DiligenceReadyसमीक्षा सिद्ध

Privacy Policy

Last updated: [EFFECTIVE DATE]

This Privacy Policy explains how [LEGAL ENTITY NAME] ("DiligenceReady", "we", "us", or "our") collects, uses, shares, and protects personal data when you use the DiligenceReady websites at diligenceready.in and app.diligenceready.in and the related services (together, the "Services").

DiligenceReady is a due diligence readiness platform for Indian MSMEs. We help companies and their advisors prepare, organise, and review the documents an investor or lender expects, before a transaction. This policy is written to align with India's Digital Personal Data Protection Act, 2023 (the "DPDP Act"). Where you access the Services from outside India, additional local laws may also apply.

Please read this policy together with our Terms and Conditions. If you do not agree with this policy, please do not use the Services.

This document is a working draft. It must be reviewed and finalised by qualified legal counsel before it is relied upon. Bracketed values marked like [THIS] are placeholders you need to complete.

1. Who we are

The data fiduciary responsible for your personal data is:

  • Entity: [LEGAL ENTITY NAME]
  • Registered address: [REGISTERED ADDRESS]
  • Email: [privacy@diligenceready.in]

For the purposes of the DPDP Act, we act as a Data Fiduciary for the account and profile data of our users, and as a Data Processor for the diligence content that a customer organisation chooses to process through the Services.

2. The personal data we collect

We collect the following categories of personal data.

Account and identity data. When you create an account we collect your name, email address, and a securely hashed password. If you sign in with Google, we receive your Google account identifier, name, email address, and profile image from Google. We do not receive or store your Google password.

Organisation and profile data. When you set up a workspace we collect the company name and the answers you provide in the readiness questionnaire, such as turnover range, sector, existing advisors, and the computed readiness tier. This may include information about your organisation and the people associated with it.

Diligence content you upload. As part of the Services you may attach documents to checklist items. These documents can contain personal data of third parties, for example promoters, directors, employees, or customers. Where your workspace is connected to Google Drive, these documents are stored in your organisation's own Google Drive account, not on our servers, and we retain only references and metadata (such as file name, size, type, version, and upload time). Where Google Drive is not connected, documents are stored in our managed storage on your behalf.

Communications. We collect the content of messages, notes, support requests, and emails you send to us or through the Services.

Usage, device, and diagnostic data. We collect log data, approximate location derived from your IP address, browser and device information, pages viewed, features used, and product analytics events. We also collect error and performance diagnostics when the Services do not work as expected.

Cookies and similar technologies. See Section 5.

We do not intentionally collect special category data beyond what a customer chooses to upload as diligence content, and we ask that you upload such content only where you have a lawful basis to do so.

3. How we use personal data

We use personal data for the following purposes:

  • To create and manage your account and authenticate you.
  • To provide and operate the Services, including the readiness checklist, workspace, document handling, notes, and, where available, reviewer features.
  • To send you transactional communications, such as verification emails, notifications, and service updates.
  • To understand how the Services are used, to measure and improve them, and to develop new features.
  • To keep the Services secure, prevent fraud and abuse, debug issues, and maintain records.
  • To comply with law and to establish, exercise, or defend legal claims.

4. Our lawful bases

Under the DPDP Act we process personal data on the basis of your consent, which you give when you create an account and agree to this policy, and on the basis of certain legitimate uses permitted by law, such as providing a service you have requested and maintaining the security of the Services. Where we rely on consent, you may withdraw it at any time as described in Section 10, though this will not affect processing carried out before withdrawal.

5. Cookies and similar technologies

We use a small number of first party cookies and similar storage technologies.

Essential cookies. The application at app.diligenceready.in uses cookies that are strictly necessary to sign you in and keep your session secure. The Services cannot function without these.

Analytics. The application uses PostHog to understand product usage. For signed in users this sets a first party analytics identifier (in a cookie and in local storage) so that we can measure how features are used and improve them. The public marketing website at diligenceready.in does not set analytics cookies and runs analytics without cookies.

