We roast products, not people's inboxes.

CPR Deck is run by Mahendra Vijay, an individual based in India. There is no registered company behind it yet, so under the DPDP Act the Data Fiduciary is Mahendra Vijay personally, reachable at hello@mahendravijay.in.

That address is also the grievance contact. If you write to it about your data, you should get a reply within 30 days.

Roast invite list. Your email address, so we can tell you when the next roast night is booked. That is the only thing it is used for — it isn't a newsletter and we don't send anything else.

Invite inquiry. Your name, email, organization, chosen format and message, so we can reply and plan a session with you.

Pitch application. Your name, email, role, optional city, and the details of the product you want roasted — its name, one-line pitch, category, stage, biggest challenge, what you want roasted, and any product or demo links you choose to share. We use this to decide which products get a slot and to prepare the room to give you useful criticism. City is optional and only used to match you to a roast night near you.

AI Roast Lab. The five fields you fill in — product name, target user, problem, solution, and business model. They are sent to an AI model, which writes the critique, and the result comes straight back to your screen. There is no database behind the Lab and we keep no copy of what you typed. Because it does leave your browser, don't paste anything confidential into it.

Private Roast request. Your name, email, product name, an optional link, the stage you're at, the one area you want pushed on, and whatever you tell us you're stuck on. It reaches the same inbox as every other form and is used only to reply and plan the session. What you share in the session itself stays between us — see the terms.

We ask for consent before each of these, and we only collect what the stated purpose actually needs.

• No analytics or tracking scripts of any kind. There are none on this site.
• No advertising cookies, and no cookie banner because there is nothing to consent to. The only browser storage we use is a one-time flag so the intro animation doesn't replay, and a local draft of your pitch form that stays on your device.
• We never sell, rent, or share your data for anyone else's marketing.
• We do not profile you or make automated decisions about you.

Form submissions are delivered by Web3Forms, which passes them to our email inbox, and then sit with our email provider. Those two companies process the data on our instructions under their own terms. Nobody else receives your form submissions.

What you type into the AI Roast Lab takes a different path. It passes through Cloudflare, which runs the small service that holds our model credentials, and on to Groq, which runs the model that writes the critique. Both process it only to produce that one response. It is never written to a database, and our service does not log what you typed.

All of these providers operate outside India, so your data does leave the country. Section 16 of the DPDP Act permits this — the Government has not restricted transfers to the countries involved.

• Roast invite list — until you tell us to stop.
• Invite inquiries — 12 months from your last message to us.
• Pitch applications — 24 months after the roast night, so we can follow up on how your product actually went. If you aren't selected, 12 months.

After that we delete it. You can ask us to delete it sooner.

Under the DPDP Act you can ask us to:

• tell you what data of yours we hold and who we shared it with;
• correct, complete, or update anything that's wrong;
• erase it, unless we're required to keep it;
• nominate someone to exercise these rights for you if you die or become incapacitated.

Email hello@mahendravijay.inand say what you want. We don't need a form or a reason.

If we handle it badly, you can complain to the Data Protection Board of India. We would rather you gave us a chance to fix it first.

Withdrawing is as easy as giving. Reply to any email from us, or write to hello@mahendravijay.in, and we'll stop processing your data and remove you from the list.

Withdrawing consent doesn't undo what was already done lawfully before you withdrew it. If you withdraw after a roast night has already happened, anything already published stays subject to the terms.

CPR Deck is for people aged 18 and over. The DPDP Act treats anyone under 18 as a child and requires verifiable parental consent, which we are not set up to collect. So we ask you to confirm your age, and we don't knowingly accept data from anyone younger.

We know students are part of this community. If you're under 18 and want in, write to us and we'll figure out how to involve you without collecting your data.

If you believe a child's data has reached us, tell us and we'll delete it.

If your data is exposed in a breach, we'll notify you and the Data Protection Board of India as the Act requires. Given that we hold very little and store none of it ourselves, the blast radius is small by design.

When this changes we'll update the date at the top. If a change actually affects what we do with data you already gave us, we'll email you rather than quietly editing the page.