Privacy policy
Last updated 13 November 2026 · Version 2
ConsentKaro ("we", "us") provides DPDP compliance software to businesses in India. We follow the same law we help our customers with: the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025. This policy explains what personal data we process, why, for how long, and how you can control it.
Contact for data questions (Grievance Officer): Grievance Officer, ConsentKaro · hello@consentkaro.in · Privacy centre: consentkaro.in/p/consentkaro
1. Data we collect and why
| Data | Purpose | Basis |
|---|---|---|
| Account: name, email, optional mobile, password (stored only as a bcrypt hash) | Create and secure your account, sign you in, contact you about it | Your consent at sign-up / providing the service you asked for |
| Business details you enter (name, address, data types, contact person) | Generate your notice and run your compliance workspace | Providing the service |
| Marketing preference | Send DPDP tips and product updates | Separate, optional consent (off by default) |
| DPDP check: email, name, business, score | Send your fix-list and deadline reminders | Your consent (checkbox) |
| Website statistics: page, referrer, device/browser type, approximate city, truncated IP address | Understand which pages help visitors | Without consent: one anonymous page count only. With your "analytics" consent in our banner: a random visitor ID, scrolls, clicks and time on page |
| Security logs: sign-ins, failed sign-ins, exports, deletions (with truncated IP) | Protect accounts and investigate misuse | Legal obligation to keep reasonable security safeguards |
We store IP addresses only in truncated form (for example 49.37.163.0). We use no advertising trackers and never sell personal data.
2. Data we process for our customers
Businesses use ConsentKaro to record consents and receive requests from their own customers. For that data, the business is the Data Fiduciary and ConsentKaro is its Data Processor: we process it only on the business's instructions to provide the service, keep it secure, and delete it when the business deletes it or closes its account. If you are a customer of one of those businesses, contact that business through its privacy centre.
3. Who we share data with
Our hosting provider (Oracle Cloud Infrastructure) stores data on our behalf under contractual security obligations. We disclose data to authorities only where the law requires it.
4. How long we keep it
- Account and business data: while your account is active. Deleting your account erases it immediately.
- Website statistics: 24 months, then deleted automatically.
- DPDP check leads who don't sign up: 18 months.
- Security and audit logs: 3 years.
- Encrypted database backups: 14 days.
5. Security
HTTPS everywhere with HSTS; bcrypt password hashing; 10-character minimum passwords; account lock after repeated failed sign-ins; signed, HttpOnly, Secure session cookies with sign-out on every device; cross-site request protection; strict content security headers; least-privilege server access; truncated IPs; daily encrypted backups; and an audit log of security-relevant actions. If a breach affects you, we will inform you and the Data Protection Board of India without delay, and file a detailed report with the Board within 72 hours.
6. Your rights
- Access: download everything we hold about your account from Account → Download all my data, or ask us.
- Correction: edit your details in the app or ask us.
- Erasure: delete your account from Account → Delete my account, or ask us.
- Withdraw consent: turn off marketing emails in Account; change analytics consent with the "Privacy choices" button on any page.
- Grievance: write to the Grievance Officer; we respond within 90 days, usually much sooner.
- Nominate: you can nominate someone to exercise these rights on your behalf if you die or become incapable.
Use our privacy centre to send and track any request. If you are not satisfied, you can complain to the Data Protection Board of India.
7. Children
ConsentKaro is a business tool and is not meant for anyone under 18. We do not knowingly collect children's data for our own purposes.
8. Changes
We will update the version and date above and email account holders about significant changes.