You can control cookies through your browser settings. Blocking essential cookies will prevent you from signing in.

6. How we share personal data

We do not sell your personal data. We share personal data only as described below.

Service providers (data processors). We use trusted providers to run the Services. Each processes personal data on our instructions and under contract. Our current providers include:

  • Supabase: database and managed file storage. Processing location: India (Mumbai).
  • Google (OAuth and Drive): sign in, and storage of your diligence documents in your own Google Drive. Processing location: global.
  • Vercel: application hosting and content delivery. Processing location: global.
  • Resend: transactional email delivery. Processing location: global.
  • PostHog: product analytics. Processing location: [United States].
  • Sentry: error and performance monitoring. Processing location: [United States].

We will keep an up to date list of our processors and provide it on request.

Within your organisation. Content and activity in a workspace is visible to other members of that workspace and, where you request it, to reviewers or advisors you invite or are matched with.

Legal and safety. We may disclose personal data if required by law, regulation, legal process, or governmental request, or where we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

Business transfers. If we are involved in a merger, acquisition, financing, or sale of assets, personal data may be transferred as part of that transaction, subject to this policy.

7. Storage, location, and retention

Your account, profile, and workspace data is stored primarily in Supabase infrastructure located in India (Mumbai). Some of our processors, such as PostHog and Sentry, may process limited usage and diagnostic data outside India.

We retain personal data for as long as your account is active and for as long as needed to provide the Services, then for a further period as required to comply with our legal obligations, resolve disputes, and enforce our agreements. When data is no longer required, we delete it or anonymise it. You can ask us to delete your account and associated data as described in Section 10.

8. Cross border transfers

Because some of our processors operate outside India, your personal data may be transferred to and processed in other countries. Where we do so, we take steps to ensure your data receives an appropriate level of protection through contractual and technical safeguards. We will only transfer personal data to countries that are not restricted under the DPDP Act or applicable rules.

9. Security

We use administrative, technical, and physical safeguards designed to protect personal data, including encryption in transit, hashed passwords, access controls, audit logging, and least privilege access for our team. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. You are responsible for keeping your login credentials confidential.

10. Your rights

Subject to the DPDP Act and applicable law, you have the right to:

  • Access a summary of the personal data we process about you and how we process it.
  • Correct or update inaccurate or incomplete personal data.
  • Request erasure of your personal data where it is no longer required.
  • Withdraw consent you have given, at any time.
  • Nominate another individual to exercise your rights in the event of your death or incapacity.
  • Have your grievances addressed through the process in Section 11.

To exercise any of these rights, contact us at [privacy@diligenceready.in]. We may need to verify your identity before acting on a request. We will respond within the timelines required by law.

11. Grievance Officer

In line with the DPDP Act, we have appointed a Grievance Officer you can contact with any concern about how we handle your personal data:

  • Name: [GRIEVANCE OFFICER NAME]
  • Email: [grievance@diligenceready.in]
  • Address: [REGISTERED ADDRESS]

We aim to acknowledge grievances promptly and to resolve them within the period required by law. If you are not satisfied with our response, you may escalate to the Data Protection Board of India.

12. Children

The Services are intended for business use by individuals who are at least 18 years old. We do not knowingly collect personal data of children. If you believe a child has provided us personal data, please contact us and we will take appropriate steps to delete it. Where required, processing of a child's data will only be undertaken with verifiable parental consent.

13. Third party links and services

The Services may link to or integrate with third party websites and services, such as Google Drive. Those services are governed by their own privacy policies, and we are not responsible for their practices. We encourage you to review them.

14. Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the date at the top and, where appropriate, notify you through the Services or by email. Your continued use of the Services after an update means you accept the revised policy.

15. Contact us

If you have any questions about this policy or our privacy practices, contact us at:

  • Email: [privacy@diligenceready.in]
  • Address: [LEGAL ENTITY NAME], [REGISTERED ADDRESS]