Privacy Policy

The table below itemises the personal data we collect and the specific purpose for which each item is processed, as required by Section 5 (1)(i) of the DPDP Act. We collect only such personal data as is necessary for the stated purpose.

We do not sell your personal data, and we do not use your compliance-assessment content for advertising or for training machine-learning models.

Your data principals in the evidence ledger. The registers you keep in the workspace may contain the contact details of your own customers (your data principals) — that content belongs to the category above and is processed on your instructions. The evidence ledger derived from those registers stores each data principal only as a salted one-way hash unique to your organisation, together with a masked display form (for example a•••@example.com); we do not maintain a browsable list of your data principals, and entries can be found only by presenting the exact identifier. Ledger entries are append-only and hash-chained so they cannot be silently altered — including by us.

Generated documents and the board deck. If you generate a board briefing deck or complete the applicability assessment while signed in, the finished file and — for the deck — the answers used to build it are saved to your organisation's Document locker, so you can re-download every version and the form starts prefilled next time. Generated anonymously, the board deck stores nothing on our servers; with your explicit permission, your answers are kept only in your own browser's local storage.

Where we rely on consent, that consent is — consistent with Section 6 (1) of the DPDP Act — free, specific, informed, unconditional and unambiguous, given by a clear affirmative action (your act of signing in and accepting this Policy), and limited to the personal data necessary for the purposes stated above.

Withdrawing consent. Under Section 6 (4), you may withdraw your consent at any time, and we will make it as easy to withdraw as it was to give. You can withdraw consent by writing to us at hello@deepdivelabs.tech or by deleting your account from within the application. When you withdraw consent, we will, within a reasonable time, stop processing the affected personal data and direct any of our data processors to do the same, unless continued processing is required or authorised under the DPDP Act, the DPDP Rules, or any other law in force in India.

Withdrawing consent does not make any processing carried out before the withdrawal unlawful, and may mean we can no longer provide some or all of the service.

We share personal data only as necessary to run the service:

• Service providers (Data Processors). We use vetted infrastructure, hosting and email providers who process personal data on our behalf, under contract, and only on our instructions.
• Google. Sign-in is handled by Google's OAuth service. Google's handling of your data is governed by Google's own privacy policy.
• AI-assisted evidence review (OpenAI). Our service includes an optional feature that uses OpenAI to review evidence files you upload (for example, a privacy notice or screenshot) and suggest answers. If you choose to use it, the relevant file(s) are sent to OpenAI solely to generate that analysis. Under OpenAI's applicable terms, this content is processed only to return the result — it is not retained beyond the request and is not used to train OpenAI's models. The feature stays off until an authorised user in your organisation expressly accepts a notice describing it.
• Within your organisation. If you use DPDPA Workflow as part of an organisational workspace, your assessment content may be visible to authorised administrators of that workspace.
• Legal and regulatory. We may disclose personal data where required to comply with applicable law, a lawful request, or to protect our rights, users or the public.

In line with Section 8 (7) of the DPDP Act, we erase personal data when you withdraw your consent, or as soon as it is reasonable to assume that the purpose for which it was collected is no longer being served — whichever is earlier — unless retention is required for the specified purpose or to comply with any law in force.

• Account identity and assessment content are retained for as long as your account is active.
• On account deletion or consent withdrawal, we delete or irreversibly anonymise your personal data within a reasonable period, save for limited records we are legally required to keep.
• Technical logs are retained only for as long as needed for security and operational purposes, then deleted or anonymised.

As required by Section 8 (5) of the DPDP Act and Rule 6 of the DPDP Rules, we take reasonable security safeguards to prevent a personal data breach. These include:

• Encryption of personal data in transit and at rest;
• Role-based access controls and the principle of least privilege;
• Logging and monitoring of access to personal data;
• Secure, access-controlled backups and business-continuity measures; and
• Contractual security obligations imposed on our data processors.

No system can be guaranteed perfectly secure, but we work to maintain safeguards appropriate to the sensitivity of the data we hold.

If a personal data breach occurs, we will act in accordance with Section 8 (6) of the DPDP Act and Rule 7 of the DPDP Rules. Specifically:

• We will, without delay, intimate each affected Data Principal in a concise, clear and plain manner, describing the breach and the steps you can take to protect your interests;
• We will give the Data Protection Board of India an initial intimation of the breach without delay; and
• We will provide the Board a detailed report within 72 hours of becoming aware of the breach (or such longer period as the Board may allow), covering the circumstances and causes, the mitigation measures taken, and a summary of the notifications issued to affected Data Principals.

DPDPA Workflow is a business-to-business tool intended for use by employees and professionals aged 18 and over. It is not directed at children, and we do not knowingly collect the personal data of a child.

Consistent with Section 9 of the DPDP Act, we do not undertake tracking, behavioural monitoring of children, or targeted advertising directed at children. If we become aware that we have collected the personal data of a child without verifiable parental or lawful-guardian consent, we will delete it promptly.

