Privacy notice of this website

CynorSense Solutions Private Limited is the Data Fiduciary for the data on this website and in early access requests emailed to us. Basis. We would ask for your consent before using any optional cookie or analytics tool; this website uses none. When you request early access, you send us your business name, work email, sector and size yourself, for us to answer your request and write to you about it (section 7(a) of the Act, data you give for a stated use). The sign-in cookies and the network address used to stop failed sign-ins keep the console secure.

The pages of this website, star.dpdpa.support, set no cookies of their own. Signing in to the console at /login sets the cookies that keep you signed in. None is used for analytics or advertising, and the pages load nothing from other websites. If you switch to dark mode, this website keeps that choice in your browser storage on your device, so the next page opens in dark mode. Only the page in your browser reads it; it is not sent to us or anyone else. The web server for this website keeps no request log: it does not record the pages you read. When you sign in, the sign-in service records your network address (for IPv6, no more than the first four of its eight parts) to stop floods and misuse. We keep these records for one year from when they are made, as rules 6(1)(e) and 8(3) of the DPDP Rules, 2025 require from 13 May 2027, and we apply this now, use them only for security and to meet the law, then delete them.

Website analytics, Google Tag Manager & campaign attribution

Consent-gated telemetry (DPDP Act, 2023 s.6 & Google Consent Mode v2). Before you make a choice in our consent banner, all optional analytics and advertising storage flags (analytics_storage, ad_storage, ad_user_data, ad_personalization) default to denied. Only if you actively grant the Website analytics purpose in our banner (or via the Cookie choices / My Privacy Dashboard controls in the footer) does the browser release our analytics script.

Separate configurations for star.dpdpa.support and app.dpdpa.support. We maintain strictly separated measurement streams and Google Tag Manager containers for our public product site versus our application and gateway surfaces:

• star.dpdpa.support (Product, Pricing, 14-Point Guide & Self-Service Onboarding): Google Analytics 4 Measurement ID G-YD500VW80B and Google Tag Manager container GTM-5P8STAR (IP anonymisation on, Google signals off, ad personalisation signals off).
• app.dpdpa.support (Console, Gateway & Data Principal Rights Surfaces): Separate Measurement ID G-9K4DPDPAPP and container GTM-7X2DPDPAPP, restricted to non-PII operational journey stages (stage_3_consent_choice, stage_7_tenant_provisioned, stage_8_active_compliance) with zero cross-site advertising cookies.

Customer journey mapping & Instagram / LinkedIn lead attribution. When you arrive on star.dpdpa.support from an Instagram Reel (utm_source=instagram&utm_medium=reel), Instagram Post (utm_source=instagram&utm_medium=post, ig_rid, fbclid), or LinkedIn post/campaign (utm_source=linkedin, li_fat_id), your browser stores a session-only, non-PII campaign summary (dpdp_lead_attr: channel, format and campaign name) in sessionStorage so we can understand which educational Reels, Posts or LinkedIn articles lead to 14-Point Guide requests, Pricing unlocks and Early Access registrations across our 8-stage customer journey. You can withdraw analytics consent or exercise your Data Principal rights (Personal Consent Artifact download, correction, erasure, or grievance within the 90-day statutory SLA under Rule 14(3)) at any time using the slim My Privacy Dashboard button in the footer of every page.

Early access registration and requests (notice version 1)

On the Early Access page (/register/), you can submit the interactive self-service registration form (protected by an in-browser proof-of-work check and a 6-character email verification code) or send an email to [email protected]. We receive your business name, work email, sector and size, and, if you add them, your website domain and your Data Protection Officer’s email. We use them only to verify your work mailbox, create or record your early-access request for DPDP Star, and write to you about your account (section 7(a) of the Act). Unverified form submissions expire after 7 days; verified early-access enquiries are kept for 12 months and then deleted unless converted into an active organisation account. You can ask us for a summary of this data and how we use it, ask us to correct, complete, update or erase it, withdraw your request, nominate someone to use these rights for you if you die or cannot act yourself, or raise a grievance, by writing from the email you used to [email protected] (sections 11 to 14 of the Act). We answer grievances as quickly as we can, and always within 90 days (Rule 14(3) of the DPDP Rules, 2025). From 13 May 2027, if our answer does not settle it, you can complain to the Data Protection Board of India (sections 13(3) and 27 of the Act).

Your organisation’s visitors. When your organisation uses DPDP Star, the personal data of its visitors that DPDP Star records is processed by CynorSense Solutions Private Limited as your Data Processor, on your instructions and under the Terms of use. You remain the Data Fiduciary for that data. Separately, for our own security we keep short records of requests that fail our checks, which may include a network address; for those records we are the Data Fiduciary and keep them for one year, then delete them.

Your acceptance of the Terms of use. When you register on /register/ or send an early-access email, we record your acceptance of the Terms of use (`terms_version = 1`, `notice_version = 1`) for 12 months (or for the life of your organisation account), then delete it.

14-Point Guide & brochure request (notice versions b1 and b2)

The 14-Point CMS Guide page (/brochure/) has a form (`notice_version = b1` / `b2`). When you ask for the 14-Point Architecture & Evidence Guide (brochure) you give your name, work email, company and, if you wish, your role. CynorSense Solutions Private Limited uses them to email you a private signed link to the DPDP Star 14-Point Guide (section 7(a) of the Act, data you give for a stated use). The link works for 72 hours. We keep your name, work email, company, role, your choice about follow-up emails and the time you made it. A short proof-of-work check runs in your browser to keep out automated requests; it sends nothing to any other company. The email is sent through our email provider, Microsoft 365, and we keep no copy of it in Sent Items.

To stop the form being used to flood mailboxes, we keep coded forms (keyed hashes) of your email address and of the first part of your network address (the first three parts of an IPv4 address, or the first two and the first three of the eight parts of an IPv6 address) with each brochure email. We allow at most 3 emails a day to one address and 5 requests a day from one network. We use these coded forms only for these limits and delete them within 3 days, also if you withdraw.

The follow-up box is separate and unticked, and the brochure does not depend on it. Follow-up emails are emails about DPDP Star, such as product news and how to get started. If you do not tick the box, or tick it but do not open the confirm link, we keep your details for 90 days from your request, to send the brochure again if you ask and to keep the links in the email working, then erase them. If you tick it, we send follow-up emails about DPDP Star only after you click the confirm link in the brochure email; if you confirm follow-up emails, we keep your details for 12 months from the day you confirm, then erase them unless you withdraw sooner. You can withdraw at any time with the link in every email; withdrawing erases your details and stops all emails from us. If someone asks for the brochure again with your email address and different answers, your details do not change. We email you a link, which works once for 72 hours, to a page that shows the new answers and saves them only if you press its button. Until then we keep the new answers, encrypted, with your details, and erase them when they are saved, when a newer request replaces them, or when your details are erased.

This notice is in English. To read it in Hindi or another language listed in the Eighth Schedule to the Constitution, write to [email protected] and we will send it before you decide. You can also ask for a summary of your details, ask us to correct, complete, update or erase them (sections 11 and 12 of the Act), nominate someone to use these rights for you if you die or cannot act yourself (section 14 of the Act), or raise a grievance, by writing to [email protected]. We answer grievances as quickly as we can, and always within 90 days (Rule 14(3) of the DPDP Rules, 2025). From 13 May 2027, if our answer does not settle it, you can complain to the Data Protection Board of India (sections 13(3) and 27 of the Act).

Questions or requests about this notice: [email protected].

CynorSense Solutions Private Limited