Data processing

For data you collect through the Pro tier (your client's data-owner contacts and the BRSR values they submit), you determine the purpose and act as the controller/fiduciary, and Saaksh processes that data on your instructions as the processor.

We process the data only to provide the service: sending request emails and reminders, storing submitted values and evidence, computing emissions, and producing drafts, and as otherwise instructed by you. We do not use your clients' data to train AI models or for our own marketing.

We keep the data confidential, restrict access to what is needed to run the service, and apply the safeguards described on our Security page (encryption in transit and at rest, locked-down database, private evidence storage).

We engage the sub-processors listed in our Privacy policy (Vercel, Supabase, Resend, Groq, Google (Gemini API), Mixpanel, Google Analytics), each bound to equivalent protection. We'll give notice of material changes.

We act on your reasonable instructions, including to correct or delete data, and we'll help you respond to a data principal's access/correction/erasure request relating to data in your campaigns.

If we become aware of a personal-data breach affecting your data, we will notify you without undue delay and support the notifications required under the DPDP Act.

On request, or when a campaign's purpose is served, we return or delete the relevant data, subject to any legal retention obligation.

To raise a data-processing matter or request a countersigned DPA: rahulu626@gmail.com.