Privacy Policy

1. Identification of Data Fiduciary

This Privacy Policy governs the processing of personal data by InfoSkills Technology Pvt. Ltd. (“AuthSetu”, “we”, “us”, or “our”), acting as a Data Fiduciary under the Digital Personal Data Protection Act, 2023 (DPDP Act) and a Data Controller under the General Data Protection Regulation (GDPR).

2. Categories of Personal Data Collected

We collect and process personal data strictly in alignment with our formal Data Inventory:

• Developer & Account Credentials: Work email address, password hash (Argon2id), full name, organization name, phone number, and multi-factor authentication credentials (WebAuthn public keys, encrypted TOTP secrets).
• Verification & Digital Locker Payloads: Where developers configure user verification pipelines, we process identity documents (PAN, Driving Licence, Vehicle RC, GSTIN records, DigiLocker XML exchanges) exclusively upon customer consent.
• Billing & Tax Identifiers: Legal business name, 15-character Goods and Services Tax Identification Number (GSTIN), Permanent Account Number (PAN), billing address, and transaction identifiers.
• Technical Telemetry & Security Logs: IP address, browser User-Agent, device classification, timestamped API access logs, and security audit event records.

3. Lawful Grounds & Purposes of Processing

Under Section 4 and Section 6 of the DPDP Act 2023 and Article 6 of the GDPR, personal data is processed exclusively on the following legal bases:

• Performance of Contract: Provisioning authentication tokens, executing verification APIs, delivering webhooks, and billing subscription services.
• Explicit Consent: Digital Locker document retrieval and step-up identity checks initiated by data principals.
• Legal & Regulatory Obligations: Retention of GST-compliant invoices under the Central Goods and Services Tax Act, 2017 (7-year retention).
• Legitimate Security Interests: Defense against brute-force attacks, DDoS mitigation, and credential stuffing prevention.

4. Data Storage & Localization (India Residency)

In accordance with Indian regulatory mandates, 100% of customer databases, Redis caches, encryption keys, and identity payloads reside within the AWS ap-south-1 region (Mumbai, India). We do not transfer sensitive verification records outside Indian territorial jurisdiction without explicit regulatory exemptions.

5. Data Retention & Erasure Schedule

6. Rights of the Data Principal (User Rights)

Under Chapter III of the DPDP Act 2023 and Chapter III of GDPR, you hold the following rights:

• Right to Access & Data Portability: Request an encrypted JSON archive of all personal data held about your account.
• Right to Correction & Erasure: Rectify inaccurate records or request account erasure subject to mandatory tax retention exceptions.
• Right of Grievance Redressal: Submit grievances regarding data handling directly to our designated Grievance Officer.

7. Grievance Officer Details

In compliance with Section 10 of the DPDP Act 2023 and Rule 5(9) of the Information Technology (Intermediary Guidelines) Rules, contact: