Draft pending legal review
This document reflects how TrustShot is built and operated, and is being reviewed by counsel before general availability. Highlighted items are details still to be confirmed. Questions: contact@trustshot.in
1.Who we are and when this notice applies
TrustShot is operated by [Registered legal entity name], a [private limited company incorporated under the Companies Act, 2013] (CIN [CIN]), with its registered office at [Registered office address, India] (“TrustShot”, “we”, “us”).
We handle personal data in two different roles, and this distinction decides who you should contact:
- As a Data Fiduciary (under section 2(i) of the Digital Personal Data Protection Act, 2023, the “DPDP Act”): for people who visit trustshot.in, sign up for a trial, administer a TrustShot account, buy a plan or contact us. This notice covers that processing.
- As a Data Processor for our customers: when a company publishes its Trust Center on TrustShot, the content it uploads and the details of people who request access to its documents are processed on that company’s instructions. That company is the Data Fiduciary, its own privacy notice applies, and our obligations to it are set out in the Data Processing Addendum. If you requested a document from a company’s Trust Center, please contact that company first; we will help it respond.
2.Personal data we collect
We collect only what each purpose below needs. Itemised:
| When | Personal data | Source |
|---|---|---|
| Free trial signup | Full name, work email address, mobile number, company name, the one-time codes you enter, and the time each was verified | You |
| Consent record | The versions and text of the notices and terms you accepted, the time of acceptance, IP address and browser user agent | You and your browser |
| Account administration | Name, work email, role, sign-in events, and changes you make to your Trust Center | You and your organisation |
| Billing | Billing contact, company GSTIN and address, payment reference and status. Card, UPI and bank details are collected by our payment processor, not by us. | You and our payment processor |
| Support and correspondence | What you write to us and your contact details | You |
| Security and operation of the service | IP address, request time, URL, browser user agent, and error logs | Automatically |
We do not knowingly collect personal data of children (persons under 18). TrustShot is a business service and an account can be created only with a verified corporate email address.
We do not use advertising cookies, tracking pixels or third-party analytics that profile individuals on trustshot.in. See the Cookie Notice.
3.Why we process it, and on what basis
| Purpose | Data used | Basis under the DPDP Act |
|---|---|---|
| Verify that a trial request comes from a real person at a real organisation, and decide whether to approve it | Name, work email, mobile, company, verification times | Consent (section 6) |
| Create and run your Trust Center account and trial | Account and usage data | Consent (section 6) |
| Send service messages: verification codes, approval, trial expiry and data purge reminders, security notices | Email, mobile | Consent (section 6); these messages are necessary to the service you asked for |
| Keep a record of what you agreed to | Consent record | Compliance with law and our ability to demonstrate valid consent (sections 6(10) and 7) |
| Invoicing and tax compliance | Billing data | Legitimate use for compliance with law, including GST and income tax law (section 7) |
| Protect the service from abuse and investigate incidents | Logs, IP address | Legitimate use, including compliance with CERT-In directions (section 7) |
| Product news and offers | Separate, optional consent, unticked by default. Declining it never affects your trial. |
We do not sell personal data, do not use it to build advertising profiles, and do not use customer content to train machine-learning models.
4.Where your data is stored
Application data, including trial signups, consent records, account data and the content of customer Trust Centers, is stored and processed in data centres located in India.
Some service providers necessarily handle limited data outside India: for example, our content delivery network serves the website from the location nearest each visitor, and an email delivery provider may route messages internationally. Each is listed, with where it operates, on our Sub-processors page. Any transfer outside India is made only to a country not restricted by the Central Government under section 16 of the DPDP Act, and under a contract requiring the recipient to protect the data.
5.How long we keep it
- Trial requests that are not approved: deleted within 90 days of the decision, except the consent record.
- Trial accounts that do not convert: all Trust Center content and account data is permanently deleted after the trial and its notified grace period end. We tell you before this happens. It cannot be recovered afterwards.
- Paying customers: for the term of the subscription, then deleted within 90 days of termination, unless you ask for earlier deletion or an export.
- Consent records: kept for as long as the consent is relied on and for a further period needed to demonstrate it, which we set at three years, then deleted.
- Invoices and billing records: for the period tax law requires (currently eight years under GST and income tax law).
- Security logs: at least the period CERT-In directions and the DPDP Rules require, and no longer than needed for security purposes.
When a purpose ends, or you withdraw consent, we erase the personal data unless a law requires us to keep it, and ask our processors to do the same (section 8(7)).
7.How we protect it
We apply reasonable security safeguards as section 8(5) of the DPDP Act requires, including encryption in transit (TLS) and at rest, access restricted to people who need it, multi-factor authentication for administrative access, logging of access, and backups. One-time codes are stored only as hashes and expire within minutes. Details are on our Security page.
If a personal data breach affects you, we will inform you and the Data Protection Board of India as the DPDP Act and Rules require, and report cyber security incidents to CERT-In within the time its directions set.
8.Your rights
As a Data Principal under the DPDP Act you may:
- Access a summary of your personal data we process and the processing activities, and the identities of those we have shared it with (section 11).
- Correct, complete or update it, and erase it where it is no longer needed for the purpose or you withdraw consent (section 12).
- Withdraw consent at any time, as easily as you gave it (section 6(4)). Withdrawal does not affect processing already done, and if you withdraw consent needed for the trial, we will close it.
- Have a grievance redressed by us (section 13), and then complain to the Data Protection Board of India if you are not satisfied.
- Nominate another person to exercise these rights if you die or become incapacitated (section 14).
To exercise any right, email contact@trustshot.in from the address registered with us, with the subject “Data Principal request”. We may ask you to confirm your identity before acting. We acknowledge requests within 72 hours and respond within the period prescribed under the DPDP Rules, and in any case aim to resolve them within 30 days.
9.Grievance Officer and the Data Protection Board
Grievance Officer: [Name of Grievance Officer]
Email: contact@trustshot.in
Address: [Registered office address, India]
If your grievance is not resolved to your satisfaction, you may complain to the Data Protection Board of India through the means it makes available. You must first exhaust our grievance process, as section 13(3) of the DPDP Act requires. The full process is on our Grievance Redressal page.
10.Your duties
Section 15 of the DPDP Act asks Data Principals not to impersonate another person, not to suppress material information, and not to register false or frivolous grievances. Please use only your own work email and mobile number when you sign up.
11.Changes to this notice
We version this notice. If we change it materially, we will email account holders before the change takes effect and, where the change needs fresh consent, ask for it. Earlier versions are available on request.
12.Language
On request, we will provide this notice in English or any language specified in the Eighth Schedule to the Constitution of India, as section 5(3) of the DPDP Act provides. Email contact@trustshot.in with the language you prefer.