Working draft. This document is provided in good faith and is being finalised with legal review. If anything here conflicts with applicable law, the law prevails.
The short version
- The free readiness tool runs entirely in your browser. Your client's answers, uploaded reports and the generated report are processed on your device and are never uploaded to us.
- The Collect (Pro) tier is login-gated and does store data you submit (data-owner contacts, the BRSR values they provide, evidence files), securely, to do its job.
- We use product analytics only if you opt in, and never include your clients' data in it.
Who we are (the data fiduciary)
Saaksh is built and operated by Rahul Upadhyay (a sole operator, pre-incorporation). For any privacy question or request, contact the grievance contact below.
What we collect, and why
Free tool (on-device, nothing uploaded): the intake form, any report you upload for detection, and the generated report stay in your browser's local storage. We do not receive them.
Collect / Pro tier: to chase and compile BRSR data we store the campaign details you create, the names and email addresses of the data owners you add, the values and prior-year figures they submit, and any evidence documents they upload. Purpose: to run the collection, compute emissions, and produce a draft.
Analytics (consent-based): if you accept analytics, we record anonymous usage events (e.g. a report was generated, a PDF was downloaded) with non-identifying properties like industry and sector. Session replay and autocapture are disabled. You can decline, or change your mind any time via "Cookie settings".
Email you send us (e.g. support) is used only to reply.
Legal basis
We process personal data on the basis of your consent (analytics; using the Pro tier) and for the legitimate uses permitted under the DPDP Act (e.g. providing a service you asked for, responding to your requests).
Sub-processors
We rely on the following service providers. Each is bound to protect the data they handle on our behalf:
| Provider | Purpose | Region |
|---|---|---|
| Vercel | Application hosting & delivery | USA |
| Supabase | Database & file storage for the Collect (Pro) tier | USA |
| Resend | Transactional email (Collect requests, reminders, alerts) | USA |
| Groq | AI inference for grounded narrative drafts & document extraction (Pro) | USA |
| Google (Gemini API) | AI inference for document auto-fill (Pro) | USA |
| Mixpanel | Product analytics, only with your consent | USA |
| Google Analytics | Web analytics, only with your consent | USA |
Cross-border transfer
Our infrastructure is hosted with the providers above, currently in the USA. Under the DPDP Act's model, transfer is permitted unless the data is to a country the Government specifically restricts (no such restriction currently applies). We are planning an India data-residency option.
Retention & deletion
Free tool: nothing is stored with us; clear your browser data and it is gone. Use "Back up work" to keep a copy.
Collect / Pro: we keep campaign data for as long as the collection is active or as you need it, and erase it on request once its purpose is served.
Your rights
You may request access to, correction of, or erasure of your personal data, and you may withdraw consent (e.g. for analytics) at any time, as easily as you gave it. To exercise any right, contact the grievance contact below.
Security
We use encryption in transit and at rest, access controls, and reputable infrastructure. More detail is on our Security page. If you believe data has been exposed, tell us immediately.
Grievance contact
For any privacy question, request, or complaint: Rahul Upadhyay, rahulu626@gmail.com. We aim to respond promptly and within the timelines the DPDP Act prescribes.