryption at rest for our database, hashed passwords, and limited access to production systems. No system is perfectly secure, however; we cannot guarantee absolute protection against unauthorised access.

If we become aware of a breach affecting your personal data, we will notify you and the relevant authority as required by the DPDP Act.

8. International transfers

Some of our service providers (Resend, Vercel) are located outside India. When we transfer personal data outside India, we ensure appropriate safeguards are in place through the providers’ own compliance frameworks.

9. Children

The Service is not intended for, and we do not knowingly collect personal data from, anyone under 18 years of age. If you believe a child has provided us with information, please write to support@just99.club and we will delete it.

10. Changes to this Policy

We may update this Privacy Policy from time to time. Material changes will be notified via email or a prominent notice on the Service at least 14 days before they take effect.

11. Contact & Grievance Officer

For privacy questions, requests, or complaints, contact:

Grievance Officer: Ajith R Krishnan
Email: support@just99.club
Subject line: “Grievance — just99.club”
Response time: within 15 working days, in line with the DPDP Act.

just99.club is a brand of Expitech.