DPDP Act Notice
Version 2026-11-03-draft. Data Principal rights and the grievance process under the Digital Personal Data Protection Act, 2023. Draft dated 03/11/2026.
1. Data Fiduciary
| Item | Detail |
|---|---|
| Data Fiduciary | [[OWNER TO SUPPLY: legal entity name]] |
| Registered office | [[OWNER TO SUPPLY: registered office address]] |
| Service | AIVE One (www.aive.one and app.aive.one), in beta |
| Contact for questions about this notice and for the exercise of your rights | [[OWNER TO SUPPLY: grievance officer name]], [[OWNER TO SUPPLY: grievance officer email]] |
| Significant Data Fiduciary | Not notified as one under section 10 of the DPDP Act at the date of this draft. If that changes we will appoint a Data Protection Officer, based in India, and publish their details here. |
2. The Act and the Rules
2.1 This is the notice required by section 5 of the Digital Personal Data Protection Act, 2023, read with the Rules made under it. It is meant to be read on its own, in plain language, and it is available in English. A Hindi version is [[OWNER TO DECIDE: whether to publish a Hindi version; the Rules ask for access to the languages in the Eighth Schedule]].
3. Personal data and purposes
3.1 The personal data we process, and the specific purpose of each item, are listed in clause 2 of the privacy notice. In short: account details, a consent record, a beta record, your uploads and what is made from them, sign-in history, server logs, audit entries, and the feedback you send. The purposes are to run your account, to provide the editing service, to apply the beta limits, to keep the service secure, and to tell you about your access.
4. Consent
4.1 We ask for consent at sign-up by a box you must tick yourself. The consent is free, specific, informed, unconditional and unambiguous, and is given by clear affirmative action (section 6(1)). We record the time and the version accepted.
4.2 You can withdraw consent as easily as you gave it: “Delete my account and data” in the editor. You can also write to the contact in clause 1. After withdrawal we stop processing and erase the data, except where a law requires us to keep it.
4.3 Consent managers: the Act allows you to give, manage and withdraw consent through a registered consent manager. We do not yet integrate with one. [[OWNER TO DECIDE: whether to integrate a registered consent manager once the Board registers them]]
5. Your rights as a Data Principal
| Right | Provision | How to use it | Our time limit |
|---|---|---|---|
| Information about your data and who has received it | Section 11 | Write to the contact in clause 1 from your registered email | 30 days |
| Correction, completion, updating | Section 12 | Write to the contact in clause 1 | 30 days |
| Erasure | Section 12 | Use “Delete my account and data” in the editor, which acts at once; or write to us | Immediately for self-service; 30 days otherwise |
| Grievance redressal | Section 13 | Clause 7 below | Acknowledged in 48 hours, resolved in 30 days |
| Nominate another person | Section 14 | Write to us naming the person; we record it against your account | 30 days |
| Withdraw consent | Section 6(4) | Clause 4.2 above | Immediately |
5.1 We may need to confirm that a request comes from you before we act. We will use your registered email for that and will not ask for identity documents.
5.2 Under section 15 you must provide authentic information, must not impersonate another person, must not suppress material information and must not make a false or frivolous grievance.
6. Children
6.1 AIVE One is not offered to anyone below 18. We do not process the personal data of a child, track or monitor a child’s behaviour, or direct advertising to a child (section 9). If we find an account held by a child, we will delete it.
7. Grievance redressal and the Data Protection Board
7.1 Grievance Officer: [[OWNER TO SUPPLY: grievance officer name]], [[OWNER TO SUPPLY: legal entity name]], [[OWNER TO SUPPLY: registered office address]], [[OWNER TO SUPPLY: grievance officer email]].
7.2 We acknowledge within 48 hours and resolve within 30 days of receiving the grievance. We will tell you the outcome and the reasons by email.
7.3 If your grievance is not resolved, or you receive no response in that time, you may make a complaint to the Data Protection Board of India (section 27 of the DPDP Act and the Rules). Please use our process first.
8. Retention and erasure
8.1 Uploads and everything made from them are deleted 7 days after creation. Other data is kept only while the purpose is served, as the table in clause 4 of the privacy notice says, and is then erased (section 8(7)). Where we must keep a record by law we keep it only for as long as the law requires.
9. Security and breach
9.1 The safeguards we apply are in clause 8 of the privacy notice. In the event of a personal data breach we will inform the Board and each affected Data Principal as section 8(6) and the Rules require.
10. Transfers outside India
10.1 Section 16 of the DPDP Act permits transfer outside India except to a country or territory the Central Government restricts by notification. As at the date of this draft [[OWNER TO DECIDE: counsel to confirm that no restriction notification is in force]]. Our hosting is in the AWS Mumbai region and your uploads stay there. The transfers that can happen are: your email address to Amazon SES for service emails ([[OWNER TO DECIDE: SES region]]); your IP address to Cloudflare if the sign-up check is switched on; and your IP address and browser details to the jsDelivr network when the editor loads its typefaces. When payments open, Razorpay processes payments in India.
10.2 Laws that impose a higher protection for data (for example the sectoral requirements in section 16(2)) continue to apply.
11. Processors
11.1 We engage processors only under a contract that binds them to process on our instructions (section 8(2)). They are listed in the data processing statement.
12. Other laws
12.1 The Information Technology Act, 2000 continues to apply, including sections 43A (while in force), 72A and 79, and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021. See the terms for how content reports are handled.
13. Changes
13.1 We will update this notice when the Rules, our processing or our processors change, and will show the new version number above.