1. Who we are

Data Fiduciary: Aptus Software Labs Pvt Ltd, [registered address — update before launch].
Contact for data rights requests: [email protected]

2. What we collect and why

Data	Why	Legal basis (DPDP Act, 2023)
Name, work email, company name, sector	Account creation and identification	Contractual necessity — S.7
Password (stored as PBKDF2-SHA256 hash — never plain text)	Authentication	Contractual necessity — S.7
Assessment responses and free-text notes	Deliver the compliance self-assessment service	Contractual necessity — S.7
Consent records (purpose, timestamp, notice version)	Legal obligation to log consent	Legal compliance
Payment reference token (from Razorpay)	Subscription management — paid plans only	Contractual necessity — S.7. Raw card/bank data never stored by us.
Email address (marketing)	Product updates, regulatory alerts	Freely given, specific, opt-in consent — S.6. Withdrawal any time in Account Settings.

3. Our processors

We use the following Data Processors who handle personal data on our behalf:

• Razorpay Software Pvt Ltd — payment processing (paid plans). Razorpay tokenises card/bank details; we receive only a payment reference.
• Sendy (self-hosted by Aptus) — marketing email delivery (only for users who opt in).
• Database server — [cloud provider / hosting — update before launch].

4. Your rights under the DPDP Act, 2023

• Right to access personal data we hold — visit Account Settings or email [email protected]
• Right to correction of inaccurate data — email [email protected]
• Right to erasure — close your account in Account Settings; PII is pseudonymised immediately
• Right to withdraw consent — for marketing, unsubscribe in Account Settings or via any email link; for service, close your account
• Right to grievance redressal — contact [email protected] within 48 hours we will acknowledge
• Right to complain to the Data Protection Board of India — dpboard.gov.in (once operational)
• Right to nominate — you may nominate another individual to exercise rights on your behalf in the event of your death or incapacity (S.14)

5. Retention

Account PII (name, email) is retained until you close your account, then pseudonymised immediately. Invoice and payment records are retained for 7 years (Indian GST and tax law). Consent records are retained indefinitely as they are themselves a legal compliance requirement.

6. Cookies

We use one essential session cookie (required to keep you logged in). This does not require your consent. We use Google Analytics to understand how visitors use this site (pages viewed, general usage patterns). Google Analytics sets analytics cookies and is only activated after you give consent via the cookie banner ("Accept analytics"). You can withdraw this consent at any time by choosing "Essential only" on the cookie banner. Data collected is processed by Google in accordance with their privacy policy.

7. Changes to this notice

We will update the notice version (currently notice-v1.0) and notify registered users by email before any material change takes effect.