Privacy policy
Version 1 · Last updated 18 October 2026
Who we are
nodd is software that helps small businesses in India meet their obligations under the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025. It is run by Debayan, reachable at debayansen.ds.ds@gmail.com. This policy covers the nodd website, the console at /app, hosted Privacy Center pages and the consent banner.
nodd plays two roles. For people who join our waitlist or open an account, we decide how their data is used. For the visitors of businesses that use nodd, we process consent records on that business's behalf, and that business's own notice applies.
What we collect and why
| Who | Personal data | Why |
|---|---|---|
| Waitlist | Business name, website, platform, role, contact email, languages needed, whether you would pay | To understand who is asking, send early-access updates and decide what to build first |
| Account holders | Email address, sign-in sessions, business name and the notice you write | To sign you in, run your console and publish your Privacy Center |
| Visitors of businesses using nodd | A random visitor id, the notice version shown, the choices made and when | To record consent for that business, so it can show what each visitor agreed to |
We do not sell personal data, show ads, or use it to build marketing profiles. The consent ledger does not store names, email addresses or IP addresses of visitors.
Consent and withdrawal
We use waitlist details only with your consent, given on the form. You can withdraw it at any time by emailing debayansen.ds.ds@gmail.com, as easily as you gave it. Withdrawal applies from that point on.
Who processes data for us
- Oracle Cloud Infrastructure: hosting and database, in Singapore.
- Resend: sends sign-in codes by email, from its Tokyo region.
- Let's Encrypt issues our HTTPS certificate; GoDaddy runs our DNS. Neither receives your personal data.
This means data is stored outside India. The Act allows this unless the Government restricts a country, and we will move data if it does.
How long we keep it
- Waitlist details: until you withdraw consent, or 12 months after launch if you never become a customer.
- Sign-in codes: 10 minutes. Sign-in sessions: 30 days.
- Account data and published notices: while the account is open, then deleted on request.
- Consent records: at least one year from when they were made, as the Rules require, and for as long as the business keeps its account.
Your rights
You can ask us for a summary of your personal data and how we use it, ask us to correct, complete, update or erase it, nominate someone to act for you, and raise a grievance. Email debayansen.ds.ds@gmail.com; we reply to grievances within 90 days. If we do not resolve your grievance, you can complain to the Data Protection Board of India.
If you visited a business that uses nodd, contact that business first: it decides how your consent records are used, and we help it respond.
Security
Everything travels over HTTPS. Sign-in codes and session tokens are stored only as hashes, the consent ledger is hash-chained so changes to past records are detectable, and access to the servers is limited to the owner's own accounts. If a breach affects you, we will tell you and the Data Protection Board as the Rules require.
Children
nodd is a tool for businesses and is not meant for anyone under 18.
Changes
When this policy changes in a way that matters, we update the version and date above and, for waitlist members and account holders, tell you by email.
Contact
Questions about how we use your personal data: Debayan, debayansen.ds.ds@gmail.com.