Privacy policy
Version 2 · Last updated 18 October 2026
Who we are
nodd is software that helps small businesses in India meet their obligations under the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025. You can reach us at support@nodd.in. This policy covers the nodd website, the console at /consent/app, hosted Privacy Center pages and the consent banner.
nodd plays two roles. For people who open an account, or who joined our early waitlist, we decide how their data is used. For the visitors of businesses that use nodd, we process consent records on that business's behalf, and that business's own notice applies.
What we collect and why
| Who | Personal data | Why |
|---|---|---|
| Early waitlist (now closed) | Business name, website, platform, role, contact email, languages needed, whether you would pay | To understand who is asking, send early-access updates and decide what to build first |
| Account holders | Email address, sign-in sessions, business name and the notice you write | To sign you in, run your console and publish your Privacy Center |
| Visitors of businesses using nodd | A random visitor id, the notice version shown, the choices made and when | To record consent for that business, so it can show what each visitor agreed to |
We do not sell personal data, show ads, or use it to build marketing profiles. The consent ledger does not store names, email addresses or IP addresses of visitors.
Consent and withdrawal
We use waitlist details only with the consent you gave on the form. You can withdraw it at any time by emailing support@nodd.in, as easily as you gave it. Withdrawal applies from that point on.
Who processes data for us
We use a cloud hosting provider for our servers and database, and an email delivery service to send sign-in codes. They act only on our instructions and under contract. Data may be stored outside India, which the Act allows unless the Government restricts a country; if it does, we will move the data.
How long we keep it
- Waitlist details: until you withdraw consent, or 12 months after launch if you never become a customer.
- Sign-in codes: 10 minutes. Sign-in sessions: 30 days.
- Account data and published notices: while the account is open, then deleted on request.
- Consent records: at least one year from when they were made, as the Rules require, and for as long as the business keeps its account.
Your rights
You can ask us for a summary of your personal data and how we use it, ask us to correct, complete, update or erase it, nominate someone to act for you, and raise a grievance. Email support@nodd.in; we reply to grievances within 90 days. If we do not resolve your grievance, you can complain to the Data Protection Board of India.
If you visited a business that uses nodd, contact that business first: it decides how your consent records are used, and we help it respond.
Security
Everything travels over HTTPS. Sign-in codes and session tokens are stored only as hashes, the consent ledger is hash-chained so changes to past records are detectable, and access to the servers is limited to the owner's own accounts. If a breach affects you, we will tell you and the Data Protection Board as the Rules require.
Children
nodd is a tool for businesses and is not meant for anyone under 18.
Changes
When this policy changes in a way that matters, we update the version and date above and, for waitlist members and account holders, tell you by email.
Contact
Questions about how we use your personal data: nodd, support@nodd.in.