Privacy (DPDP)
Last updated: [date]. Governed by the Digital Personal Data Protection Act, 2023.
What data we collect
We collect your name, email address, phone number, and the details of your case that you provide during triage and intake. We collect documents you upload. We collect payment confirmation data from Razorpay (transaction ID, amount, method) — not your card number or CVV.
How we use it
Solely to draft your complaint package, communicate with you about your case, and send transactional emails. We do not use your data for marketing. We do not sell it. We do not share it with third parties except the services that process it on our behalf (Razorpay for payments, Supabase for file storage, Resend for email delivery).
How we protect it
Documents are encrypted at rest and accessible only via signed, time-limited URLs. Database access is restricted to First72 staff. Staff access is logged.
Retention
Active case data is retained for 12 months after case closure. Deleted accounts are hard-deleted after 90 days. You may request deletion at any time.
Your rights under DPDP
You have the right to access your data, correct it, and request deletion. To exercise any of these rights, email first72.in@gmail.com with “DPDP Request” in the subject line.
Questions
Write to first72.in@gmail.com. We aim to respond within 4 business hours.