Your data, plainly
What we keep, and why.
This page is the whole truth about the data this site holds, told in order — the order it actually happens — with the reason standing next to every item. If a reason ever stops being good enough, so does the data.
The formal versions exist too: the privacy policy and the terms of service. Everything below is the same story without the clause numbers.
01
You arrive
The assessment, the templates, the board deck — all of it works without an account, and nobody asks who you are. Here is everything that exists just because you visited.
A random visitor number
Cookie · dpdpa_vid
A coin-flip identifier — not your name, not your email. It does not exist until you allow it in the cookie notice; choose "essential only" and it is never set.
Page counts tell us which pages actually help people, so we improve the right ones. No advertising networks, no third parties — the count stays here.
Your cookie choice
Cookie · dpdpa_cookie_ack
A single flag remembering that you dismissed the cookie notice.
So we do not ask you the same question on every page, forever.
Your terms acceptance
Cookie · dpdpa_terms_ack
Remembers that you accepted the terms and privacy policy at sign-in.
So the question is asked once, properly — not on every visit.
A scrambled trace of your network address
Server · page views
Each page view is recorded with a shortened, one-way-scrambled version of the network address it came from.
It is how we spot abuse — someone hammering the free document generators — and keep them free for everyone else.
Your board-deck answers, on this device
Browser storage · never sent to us
If you agree — in the cookie notice or when asked before your first deck — the answers you type into the board-deck form stay in your own browser, so the form starts filled in next time.
Rebuilding the same deck from a blank form is busywork. Say no and the deck still builds; nothing is remembered.
02
You sign in
Signing in with Google hands us exactly three things — your name, your email address and your profile photo. There is no password to store, so we never store one.
Your name, email and photo
From Google · your profile
The three fields Google shares when you approve the sign-in. That is the entire account.
Your workspace, your documents and your exports have to belong to someone — this is how they belong to you.
A signed session cookie
Cookie · session (httpOnly)
A sealed token that keeps you signed in as you move between pages. Scripts on the page cannot read it.
Without it you would type your credentials on every click. It exists only while you are signed in.
Sign-in security tokens
Cookie · csrf + callback
Short-lived tokens that protect the sign-in flow against forgery, and remember which page to return you to.
They are what stops another website from signing you in — or out — without your knowledge.
Your sign-in history
Server · login events
When you signed in and the address it came from.
So unusual activity is visible — to you. Your full history ships inside your data export.
03
You do the work
Everything in this chapter exists only because you created it. Holding it for you is not a side effect — it is the service.
Your questionnaire answers
Server · workflow modules
Every answer you give across the fourteen modules, and the gaps and scores computed from them.
A compliance programme you cannot revisit is not a programme. Your answers are the evidence trail.
Your live registers
Server · registers
Rights requests, incidents, consents, grievances, retention lines, processors, transfers — the operational record.
The DPDP Act runs on statutory clocks. The registers are how you prove every clock was answered.
Your evidence ledger
Server · append-only, hash-chained
A timestamped entry for every rights-relevant act your registers record. Your customers appear in it only as salted one-way hashes and masked strings (a•••@x.com) — we never hold a browsable list of your data principals.
A Board complaint names a person and a date; the ledger is how you answer it with records. The hashing means we hold the proof without holding their contact book.
Your generated documents
Server · document locker
Every document you generate — Word templates, your board deck, your assessment roadmap — kept with its full version history.
So you can re-download the exact version you adopted — years later, in front of an auditor.
Your uploaded evidence
Server · private storage, Mumbai
Files you attach as evidence, stored privately in an Indian region. Never public, never shared.
An audit is a paper exercise — the paper has to live somewhere you control.
04
You stay in charge
Every item above comes with a way out. None of them argue with you.
Delete every cookie
The cookie centre sits beside the sign-in button on every page. One click removes everything this site set — it signs you out, and the site keeps working.
Take everything with you
Your account page exports a single ZIP: a readable summary of all of it, plus every document you generated as the original Word files.
Export from your accountDelete your account
Also on the account page. It erases your profile, your history and — if you are the only member — your organisation and all of its data. Gone means gone.
Delete from your accountOr simply close the tab
Nothing here follows you around the web. No advertising pixels, no third-party trackers — when you leave, the story pauses until you come back.
Back to the startAnd thank you
Trust is the only thing on this page we cannot store.
You give it to us one visit at a time, and we try to earn it the same way — by keeping only what the service needs, telling you exactly what that is, and handing all of it back the moment you ask.
And if you would rather we held nothing at all — delete your cookies, export your data, delete your account, close the tab. We would miss you. But it is your data, and that makes it your choice, entirely.