Privacy Policy

Effective and last updated: 16 October 2026

PrivacyGuardin is a platform for assessing organisations against the Digital Personal Data Protection Act, 2023 (the “DPDP Act”) and the Digital Personal Data Protection Rules, 2025 (the “DPDP Rules”). This policy explains what personal data we process when you use the PrivacyGuardin website and service, why we process it, and the choices and rights you have.

At a glance

We collect only what we need to run the service: your account details, what you enter into PrivacyGuardin, and basic technical logs.
Information an organisation records about its own processing, requests and incidents (“Customer Content”) is processed on that organisation’s behalf and on its instructions.
We do not sell personal data, show advertising, or use analytics or tracking cookies.
When PrivacyGuardin AI is used to draft records from meeting minutes, names, e-mail addresses, phone numbers and identity numbers are masked before the text is sent.
Optional uses — remembering your display preferences and PrivacyGuardin AI — happen only with your consent, which you can give or withdraw at any time under Privacy choices (or Privacy & consent after you sign in).
You can ask to access, correct or erase your personal data, nominate someone and raise a grievance — see section 5.

1. Who we are and what this covers

This policy is issued by PrivacyGuardin (“PrivacyGuardin”, “we”, “us”). For the personal data described in this policy we act as the Data Fiduciary under the DPDP Act, except where section 1.2 says otherwise. You can reach us at privacyguard323@gmail.com.

1.1 Who this policy covers

Account holders — assessors, reviewers and administrators who sign in to PrivacyGuardin.
People who ask for an account — new accounts are approved by us before they can be used.
Department contacts (SPOCs) who open a link shared with them to complete or confirm a Record of Processing Activities.
Individuals who submit a request through a public request form published by an organisation using PrivacyGuardin.
Visitors to the PrivacyGuardin website.

1.2 Customer Content

Organisations use PrivacyGuardin to record their processing activities, gaps, DPIAs, rights requests, consent records, incidents and evidence. That information is Customer Content. For Customer Content the organisation is the Data Fiduciary and we process it as its Data Processor, only to provide the service and as the organisation instructs. If your personal data appears in Customer Content — for example as a requester, an employee or a customer of that organisation — please contact that organisation; its own privacy notice applies, and we will support it in responding to you.

2. Personal data we collect

2.1 Personal data you give us

Account details: your name, e-mail address and password (stored only as a one-way hash), your team and your role.
Account requests: when you ask for an account, your name, e-mail address, the date and time and the IP address of the request, so that we can decide whether to approve it.
What you enter or upload: answers, comments, observations and files you add to PrivacyGuardin, including meeting minutes uploaded for drafting.
Communications: messages you send us, such as support requests and grievances.
Request forms: if you submit a request through a public form, your name, e-mail address, the request and any identity document you choose to attach.

2.2 Personal data we collect automatically

Activity and security logs: sign-ins, changes, approvals and downloads, with the date, time and IP address, kept in an audit log.
Device and browser data: browser type and basic request information needed to deliver pages securely.
Cookies and local storage: see section 6.

2.3 Personal data we receive from others

An administrator of your organisation may add your name and e-mail address to invite you or to share a link with you as a department contact.
Organisations using PrivacyGuardin record personal data in Customer Content (see section 1.2).

3. How we use personal data

Purpose	Personal data	Ground under the DPDP Act
Review and decide account requests, and tell you the decision by e-mail	Name, e-mail address, request date and time, IP address	Data you provide voluntarily for this purpose (section 7(a))
Create and secure your account; let you sign in and work with your team	Account details, activity and security logs	Consent (section 6); data you provide voluntarily for this purpose (section 7(a))
Provide the service: store and process what you enter, generate reports and workbooks	What you enter or upload; Customer Content	Consent; as Data Processor, the organisation’s instructions
Draft and check text with PrivacyGuardin AI, when you choose to use it	Meeting minutes and report text, with names, e-mail addresses, phone numbers and identity numbers masked first	Your consent, asked before first use and withdrawable at any time; as Data Processor, also the organisation’s instructions
Remember your display preferences on your device	Light or dark mode, sidebar layout and list filters (stored in your browser)	Your consent, withdrawable at any time
Keep a record of your consent choices	Each choice, the notice version, where it was given, date, time and IP address	To prove consent (section 6(10))
Send service e-mails: invitations, links to department contacts, password resets	Name, e-mail address	Consent; data provided voluntarily for this purpose (section 7(a))
Keep the service secure, investigate misuse and incidents, keep an audit trail	Activity and security logs	Reasonable security safeguards (section 8(5) and Rule 6)
Respond to your questions, requests and grievances	Communications, account details	Consent; obligations under sections 11 to 14
Comply with law and respond to lawful requests	Any of the above, as required	Compliance with law (section 7)

We do not use personal data for advertising, we do not build profiles of you for marketing, and we do not use Customer Content to train AI models.