We primarily process and store personal data on infrastructure located in India. Where any processing involves a transfer of personal data to a country or territory outside India (for example, where a sub-processor operates abroad), we do so consistent with Section 16 of the DPDP Act, and we will not transfer personal data to any country or territory that the Central Government has restricted by notification. Our data-processing arrangements require equivalent protection for your personal data wherever it is processed.

AI-assisted evidence review. If you choose to use our optional AI evaluation feature, the evidence you submit for review is transferred to OpenAI and processed on infrastructure outside India. We enable this only after an authorised user in your organisation has expressly accepted a clear notice describing this transfer; that acceptance is recorded once and applies to subsequent evaluations across your workspace. OpenAI does not retain that content beyond the request or use it to train its models. Because you decide what each file contains, you remain responsible for deciding whether evidence that includes sensitive or special-category personal data should be submitted for AI review, and for redacting it where appropriate.

The DPDP Act gives you the following rights, which you can exercise by contacting us at hello@deepdivelabs.tech. Many of these can also be exercised directly within the application.

• Right to access information (Section 11). You may request a summary of the personal data we are processing about you and the processing activities we undertake, along with the identities of any other Data Fiduciaries or Data Processors with whom it has been shared.
• Right to correction and erasure (Section 12). You may request that we correct, complete, update or erase your personal data. We will erase it on request unless retention is necessary for the specified purpose or required by law.
• Right of grievance redressal (Section 13). You have the right to a readily available means of raising grievances about how we handle your personal data. See section 10 below.
• Right to nominate (Section 14). You may nominate another individual to exercise your rights under the Act in the event of your death or incapacity. Contact us to record a nomination.

We will respond to a rights request within the period we publish for this purpose, which will not exceed ninety (90) days as contemplated by Rule 14 (3) of the DPDP Rules. We may need to verify your identity before acting on a request.

We have a readily available grievance-redressal mechanism, as required by Section 13 of the DPDP Act.

Grievance / Data Protection Contact — DPDPA Workflow · Email: hello@deepdivelabs.tech

Please include enough detail for us to identify your account and understand your concern. We will acknowledge and respond to your grievance within the period we publish for this purpose, which will not exceed ninety (90) days (consistent with Rule 14 (3) of the DPDP Rules).

Escalation to the Data Protection Board of India. If you are not satisfied with our response, or if we fail to respond within the prescribed period, you have the right to make a complaint to the Data Protection Board of India (the regulator established under the DPDP Act), in the manner prescribed under the DPDP Rules. We will provide details of how to reach the Board on request.

If you apply to our founding consultants programme, we collect additional personal data for a single, narrower purpose: assessing your application and, if you are accepted, running the programme.

What we collect. At application, this includes: your identity (name, email, city, languages, and LinkedIn profile), your practice details (profession, years in practice, sectors, engagement history, and whether you hold professional indemnity cover), any professional credentials you claim (the credential, its certificate ID, and — where you attach one — the certificate file itself), one redacted work sample, two professional references (name, organisation, relationship, and contact details), and your free-text answers to two questions about your practice.

Who sees it. Only our reviewers see your work sample, your references, and your free-text answers. We do not show them to your clients, to other founding members, or to the public.

The vault. Files you upload — your work sample and any credential certificates — are stored in a private area of our file storage (Amazon S3), reachable only under your own application. Only our reviewers can download them; no public or presigned link is ever issued for a vault file.

Credential verification and references. Where you claim a professional credential, we check the certificate ID you give us against the relevant issuing body before marking it verified. We also contact the references you name, using the details you give us, to ask about your work.

The decision trail. Every change to your application's status — submission, each review stage, and the final decision — is written to an append-only audit trail of who made the change and when. If you withdraw your application, or ask us to erase your data under Section 12, we keep this decision trail — the fact that an application existed and how it was decided — even though we erase the rest, because we need it to show that our vetting process is applied consistently and fairly, including on a future re-application.

The public directory. If you are accepted as a founding member, you may opt in to a public consultant directory. It is off by default; you choose it, and can change your choice at any time, from your account. If you opt in, we show only: your name, city, profession, the sectors and languages you work in, and any credential we have verified against its issuing body. We never show your work sample, your references, your registration number, your contact details, or your free-text answers.

Your rights. Your rights of access, correction and erasure under Sections 11 and 12 of the DPDP Act apply to your application data exactly as they do to the rest of your account, subject to the decision-trail retention described above. You can withdraw your application at any time before a decision is made, from the application page itself.

We may update this Privacy Policy from time to time to reflect changes in our service, the law, or regulatory guidance. When we make material changes, we will update the "Last updated" date above and, where appropriate, notify you within the application or by email. Your continued use of the service after an update constitutes acknowledgement of the revised Policy.