Data Protection & DPDP Act Compliance

Last updated: 3 October 2026

This page explains, in plain language, how ClaimRights handles your personal data and how our practices line up with India's Digital Personal Data Protection Act, 2023 (the "DPDP Act"). It sits alongside our Privacy Policy, which remains the fuller, primary document — this page is a plain-language summary focused specifically on the DPDP Act.

1. What the DPDP Act Requires, in Brief

The DPDP Act is India's law governing how organisations ("Data Fiduciaries") collect and use the personal data of individuals ("Data Principals"). Its core requirements, at a glance:

Requirement	What it means
Notice	Tell you what data is collected and why, before or when we ask for your consent
Consent	Your consent must be free, specific, informed, and can be withdrawn at any time
Purpose limitation	We may only use your data for the purpose we told you about
Data minimisation	We should only collect what we actually need
Data Principal rights	You have the right to access, correct, and erase your data, and to grievance redressal
Reasonable security	We must take reasonable steps to protect your data from breach or misuse

The DPDP Act was passed in August 2023. The Digital Personal Data Protection Rules, 2025 were notified by the Ministry of Electronics and Information Technology on 13 November 2025, and the Act's provisions are commencing in phases through 2026 and 2027. We've written this page to reflect the Act's principles now, ahead of the phases that apply to us, rather than waiting for each provision to formally commence.

2. What We Collect, and Why

Your uploaded rejection/authorization letter's file is never sent to our servers. It's read entirely inside your own browser. The text extracted from it is sent to OpenAI to verify it's a genuine letter and read its details; OpenAI does not use this text to train its models and deletes it within 30 days. We don't store this text ourselves.

If you create an account, here is everything else we collect, and why:

What	Why we collect it
Name, email address, mobile number	To create and manage your account, and to contact you about documents you generate
Document usage records (which document, date)	To deliver your documents and provide support
Messages sent through our website chat, if you choose to forward one to our team	To respond to your question or issue

The Service is currently free during our public pilot, so we do not collect payment or card details at all. Our payment processor, Razorpay, an RBI-authorised payment aggregator, remains integrated in our systems in case pricing is reintroduced in the future; if it is, we would never receive your raw card or bank details ourselves. See our Privacy Policy, Section 2, for the complete list.

3. Consent

We ask for your consent before collecting your name, email address and mobile number — for example, via the consent checkbox on our sign-up form and the notice shown the first time you visit this website. You can withdraw consent at any time by requesting deletion of your account (see Section 5 below), though this will mean we can no longer provide the services that depend on that account, such as generating and delivering documents.

4. Your Rights as a Data Principal

Right to AccessAsk us what personal data we hold about you

Right to CorrectionAsk us to fix inaccurate or incomplete data

Right to ErasureAsk us to delete your personal data

Right to Grievance RedressalRaise a concern about how we've handled your data

To exercise any of these rights, email support@claimrights.in. For deletion specifically, see our dedicated Data Deletion page for the exact steps and timeline.

5. How to Reach Us About Data Protection

For any question, request, or concern about how we handle your personal data — including the rights listed above — contact us at support@claimrights.in. We aim to respond within a reasonable time, and for deletion requests specifically, within 7 business days (see our Data Deletion page).

If you believe your concern hasn't been resolved, the DPDP Act also provides for complaints to the Data Protection Board of India, the regulator established under the Act.

6. Security Measures

The website is served over HTTPS (encrypted in transit).
Your account data is stored with Supabase, with Row Level Security enabled so that each user's data is only accessible to that user, not to other users.
Your uploaded rejection letter's file is never transmitted to or stored on our servers at all — it stays in your browser. The text extracted from it is sent to OpenAI's API to verify it's genuine and read its details; OpenAI doesn't use this text to train its models and deletes it within 30 days.
We do not collect card or bank account details at all during our free pilot, since no payment is processed; if pricing returns, those would be handled directly by Razorpay.
No system can be guaranteed 100% secure, but we rely on established providers (Supabase, Razorpay, Resend) that maintain their own security practices, and we don't store more data than we need.

7. Data Sharing & Third Parties

We do not sell your personal data. We share limited data with the service providers who help us run ClaimRights — Supabase (database & authentication), Razorpay (payments — currently inactive during our free pilot), Resend (email delivery), ImprovMX (email forwarding), and OpenAI (receives only the text extracted from your letter, to verify it's genuine and read its details; not used to train its models, deleted within 30 days) — solely to operate the Service. The full detail of what each provider does is in our Privacy Policy, Section 4.

8. Data Retention

We keep your account and document usage records for as long as your account is active, and afterward only as long as needed for legal, tax, and accounting purposes. See our Privacy Policy, Section 5, for full detail.

A note on this page: this is a plain-language summary of our data practices and how we understand them to align with the DPDP Act's principles. It is not a certification of compliance, and the DPDP Rules are still commencing in phases as of the date above. It isn't legal advice, and if you have a specific compliance question, we'd encourage you to consult a qualified professional or refer directly to the DPDP Act and Rules.

For the complete picture of how we handle your data, please also read our Privacy Policy and Terms of Service.

← Back to ClaimRights