4. How we share personal data

We do not sell personal data. We share it only as follows:

Within your organisation: other members of your team see what you add, according to their role.

Service providers that process data for us under contract and our instructions:

Service	What they process	Location
Cloud hosting and database	All data stored in the service	Singapore
E-mail delivery	Recipient name and e-mail address, message content	European Union
AI service for PrivacyGuardin AI (only with your consent)	Masked meeting minutes and report text	United States

The names of these service providers are available on request at privacyguard323@gmail.com.

Legal reasons: where required by law, by a court or by a competent authority, or to protect the rights, safety and security of users and others.
Business changes: if the service is transferred, under terms that keep this policy’s protections.

5. Your rights and choices

Under the DPDP Act you have the right to:

Access a summary of the personal data we process about you and the processing activities, and the identities of those we share it with (section 11).
Correct, complete, update or erase your personal data (section 12).
Grievance redressal — to raise a grievance with us about how we handle your personal data (section 13).
Nominate another individual to exercise your rights in the event of your death or incapacity (section 14).
Withdraw consent at any time, as easily as you gave it: open Privacy choices at the bottom of any page, or Privacy & consent in PrivacyGuardin after you sign in, and switch the purpose off. Withdrawal takes effect immediately and does not affect processing done before it.

To exercise a right, write to privacyguard323@gmail.com from the e-mail address on your account and tell us what you need; we may ask you to confirm your identity. You can update your name and password yourself in PrivacyGuardin, and you can delete your account at any time with Delete my account under Privacy & consent — or by writing to us if you cannot sign in. We respond to grievances within a reasonable time and in any case within 90 days (Rule 14). If you are not satisfied with our response, you may complain to the Data Protection Board of India.

If your request concerns Customer Content, we will pass it to the organisation responsible and help it respond.

6. Cookies and similar technologies

Name	Type	Purpose	Duration
pg.sid	Cookie — strictly necessary	Keeps you signed in securely	Ends after 12 hours without activity, or when you log out
pg-consent	Browser local storage — strictly necessary	Remembers the privacy choices you made so we do not ask again	Until you clear your browser storage
pg-theme, pg-side and list filters	Browser local storage — preference, only with your consent	Remembers light or dark mode, the sidebar and list filters	Until you withdraw consent (they are removed at once) or clear your browser storage

When you first visit, a consent bar lets you accept all, keep essential only, or choose. We do not use analytics, advertising or third-party tracking cookies. Because the session cookie is needed to sign in, the service does not work without it.

7. Where your data is stored

The service is hosted in Singapore, and some service providers listed in section 4 process data in other countries. Personal data may therefore be transferred outside India. We do so only as permitted under section 16 of the DPDP Act and Rule 15, and not to any country the Central Government restricts. Where Customer Content is involved, the organisation decides whether PrivacyGuardin AI is used.

8. How we protect your data

Encryption in transit (HTTPS) for every connection to the service.
Passwords stored only as a salted one-way hash; sign-in attempts limited.
Role-based access (administrator, assessor, viewer), separation between preparer and approver, and an audit log of significant actions.
Department contacts work through links that the assessor can revoke at any time.
Uploaded files are checked by type; identity documents attached to requests are deleted automatically after the period the organisation sets.
Regular backups of the database.

No system is completely secure. If a personal data breach affects you, we will inform you and the Data Protection Board as required by section 8(6) and Rule 7.

9. How long we keep data

Account data: while your account is active. When you delete your account, or ask us to, we erase your account data and the work you kept only for yourself within 30 days, including from backups, unless we must keep it by law. Work you shared with a team stays with that team.
Refused account requests: erased 30 days after the decision.
Logs: for at least one year, as required by Rule 6, and then deleted.
Customer Content: for as long as the organisation keeps it in PrivacyGuardin; it can delete it at any time, and we delete it at the end of the service as the organisation instructs.
Identity documents attached to requests: deleted automatically after the period the organisation sets.
Consent records: kept for as long as the consent is relied on and for the period needed to prove it afterwards.
Backups: overwritten on a rolling basis.

10. Children

PrivacyGuardin is a professional tool and is not intended for anyone under 18. We do not knowingly create accounts for children. If you believe a child has created an account, contact us and we will delete it.

11. Changes to this policy

We may update this policy. We change the “last updated” date above and show a notice in PrivacyGuardin. For significant changes we also e-mail every account holder at least 14 days before the change takes effect, and where a change needs your consent we ask for it again.

12. Contact us and grievances

For questions about this policy or your personal data, and for grievances, contact:

Grievance Officer	PrivacyGuardin Team
E-mail	privacyguard323@gmail.com

This contact is published as required by Rule 9 of the DPDP Rules. We respond to grievances within a reasonable time and in any case within 90 days. If you are not satisfied, you may complain to the Data Protection Board of India.