DPDP Act compliance

Every byte of Indian-user personal data lives in MongoDB Atlas Mumbai. Read replicas in Singapore are anonymised + non-PII for analytics. No cross-border PII transfer without your explicit consent.

• Right to access: download every byte we hold on you. Settings → Download my data ships a JSON + CSV bundle within 30 days (instant in practice).
• Right to correction: Profile → Edit covers most. For anything else: dpo@unghost.com.
• Right to erasure: Settings → Delete my account. 30-day grace, then PII anonymisation preserving the financial + audit trail (legally required).
• Right to grievance: escalate to our DPO. If unresolved, file with the Data Protection Board of India.
• Right to nominate: in case of incapacity/death, you can nominate someone to exercise your rights. Email dpo@unghost.com.

We process your data under two grounds:

• Consent: service communications, marketing (opt-in), search visibility, AI Coach memory.
• Certain legitimate uses: running the marketplace, fraud prevention, compliance with Indian law (GST, TDS, audit-trail retention).

You can revoke consent at any time in Settings → Privacy. Revoking consent for service communications limits platform functionality.

Every consent capture (signup, payment, marketing opt-in) is recorded with timestamp + IP + ToS version. You can view your consent history in Settings → Privacy → Consent log (coming soon).

• Detected breach → notify Data Protection Board within 72 hours.
• Affected users notified immediately via email + in-app banner.
• Public post-mortem on status.unghost.com within 7 days.

DPO: Anika Rao · dpo@unghost.com · response SLA: 7 business days for any DPDP request.

Registered office: unGhost Technologies Pvt Ltd, Mumbai · CIN: UXXXXXMH2025PTCXXXXXX.

• Profile + applications: until you delete your account. 30-day grace, then anonymised.
• Financial records (transactions, GST): 7 years per Indian law. Anonymised from your side but linked internally.
• Audit logs: 7-year retention. Immutable.
• Resume files: 30 days after last activity unless you sign back in.
• Bootcamp content: 1 year minimum so you can access purchased material.

We share data with vetted processors only when necessary to run the platform. All operate under data-processing agreements:

• MongoDB Atlas (Mumbai) — primary database
• Cloudflare R2 (Mumbai) — file storage
• Upstash Redis (Mumbai) — session cache
• Groq + Google Gemini — AI inference (no model training)
• PhonePe — payments (UPI / QR)
• Resend — transactional email