Privacy notice
Version 2026-11-08
This is a draft. Our legal partner has not reviewed it yet. We publish it so you can see what we intend; the reviewed version will carry a new date.
This notice explains what personal data we collect when you use Sammati, why we collect it, and what you can do about it. If anything is unclear, write to our grievance officer (details at the end).
Who we are
Sammati is a product of Dhruvaatma Systems Pvt. Ltd. We help Indian businesses check how their website handles personal data under the Digital Personal Data Protection Act, 2023 (DPDP Act).
For the personal data described here, we decide why and how it is used. The DPDP Act calls this role the "Data Fiduciary". You are the "Data Principal".
Dhruvaatma Systems Pvt. Ltd. is the company behind Sammati.
What we collect and why
We collect only what we need. The free scan needs just a website address and a work email. Everything else is optional.
For most items below we rely on your consent, given with a separate, unticked checkbox for each purpose. Agreeing to our terms is never bundled with it.
| Data | Why we need it | Lawful basis | How long we keep it |
|---|---|---|---|
| Website address and work email (free scan) | To run the scan and send you the result. To check that you work at the company before showing the full report. | Your consent | 90 days if you never verify the email. Otherwise while your account is active. |
| Phone number and company size (optional) | To call you back if you ask, and to make our advice fit your business. | Your consent | Until you remove them or your account is deleted. |
| Account and sign-in data (email, company, sign-in records) | To create your account, sign you in with a one-time code, and keep the account secure. | Your consent | While your account is active. See "How long we keep it". |
| Consent records (what you agreed to, when, which version of this notice, and your IP address) | To prove what you agreed to, and to honour any change you make. | Your consent | As long as the DPDP Rules require. |
| Cookie choice ID (a small cookie on your device) | To remember whether you accepted or rejected analytics. | Your consent | 12 months. See our cookie notice. |
| Support messages | To answer your question or request. | Your consent | Until the request is closed, then as long as the DPDP Rules require. |
| Request-a-call details (name, email, company website, and optional phone and message) | To reply to your request and arrange a call. | You gave it to us for this purpose (DPDP Act, section 7(a)) | Until your enquiry is closed, or sooner if you ask us to delete it. |
| Email for a free resource (a template or your readiness quiz result) | To send you the item you asked for. We do not store your quiz answers. | You gave it to us for this purpose (DPDP Act, section 7(a)) | We keep only a scrambled record that an email was sent, not the address itself. |
| WhatsApp number (if you add one in My privacy) | To check the number with a one-time code over WhatsApp, and, only if you switch WhatsApp updates on, to send you deadline reminders and rule changes. | Your consent, given with its own switch | Until you remove the number, switch updates off, reply STOP, or delete your account. Unused code requests are deleted after a day. |
| Email for the weekly newsletter | To send the newsletter you asked for, after you confirm the address from the email we send. | Your consent, given by subscribing and confirming | Until you stop the newsletter with the link in any issue. Requests nobody confirms are deleted after 7 days. Stopping the newsletter does not affect other emails you asked for. |
| Email and company, if you agree to be contacted when asking for a free resource | So our team can contact you about DPDP readiness. | Your consent, given with its own unticked box | Until you withdraw it, using the unsubscribe link in any of our emails or by writing to our grievance officer. |
If you tick the box for it, we also use your email to send occasional updates about the DPDP Act. You can untick it at any time.
What we do not do
- We do not sell your personal data.
- We do not share it with anyone for their own marketing.
- We do not load analytics or advertising trackers before you accept them in our cookie banner.
- We may publish anonymous totals from our scans (for example, the share of clinic websites without a grievance contact), only from groups of at least 20 organisations. We never name a company or publish its results.
- We publish our own articles and posts on social platforms (LinkedIn, X, Facebook, Instagram, WhatsApp Channels). Links in those posts go through a short link on our site that counts clicks; the count stores no IP address, cookie or device detail. If you then start a website check from that article, we note which post you came from alongside your check, to learn which posts are useful.
- We do not show the full scan report of a company to anyone outside your company, unless our team sends it to someone at your company. Others see only the headline score.
How long we keep it
- Scan emails you never verify: deleted after 90 days.
- Inactive accounts: after 2 years without use, we remind you. If you do not respond, we delete the account and its data.
- Consent and audit records: kept for as long as the DPDP Rules require, so we can show what was agreed and what was done.
You can ask us to delete your data sooner. See "Your rights".
Who processes it for us
We use a few service providers. We are putting written data processing terms in place with each of these providers.
| Provider | What they do for us | Where |
|---|---|---|
| Supabase | Database and sign-in | Mumbai, India |
| Vercel | Hosts the website and portal | Not yet confirmed |
| Cloudflare | Domain name service, firewall and bot checks on forms | Not yet confirmed |
| Meta (WhatsApp) | Delivers the WhatsApp code and updates you asked for; tells us whether each message was delivered or read | Not yet confirmed |
| Resend | Sends our emails: sign-in codes, scan reports our team sends you, up to three follow-up emails about that report, and the weekly newsletter if you subscribe | United States |
| Anthropic | AI that reads the public text of a scanned website and drafts report wording | Not yet confirmed |
| PostHog | Visit statistics, only after you accept analytics; receives your IP address with each page view | Not yet confirmed |
We will update this table when a provider or a region changes.
Your rights
Under the DPDP Act you have these rights. Using them is free.
| Right | What it means | How to use it |
|---|---|---|
| Access | Get a summary of the data we hold about you and how we use it. | "My privacy" in the portal, or email the grievance officer. |
| Correction | Fix data that is wrong or incomplete. | "My privacy" in the portal, or email the grievance officer. |
| Erasure | Ask us to delete your data. | "My privacy" in the portal, or email the grievance officer. |
| Withdraw consent | Take back any consent, as easily as you gave it. | "Privacy choices" in the footer of every page, or "My privacy" in the portal. |
| Nominate | Name someone to use your rights if you die or cannot act. | Email the grievance officer. |
| Grievance | Complain to us about how we handle your data. We resolve it within 30 days. | Email the grievance officer. |
| Complaint to the Board | If you are not satisfied with our answer, complain to the Data Protection Board of India. | Through the Board's website. |
Some portal options may not be live yet. Until they are, email the grievance officer and we will do it for you.
When you withdraw consent, we stop the use that depended on it. It does not undo what was done before.
Children
Sammati is a service for businesses. When you sign up, you confirm that you are 18 or older. We do not knowingly collect data about children. If you think a child has given us data, tell the grievance officer and we will delete it.
Security
We protect your data with encryption, strict access controls and an independent security test before launch. Our staff sign in with two-factor authentication. Read more on our "How we follow DPDP" page.
Grievance officer
- Name: Jayprakash
- Email: jayyadav@dhruvaatma.com
We respond within 30 days.
Changes to this page
When we change this notice, we change the version date below. If the change affects what you agreed to, we ask for your consent again.
- Version 2026-11-08: first draft, pending review by our legal partner.