Last updated: 19 June 2026
Who we are
checkDPDP ("we", "us") operates https://www.checkdpdp.in and the related tools and services. We are a Data Fiduciary under India's Digital Personal Data Protection Act, 2023.
What personal data we collect, and why
- When you scan a URL — we record the URL you submitted, the score we computed, a per-category summary, and the IP address that initiated the scan. Purpose: to show you results, prevent abuse, and improve our checks.
- When you contact us — we record your name, email, subject and message. Purpose: to respond and (where relevant) to route DPDP grievances to our Grievance Officer.
- When you use our tools — for the Cookie Consent Manager and the Data Principal Rights handler, we record the configuration you generated. Purpose: to serve your widget on your site and to keep a tamper-evident consent log.
- Analytics — only if you opt in via the cookie banner. We use first-party product analytics to see which pages help and which don't.
How long we keep it
- Scan records: 90 days for free scans; longer for Pro accounts based on your retention setting.
- Initiating IP for scans: 7 days, for abuse prevention.
- Contact-form submissions: 12 months after the last reply.
- Account & billing data (if you have a paid plan): for the life of the account, plus statutory retention.
Who we share it with
We use a small set of sub-processors listed on our Trust & Security page. We don't sell personal data, and we don't share it with third parties for marketing purposes.
Your rights
You can ask us to:
- Provide a summary of personal data we hold about you.
- Correct or complete it.
- Erase it (where retention is not otherwise required by law).
- Withdraw consent at any time — without affecting prior processing.
- Nominate someone to exercise your rights on your behalf.
- Raise a grievance with our Grievance Officer (below).
To exercise any of these, email grievance@checkdpdp.in. We aim to respond within 30 days.
Cross-border transfers
Some of our sub-processors are based outside India. We host on Vercel (United States edge infrastructure with a Mumbai POP), use Google services (United States) for analytics, fonts, reCAPTCHA and Translate, and route email through Resend (United States and the European Union, Ireland). Database hosting is on MongoDB Atlas (region: AWS Mumbai, India). Under Section 16 of the DPDP Act, the Government may restrict transfers to specified countries; until then, these transfers are permitted. We name the destinations so your consent is genuinely informed.
Children's data
checkDPDP is intended for website operators, not for under-18 users. We do not knowingly collect personal data from any child (a person under the age of 18). If we ever need to process the personal data of a child, we will require verifiable parental consent from the parent or lawful guardian and we will not undertake tracking, behavioural monitoring, or targeted advertising directed at children, in accordance with Section 9 of the DPDP Act 2023. If you believe a child's data has been collected, contact the Grievance Officer below and we will erase it.
Grievance Officer
For any DPDP-related grievance, contact:
Grievance Officer, checkDPDP
grievance@checkdpdp.in
Response SLA: 30 days.
Changes
We may update this notice as the law, our services and our sub-processors evolve. Material changes will be flagged at the top of the page and through the cookie banner on your next visit.