Legal

Privacy Policy

Version 2.1  ·  Effective from: 23 September 2026  ·  Last reviewed: 6 October 2026  ·  Previous version (effective March 2026, amended 21 September 2026)

This policy states what personal data CivicLayer Technologies collects from visitors to consentos.in and users of the ConsentOS platform, why we collect it, how long we keep it, and what rights you hold over it under the law in force today and under the Digital Personal Data Protection Act, 2023 as its sections come into force.

1. Who This Policy Applies To

This policy applies to:

• Visitors to consentos.in
• Businesses and individuals who register for or use a ConsentOS account
• Contacts who submit inquiries through our website or by email

Children. This website and the ConsentOS platform are offered to businesses and their authorised representatives. We do not knowingly collect personal data from anyone under 18 and we do not open accounts for them. Section 9 of the DPDP Act 2023 requires verifiable parental consent before a child's personal data is processed. Our services are not designed for that processing. If you believe a person under 18 has supplied personal data to us, write to the Grievance Officer. We delete it.

2. Data We Collect

Website visitors

When you visit consentos.in, we collect log data including your IP address, browser type, pages visited, and timestamps. This data is used to monitor site performance. It is not used to build individual profiles or for advertising purposes.

This website sets no cookies of its own. The ConsentOS platform sets a session cookie once you sign in. Section 8 states the full position.

Account registration

When you create a ConsentOS account, we collect your name, business email address, company name, and job role. This information is necessary to create and maintain your account.

Platform usage

While you use the ConsentOS platform, we collect usage data including feature access logs, API call records, and error reports. This data is used to maintain platform reliability and diagnose technical issues.

Inquiries and communications

If you contact us by email or through a website form, we retain the content of that communication along with your contact details, for as long as the inquiry remains open and for 12 months after it is resolved.

3. How We Use Your Data

We use the data described above for the following purposes:

• Creating and maintaining your ConsentOS account
• Delivering the platform and its features
• Sending transactional communications, including account confirmations, product updates, and billing notifications
• Complying with our obligations under the DPDP Act 2023 and other applicable Indian law
• Diagnosing and resolving technical issues
• Improving platform reliability and performance

We do not sell personal data. We do not use personal data for advertising targeting on third-party platforms.

4. Third-Party Processors (Sub-processors)

To operate ConsentOS, we share certain personal data with the following third-party processors. Each processor is engaged under contractual terms that require it to handle your data in accordance with applicable law. Infrastructure providers in India hold platform data at rest; the United States providers receive only the categories listed against them.

Data transfers to processors outside India are made under appropriate contractual safeguards in accordance with the DPDP Act 2023.

5. Your Rights

Today, the Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules, 2011 give you the right to review the information you gave us, to have it corrected if it is wrong or incomplete, and to withdraw consent you gave earlier. Sections 11 to 14 of the Digital Personal Data Protection Act, 2023 create a wider set of rights: access, correction and erasure, grievance redressal, and nomination. Those sections take effect on 13 May 2027. We operate them before that date, as our own commitment to you rather than because the law currently requires it, on the terms set out below:

To exercise any of these rights, contact our Grievance Officer using the details in Section 9. We will acknowledge within 2 working days and respond within 30 days. We may ask you to verify that the request comes from you.

Two limits apply, and they are the same limits the Act itself will apply from 13 May 2027. First, we may decline a request where we are required to retain the data by law or by a retention obligation we owe a customer under contract, and where we decline we will tell you which it is. Second, where we hold personal data as a Data Processor on behalf of a customer, we will pass your request to that customer, who decides the outcome, and we will tell you we have done so.

6. Data Retention

We keep personal data for as long as your account remains active.

When you close your account:

• Account data is deleted within 90 days
• Billing records are retained for 7 years for tax compliance
• Log and usage data is retained for 12 months, then deleted

If you contact us without creating an account, we retain your inquiry data for 12 months from the date of last contact.

7. Data Security

ConsentOS platform data is encrypted in transit using TLS 1.2 or higher. Data at rest is encrypted using AES-256. Access to personal data is restricted to personnel who require it for operational purposes, and all access is logged and reviewed.

We maintain incident response procedures for security events. On any personal data breach affecting your personal data, we intimate affected individuals without delay, and we intimate the Data Protection Board of India in the manner and within the timelines the DPDP Rules 2025 prescribe under Rule 7, including the detailed report due within 72 hours of becoming aware of the breach. No risk threshold applies: Rule 7 attaches to every personal data breach, not only to those we judge severe. Rule 7 becomes enforceable on 13 May 2027, and we operate to it now. Where an incident is also a reportable cyber security incident, we report to CERT-In within the six-hour window already in force under the CERT-In Directions 2022.

No transmission over the internet is entirely secure. We maintain these controls to reduce risk to a responsible minimum, and we will continue to review and improve them as the platform grows.

8. Cookies

consentos.in sets no cookies of its own. The marketing pages are prerendered. Our edge provider, Cloudflare, may set a short-lived security cookie only if it serves a bot challenge to your browser. The site runs no analytics script, no tag manager, and no advertising or cross-site tracking tag, so there is nothing to opt out of and no cookie preferences panel is presented. Two interactive tools keep your own entries in your browser's own storage so your progress survives a reload: the compliance checklist uses local storage, and the gap assessment uses session storage, which your browser discards when you close the tab. Neither is a cookie. That data stays on your device until you submit the assessment form.

Essential cookies on the platform. The ConsentOS platform at app.consentos.in sets session cookies once you sign in. They carry your authentication session and nothing else. They are required for the platform to function and cannot be disabled while you are signed in. Signing out ends the session.

Traffic measurement without cookies. We understand site traffic from the aggregated request logs our hosting provider generates at the edge (Section 4). That measurement sets no cookie, runs no script in your browser, and is not used to build individual profiles.

9. Grievance Officer

We publish this contact under rule 5(9) of the Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules, 2011. That rule requires a body corporate to designate a Grievance Officer, publish the name and contact details on its website, and redress grievances within one month of receipt. From 13 May 2027, Section 8(9) of the Digital Personal Data Protection Act, 2023 will require us to publish the business contact information of a person who can answer your questions about the processing of your personal data, and Section 8(10) will require us to run an effective grievance redressal mechanism. The same office performs both functions. If the 2011 Rules cease to apply before then, this contact and this one-month commitment continue to apply as our own undertaking to you.

This page covers personal data we hold as a Data Fiduciary: visitors to consentos.in, people who request the Gap Assessment, subscribers, and our customers' account administrators. Where we hold personal data as a Data Processor on behalf of a customer, that customer is the Data Fiduciary. Send requests about that data to the customer. If you send it to us, we will pass it on and tell you we have done so.

We will acknowledge your inquiry within 2 working days. We will provide a substantive response within 30 days of receiving your complaint, and in any event within the one month set by rule 5(9) of the 2011 Rules.

From 13 May 2027, if you have given us the opportunity to resolve your grievance and we have not resolved it, you may take the matter to the Data Protection Board of India. Until then, nothing on this page limits any remedy available to you under any other law.

10. Changes to This Policy

We may update this policy when our data practices change or when required by law. If we make material changes, we will notify active account holders by email at least 14 days before the changes take effect.

The current version of this policy is always available at consentos.in/privacy. The effective date at the top of this page reflects when the current version came into force. Superseded versions stay available at their own addresses so that the text in force on any date can be checked.

What changed in version 2.0 (23 September 2026). We corrected the legal basis for our Grievance Officer, set out which sections of the Digital Personal Data Protection Act, 2023 take effect on 13 May 2027 and which rights apply today under the 2011 Rules, stated the two limits on rights requests, corrected the description of the nomination right to Section 14(1), clarified how to complain and when the Data Protection Board route opens, and separated the data we hold as a Data Fiduciary from the data we process for customers. We did not change what data we collect, why we collect it, who we share it with, or how long we keep it.

11. Contact

For questions about this policy that are not a rights request:

Email: hello@consentos.in

For rights requests and complaints, contact the Grievance Officer at privacy@consentos.in.