Compliance

India

Digital Personal Data Protection Act, 2023 and Rules, 2025

Your customers see a plain notice that lists what is kept, why, how to withdraw and how to complain to the Data Protection Board, before they say yes.
Consent is asked per channel and per kind of message, never pre-ticked, and can be withdrawn as easily as it was given: reply "stop" in any language, one click in an email, or the preferences page.
People under 18 get no marketing and are not tracked; their reminders go to a parent or guardian only once that person's consent has been checked.
A customer can be erased in one click, with no trace left, and the services that hold a copy are asked to delete it too.
Personal data breaches are reported to the Board and to every person affected, with a detailed report within 72 hours.

India

A published privacy policy says what we collect, why, who we share it with and how we protect it.
Sensitive data is collected only with permission, can be refused, and the permission can be withdrawn at any time.
Every complaint is acknowledged within 48 hours and resolved within 30 days.

India

Cyber security incidents are reported to CERT-In within 6 hours of being noticed, through our named point of contact.
Security logs are kept in India for at least 180 days (and a year under the DPDP Rules), and are never edited.
Our servers keep their clocks in step with standard time sources, so every log line can be matched.

European Union and United Kingdom

Each use of data has a recorded legal basis, and marketing needs a clear, prior opt-in.
The website loads no analytics or marketing cookies until you accept them, and "Essential only" is as easy as "Accept all".
Businesses get a data processing agreement; transfers out of Europe are covered by the Standard Contractual Clauses, with encryption and access controls.
People can access, correct, export, restrict, object to and delete their data, and requests are answered within 30 days.
A personal data breach is reported to the business without undue delay, so its authority hears within 72 hours. We keep a record of everything we process.

United States

Every email names the business truthfully, and its subject matches its content.
Marketing email is sent only to people who said yes, and always carries the business's postal address and a free one-click unsubscribe.
An unsubscribe takes effect at once, with nothing to sign in to, and the link keeps working for at least 180 days.

United States (California)

For the businesses we serve, we are a service provider: we use their customers' data only to run the service, and never sell it, share it for advertising, or combine it with other data.
We do not sell or share anyone's personal information, and the website honours the Global Privacy Control signal.
People can ask to know, correct and delete what is held about them.

Canada

Promotional messages need consent first. Express consent lasts until withdrawn; implied consent stops 24 months after a purchase or 6 months after an enquiry, automatically.
Every message names the sender, gives a way to reach them and has a free unsubscribe that takes effect at once.
Every security breach is recorded and kept for at least 24 months, and serious ones are reported.