Our security and privacy posture

This page is the short version. The four other policy summaries — data residency, authorisation, audit log, AI provider — go deeper into specific commitments. Together they describe how this product handles your data.

Your rights under the Digital Personal Data Protection Act, 2023

Six rights, each implemented as something you can actually do from your account:

You can ask to see the data we hold about you, and download it in a portable format.

You can correct anything that is wrong, and we apply the correction immediately.

You can ask us to delete your account, and a thirty-day soft-delete window means a mistaken deletion can still be reversed.

You can withdraw any consent you previously gave. The withdrawal is one click and takes effect at once.

You can file a grievance about how we have handled your data, and we acknowledge within seven days and resolve within thirty days.

You can name a person who will exercise these rights on your behalf if you are unable to.

The contact form is the route for every one of these — it routes your message to the right team, sends you a verification email so we know it really came from you, and writes the request into our audit log so we can prove the timeline.

What we will never do

We will never sell, rent, or share your data with any third party.

We will never use your profile data to train an external machine-learning model.

We will never track you across the web with third-party cookies.

We will never send you marketing without an explicit opt-in.

We will never charge you, or anyone acting in your name, for filing a government application.

What we hold and for how long

The data we use to generate your roadmap is held while your account is active and for a short grace period after closure. Application logs are kept for one hundred and eighty days in India in line with the CERT-In Directive of 2022. Consent records and audit-log entries are kept for seven years.

What happens if something goes wrong

We have a defined incident response process. A confirmed personal-data breach is notified to the Data Protection Board of India within seventy-two hours and to affected users without undue delay. Technical incidents are reported to CERT-In within the six-hour window the directive sets.

See also

• Data residency
• Authorisation
• Audit log
• AI provider
• Eligibility engine

This summary is reviewed quarterly. Last reviewed: 28 May 2026.