Digital Personal Data Protection Act, 2023

About the DPDP Act

The Digital Personal Data Protection Act, 2023 ("DPDP Act") is India's primary legislation governing how businesses collect, process, and store personal data of Indian residents. As a Data Fiduciary under the Act, Kunjara OS is responsible for ensuring your personal data is processed lawfully, fairly, and transparently.

Lawful basis for processing

We process your personal data on the following bases:

Consent

When you register an account, you consent to us collecting and processing your data as described in our Privacy Policy. You may withdraw consent at any time by deleting your account.

Contractual necessity

Processing required to deliver the Service you subscribed to — for example, storing your proposals and processing your payments.

Legal obligation

We retain payment and transaction records for 7 years as required under Indian taxation laws.

Legitimate interests

Anonymised usage analytics to improve the product, subject to your interests not overriding ours.

Your rights under the DPDP Act

As a Data Principal (the person whose data we process), you have the following rights:

Right to access

Request a summary of the personal data we hold about you and how it is being processed.

Right to correction

Request that we correct inaccurate or incomplete personal data.

Right to erasure

Request deletion of your personal data, subject to legal retention requirements.

Right to grievance redressal

Raise a complaint about our data practices and receive a timely response.

Right to nominate

Nominate another person to exercise your rights on your behalf in the event of your incapacity.

To exercise any of these rights, contact our Data Protection Officer at support@kunjaraos.com. We will respond within 30 days as required by the Act.

Data minimisation

We collect only the personal data that is necessary to provide the Service. We do not collect sensitive personal data (as defined under the DPDP Act) such as financial account numbers, biometric data, health data, or caste information. Payment details are processed by Razorpay and are not stored on our servers.

Cross-border data transfers

Some of our service providers — including OpenAI (AI processing) and Vercel (hosting) — operate outside India. Where personal data is transferred internationally, we ensure appropriate safeguards are in place consistent with the DPDP Act and any rules notified by the Indian Government.

Your primary data (account, proposals) is stored on Supabase infrastructure in the ap-south-1 region (Mumbai, India).

Data retention

We retain personal data only for as long as necessary:

Account & proposal data

Retained while your account is active. Deleted within 30 days of an account deletion request.

Payment records

Retained for 7 years as required under the Income Tax Act, 1961.

Usage logs

Retained for 90 days for security and performance monitoring, then automatically deleted.

Grievance redressal

If you have a complaint regarding how we handle your personal data, you may contact our Data Protection Officer:

We will acknowledge your complaint within 48 hours and resolve it within 30 days. If you are not satisfied with our response, you may approach the Data Protection Board of India once it is constituted by the Government of India.

Updates to this notice

We will update this page as the DPDP Act's rules and regulations are notified. Material changes will be communicated to registered users by email.