Comply Privacy Policy
Effective Date: September 30, 2026 • Version 1.0 (Statutory DPDP Edition)
Comply Technologies India Private Limited ("Comply", "we", "us", or "our") provides this Privacy Policy in strict accordance with the Digital Personal Data Protection Act, 2023 (DPDP Act) and the General Data Protection Regulation (GDPR). This notice explains how we collect, process, store, and protect your personal data when you interact with our compliance management SaaS platform.
1. Categories of Personal Data Collected
We collect and process only the minimal personal data necessary to provide our compliance services:
- Identity & Account Data: Full name, corporate email address, and authentication credentials managed securely via Clerk.
- Billing & Subscription Data: Company billing address, GSTIN, transaction references, and payment tokens tokenized via Razorpay / Stripe (we never store raw card numbers).
- Consent Telemetry: Anonymized SHA-256 IP hashes, user agent strings, and consent opt-in timestamps recorded by our public Consent SDK.
- Support & Communications: Correspondence, DSR tickets, and customer support inquiries.
2. Legal Grounds for Processing (Section 4 & 6 DPDP Act)
Personal data is processed strictly based on lawful statutory grounds:
- Contractual Necessity: To deliver, configure, and maintain your Comply subscription.
- Explicit Consent: Given freely and without pre-ticked boxes for analytics and optional communications.
- Legal Obligation: Maintaining 8-year tax and invoice records pursuant to statutory Indian financial regulations.
3. Data Storage, Sovereignty & Retention
All customer databases and primary compliance vaults are hosted on sovereign Indian infrastructure in AWS Mumbai (`ap-south-1`). Data is encrypted at rest using AES-256 and in transit via TLS 1.3. We retain account data for the duration of your active subscription plus 180 days, after which it is permanently purged.
4. Your Rights as a Data Principal
Under Section 11, 12, and 13 of the DPDP Act 2023, you have the right to:
- Request access to an intelligible summary of your personal data processed.
- Request correction, completion, or updating of inaccurate data.
- Request erasure or permanent deletion of your data when no longer needed.
- Withdraw your consent at any time with immediate effect.
- Lodge a statutory grievance with our designated Grievance Redressal Officer.
5. Statutory Grievance Redressal Officer
Appointed under Section 13, Digital Personal Data Protection Act, 2023
If you have questions, concerns, or wish to exercise your rights under the DPDP Act, contact our named Grievance Redressal Officer directly. Under statutory rules, your inquiry will be formally investigated and resolved within 30 days: