How we follow DPDP
Version 2026-10-13
This is a draft. Our legal partner has not reviewed it yet. We publish it so you can see what we intend; the reviewed version will carry a new date.
We test our own site with the same scanner we offer you. This page lists what the Digital Personal Data Protection Act, 2023 (DPDP Act) and the DPDP Rules ask of us, and what we do about it.
What the law asks and what we do
| What the law asks | What we do |
|---|---|
| Tell people what you collect before you collect it | A short notice sits next to every form: what we collect, why, for how long, and your rights. The full privacy notice is one click away. |
| Get free, specific consent | A separate, unticked checkbox for each purpose. Consent is never bundled with our terms. We record the time, the notice version and the IP address of each consent. |
| Get consent before tracking | Our cookie banner has "Accept" and "Reject" buttons of equal weight. Analytics load only after you accept. |
| Make withdrawal as easy as giving consent | The Privacy choices link in every footer withdraws measurement consent in one click; in-portal privacy settings are being built. |
| Collect only what you need | The scan needs only a website address and a work email. Phone and company size are optional. |
| Use data only for the stated purpose | Lead data is used only to talk about DPDP readiness. We never sell it or share it for anyone else's marketing. |
| Do not keep data longer than needed | Unverified scan emails are deleted after 90 days. Inactive accounts get a reminder after 2 years, then are deleted. Consent and audit records are kept as the DPDP Rules require. |
| Respect people's rights | Self-serve tools to view, download, correct and delete your data are being built. Until then, email the grievance officer and we respond within 30 days. Every request is tracked by our team. |
| Name a contact for complaints | Our grievance officer is named in the footer of every page. |
| Keep data secure | Sign-in codes that expire in 10 minutes and work once, two-factor sign-in for staff, encryption of phone numbers and notes, and an external security test before launch. Our scanner runs apart from everything else and cannot reach our database directly. |
| Report breaches | A written plan: detect, contain, assess, then tell the Data Protection Board of India and affected people without delay, with a full report to the Board within 72 hours. The first drill is scheduled before launch, and then every year. |
| Control who processes data for us | We are putting written data processing terms in place with each provider. The list is in our privacy notice. |
| Protect children | Sammati is for businesses. Everyone who signs up confirms they are 18 or older. |
| Keep records | Processing records, consent logs and policy versions will be kept in our team console. Today they are kept in our database and our code repository. |
Known gaps
We would rather tell you what is not finished than pretend it is.
- Legal review: our legal partner has not yet reviewed these pages. Each page shows "draft" until they have.
- Hardware-key sign-in: our super admins will sign in with a hardware security key. This is not in place yet.
- Hindi and Marathi: these pages are in English only for now. Hindi and Marathi versions are planned.
- Self-serve privacy tools: viewing, downloading, correcting and deleting your data in the portal is being built. Until then, email the grievance officer.
- Breach drill: our first breach-response drill has not happened yet. It is scheduled before launch.
- Data processing terms: written terms with each provider are being put in place.
- Records in the team console: processing records, consent logs and policy versions are not yet in the team console. Today they are kept in our database and our code repository.
We will update this list as each item is done.
Changes to this page
- 2026-10-13: first draft, pending review by our legal partner.