Privacy Policy

1. Data Fiduciary

CompliYUG (“we”, “us”) operates Sanshodhan AI as a Data Fiduciary under the Digital Personal Data Protection Act, 2023 (“DPDP Act”). Our registered office is in India. For data protection inquiries, contact us at privacy@compliyug.com.

2. Data We Collect

We practice data minimization. We only collect what is necessary for the assessment:

• Identity data: Name, email address, company name, job role
• Organization data: Company size, industry sector
• Assessment data: Your responses to the 34-question DPDP questionnaire
• Optional: Phone number (only if you choose to provide it)
• Technical data: Hashed IP address (never stored in raw form), browser metadata for security

3. Purpose of Processing

We process your data for the following specific, stated purposes:

• Generate your personalized DPDP compliance gap analysis report
• Send your report via email with a secure access link
• Follow up with remediation guidance and consultation options
• Improve our assessment methodology and scoring accuracy

4. Consent

We obtain explicit, informed, timestamped consent before collecting any personal data. Consent is captured via a mandatory checkbox on our assessment form, recording the timestamp, consent version, and hashed IP. You may withdraw consent at any time by deleting your data at /delete-my-data.

5. Security Safeguards

• Encryption at rest: All PII (email, name, company, phone) is encrypted using AES-256-GCM before storage
• Encryption in transit: All connections use TLS 1.2+ with HSTS enforcement
• IP protection: Raw IP addresses are never stored; only SHA-256 hashed versions are used for audit logs
• Access control: Report access is protected by unguessable UUID identifiers and magic-link authentication
• Audit logging: All data access events (views, downloads, CTA clicks) are logged with hashed identifiers

6. Data Retention

Assessment data and reports are retained for a maximum of 12 months from creation, after which they are automatically purged. You may request earlier deletion at any time.

7. Your Rights (Data Principal Rights)

Under the DPDP Act 2023, you have the right to:

• Right to Information (Sec 11): Know what data we hold about you
• Right to Correction (Sec 12): Request correction of inaccurate data
• Right to Erasure (Sec 12): Request permanent deletion of all your data
• Right to Grievance Redressal (Sec 13): Lodge a complaint about data handling
• Right to Nominate (Sec 14): Nominate another person to exercise your rights

To exercise any of these rights, email privacy@compliyug.com or use our self-service erasure page.

8. Third-Party Sharing

We do not sell, share, or disclose your personal data to third parties for their marketing purposes. Data is processed only by our authorized team members and secure infrastructure providers necessary for service delivery.

9. Cookies & Tracking

Sanshodhan AI does not use third-party tracking cookies. We do not load advertising scripts or social media trackers. We use only essential functional cookies for session management.

10. Contact & Grievance Officer

For any data protection concerns, complaints, or rights requests:
Email: privacy@compliyug.com
Response time: Within 7 business days
Erasure processing: Within 30 days of request