Privacy notice
Privacy notice
What we collect, why, where it is kept and your rights.
Draft. This text is under review by an advocate and is not in force yet.
Status: draft, 5 November 2026. Not in force. The final text follows the advocate's review.
Language: English only at launch (owner decision, D-015). The Digital Personal Data Protection Act, 2023 (DPDP Act) allows a notice in other languages on request; the advocate confirms this.
1. Who we are
DHYANSHIV INDIA PRIVATE LIMITED (CIN U69100GJ2025PTC171209) runs DLI, the Digital Legal Infrastructure platform. The registered office is the address on the Certificate of Incorporation (see the website's company details).
DLI is a technology platform for document services. DLI does not perform any notarial act. A notary who is appointed under the Notaries Act, 1952 performs any notarial act. DLI does not choose the notary for you.
Grievance officer: Mr. Dharmesh Vegad. Email grievance@dhyanshivindia.in. Phone +91 7201013251 (company line).
2. What personal data we collect
| Data | When | Why |
|---|---|---|
| Mobile number | Sign-up, sign-in | To send the one-time code and to identify your account |
| Email address | Sign-up, sign-in | To send the one-time code and to identify your account |
| Acceptance of the terms, with the time | Sign-up | To show that you accepted the terms |
| Identity-check consent and its version, with the time | Before a request | To show that you agreed to the identity check |
| Your name | Only after a verified identity check. Not yet available. | Your account profile |
| Sign-in and sign-up codes | Each time you ask for a code | Stored only as a keyed hash. Deleted after 24 hours. |
| Sessions | Each time you sign in | The session token is stored only as a hash. Sessions are removed 30 days after they end. |
| Audit log | Sign-in, account creation and staff actions | Security and evidence (see section 6). Holds the action, the time, a masked identifier and the network address. |
| Staff authenticator secret and backup codes | Staff only | The secret is stored encrypted. Backup codes are stored as hashes. |
Remember me: if you tick "Remember me", your session token is kept in the browser's storage on your device, so you do not sign in each time. If you do not tick it, nothing is kept.
3. What we do not collect
- We do not take an Aadhaar number. The identity check is done by a licensed provider on its own consent screen (see the identity-check note).
- We do not take biometric data (fingerprint, face) and we do not store it.
- We do not take passwords. Sign-in uses one-time codes only.
- The app contains no analytics or advertising tracker. The packages used are listed in the app's dependency file.
4. Why we use it, and on what basis
- To create and run your account, and to send the codes you ask for: the sign-up and sign-in you start.
- To check your identity, only with your separate consent, given before the check.
- To keep the audit log for security, and to meet the rules for security records set by CERT-In (see section 6).
- Legal basis under the DPDP Act: notice and consent (sections 5 and 6 of the Act), and the security safeguards the Act requires (section 8). The advocate confirms the exact basis for each purpose.
5. Where your data is kept
- Your data is kept on a server in India: a virtual private server run by Hostinger, in its Mumbai data centre (verified from the provider's panel on 5 November 2026).
- Daily database backups are kept on the same server, for 14 days.
- Email and SMS providers are not chosen yet. Before launch, we will state where each provider keeps its data. A provider must keep the data in India, or we do not use it.
6. Security
- Connections to the website use HTTPS (the certificate is to be installed before launch).
- Admin access to the server uses a key only. Password login is off.
- A firewall allows only the ports needed (SSH, HTTP, HTTPS). Repeated failed logins are blocked for one hour.
- The audit log is tamper-evident: each entry is linked to the one before it, and the database refuses changes and deletions.
- Server time is synchronised with a time service.
7. How long we keep it
See data-retention.md. In short: incomplete accounts are removed 7 days after sign-up; codes after 24 hours; sessions 30 days after they end. Periods for verified identity records and for the audit log are still to be set by the advocate.
8. Your rights
Under the DPDP Act you can ask us for:
- Access: a copy of the personal data we hold about you and what it is used for (section 11 of the Act).
- Correction and erasure: correct wrong data, or delete data no longer needed for the purpose (section 12).
- Grievance: complain to the grievance officer and get a reply (section 13).
To use a right, write to grievance@dhyanshivindia.in or call +91 7201013251. We will confirm your identity before we act. A change of mobile number or email address is made through support, so that the account stays safe.
The time we take to reply is for the advocate to confirm. Until then, we aim to reply within 15 days, which is the period in the IT Rules, 2021, rule 3(2), for complaints. Whether those rules apply to DLI is for the advocate to confirm.
If we have a personal data breach, we will inform you and the Data Protection Board as the DPDP Act and its rules require.
9. Children
DLI is not designed for children. The app does not yet check age. The DPDP Act requires verifiable consent of a parent for a child under 18 (section 9). The advocate decides the age rule before launch.
10. Changes
We will publish any change to this notice, with its date.