1. Who We Are

PrivyStack ("we", "us", "our") operates a consent-management and privacy-compliance platform. We are a Data Fiduciary with respect to the data of visitors to our website and users of our platform, and a Data Processor/service provider for the data our customers collect through our SDK and services. Our registered office is at [Legal Entity Name], [City, State], India.

2. Data We Collect

Account data: name, email address, organisation name, billing details, and authentication identifiers when you create an account.
Usage data: pages visited, features used, device and browser information, IP address, and timestamps.
Consent data: when our SDK is embedded on your site, we record consent decisions (visitor ID, decision, categories, language, timestamp, page URL) for our customers. This data belongs to the customer (the Data Fiduciary) and is processed on their behalf.
Communication data: enquiries submitted through our contact form, including name, email, and message content.

3. Purposes of Processing

We process personal data only for specific, clear, and lawful purposes: (a) providing and operating the platform; (b) account administration, billing, and support; (c) security, fraud prevention, and abuse detection; (d) improving our services through aggregated analytics; (e) legal compliance, including the DPDP Act, 2023; and (f) communicating service updates with your consent where required.

4. Lawful Basis

Under the DPDP Act, 2023, we process personal data on the basis of consent, contract (performance of our services), legal obligation, or legitimate interest — including security, fraud prevention, and service improvement — as applicable. Where consent is the basis, you may withdraw it at any time.

5. Cookies and Similar Technologies

We use cookies and similar technologies for authentication (through our identity provider, Clerk), security, and analytics. When you first visit our website, our consent banner allows you to accept, reject, or customise non-essential cookies. You may change your preferences at any time through the banner or by clearing cookies. See our Cookie Policy for details of the cookies we set.

6. Data Sharing and Processors

We share personal data only with service providers who process it on our behalf under contract: our infrastructure provider (Supabase / Vercel), authentication provider (Clerk), payment processor (Razorpay), email provider (Resend), and analytics providers. We do not sell personal data. We may disclose data where required by law, court order, or to protect our legal rights.

7. Data Security

We implement reasonable safeguards appropriate to the nature of the data: encryption in transit (TLS), encryption at rest, role-based access control, multi-tenant isolation, rate limiting, and an append-only, hash-chained audit log. Access to production data is restricted and monitored.

8. Data Retention

Account data is retained for the duration of your subscription plus a reasonable period thereafter. Consent records are retained as long as our customers require them for compliance. You may request deletion at any time. Where retention is required by law, we retain the minimum necessary.

9. Your Rights as a Data Principal

Under Sections 11–13 of the DPDP Act, 2023, you have the right to: (a) obtain a summary of your personal data and processing activities; (b) request correction or erasure; (c) nominate a representative to exercise your rights; (d) lodge a grievance with our Grievance Officer; and (e) complain to the Data Protection Board of India. You may exercise these rights by writing to us at support@privystack.in.

10. International Transfers

Data is primarily stored on infrastructure located in India. Where data is processed by our service providers in other jurisdictions, we rely on appropriate safeguards in accordance with Section 16 of the DPDP Act, 2023.

11. Children's Data

Our platform is not directed at children. Where customers use our parental-consent features, verifiable parental consent is collected as required by Section 9 of the DPDP Act, 2023.

12. Grievance Officer

Our Grievance Officer may be contacted at support@privystack.in. Grievances are acknowledged within 48 hours and redressed within 30 days, as required under the DPDP Act and Rules.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated by email or a prominent notice on our website. The "Last updated" date at the top of this page reflects the most recent revision.