Draft: to be checked by Lingsaa's lawyer before the first client. Written in plain English by Lingsaa's product team so that a lawyer can check it against India's Digital Personal Data Protection Act, 2023 and its Rules. Every point marked [lawyer to confirm] is an assumption to check. Lingsaa's own details marked [to be filled by Lingsaa] are never guessed.
1. Who we are and how to reach us
1.1 Lingsaa ([legal name, registered address and CIN to be filled by Lingsaa]) makes Lingsaa CCC and the Lingsaa apps.
1.2 Grievance officer and the person who answers questions about your data (the Act, s.8(9)): [name, email and phone to be filled by Lingsaa]. You can also write through the Help button in the CCC or to [privacy email to be filled by Lingsaa].
2. Two roles: whose data this policy covers
2.1 Lingsaa decides why and how (Data Fiduciary, the Act s.2(i)) for:
- the people who sign up for and run Lingsaa's customers' accounts: their main admins, billing contacts and anyone who writes to Lingsaa's support;
- people who visit Lingsaa's website, ask for a demo or call or write to Lingsaa's sales team;
- Lingsaa's own records of its customers (invoices, payments, the record of who accepted Lingsaa's terms).
This policy is about that data.
2.2 Lingsaa works for its customer (Data Processor, the Act s.2(k)) for the data of each customer's own people: their staff, visitors, residents, customers, suppliers and anyone else the customer records in the CCC and the apps. For that data the customer is the Data Fiduciary: its own privacy notice applies, and requests about it go to the customer, for example through its privacy page in the CCC (#/privacy?org=<the organization's code>) or its grievance officer. Lingsaa processes that data only as the customer instructs, under the Data Processing Terms. If you write to Lingsaa about such data, Lingsaa passes your request to the customer without answering it itself.
3. What we collect, and why
| What | From whom | Why (the purpose) | Basis |
|---|---|---|---|
| Name, work email, mobile number, organization's name, kind and address, GSTIN | The admin who signs up | To create and run the account, to sign the admin in, and to issue GST invoices | Consent at sign-up (the Act, s.6), and data given voluntarily for the account (s.7(a)); the invoices are kept as the CGST Act requires (s.31 and s.36; the Act, s.8(7)) [lawyer to confirm] |
| Password (kept only as a one-way hash), one-time codes, sign-in records with time, internet address and browser | Admins and Lingsaa's staff | To keep the account safe and to investigate misuse | Consent; the Rules, rule 6(1)(c) and (e) (logs) |
| Payments: the amount, the gateway's reference and the outcome | The payment gateway | To record payment and issue invoices. Lingsaa never sees or keeps your card or bank details: the gateway does | Consent; CGST Act and Companies Act records |
| Support requests: what you write, the page, the browser and, only if you tick it, a screenshot | The person asking for help | To answer the request | Given voluntarily for that purpose (the Act, s.7(a)) |
| Website "Talk to an expert" form: name, phone or email, organization, message | The person who fills it in | To answer and follow up the request | Consent (the form's tick) |
| Website visits: page counts only, with no cookie and nothing that identifies you, unless you allow counting | Website visitors | To know which pages are useful | Consent (the cookie choice) |
| The record of who accepted Lingsaa's terms: name, email, organization, the version, the time and the internet address | The admin who accepts | To show what was agreed (the contract record) | The contract; kept as a law may need it (the Act, s.8(7)) [lawyer to confirm] |
We collect only what these purposes need (the Act, s.6(1)).
4. How long we keep it
| What | How long | Why |
|---|---|---|
| The account and its admins' details | While the account is open, then deleted with the organization (30 days' read-only grace, then deletion by two Lingsaa people) | The purpose ends (the Act, s.8(7)) |
| Tax invoices and the buyer's details printed on them; the wallet's ledger | 8 years | CGST Act s.36 (72 months from the annual return's due date); Companies Act s.128(5) [lawyer to confirm] |
| Sign-in records and the audit trail | At least 1 year, and up to 10 years (Lingsaa's setting for the audit trail) | The Rules, rule 6(1)(e) and rule 8(3) (one year); CERT-In Directions (180 days within India) [lawyer to confirm] |
| The record of who accepted Lingsaa's terms (with the person's name, email and internet address as they were then) | 8 years from the day it was given, and longer for the version in force while the organization is a client (until 8 years after its agreement ends); then removed by the CCC by itself | The evidence of the contract: Indian Contract Act 1872 and IT Act 2000, s.10A (a contract made electronically); Limitation Act 1963, Schedule, Article 55 (3 years for a contract claim), and the invoices it stands behind [lawyer to confirm] |
| Support requests | 3 years after they close [lawyer to confirm] | To answer a later question about the same problem |
| Website enquiries | 2 years after the last contact, unless you become a customer [lawyer to confirm] | To follow up the enquiry |
| Backups | Backups age out within 12 months on their normal cycle | Recovery of the service as a whole |
Before personal data is erased at the end of its period, the Rules (rule 8(2)) ask for 48 hours' notice to the person where the Third Schedule's classes of Data Fiduciaries apply. [lawyer to confirm whether Lingsaa falls in those classes]
5. Who we share it with
5.1 Only with the providers that help run the service, each under a written contract that protects the data at least as well as this policy (the Act, s.8(2)):
| Provider | What for | Where |
|---|---|---|
| Hosting provider (Utho) | Servers, databases, files, backups | India [to be confirmed by Lingsaa operations] |
| Email delivery provider | Sign-in codes, invitations, invoices and notices | [to be confirmed by Lingsaa operations] |
| MSG91 | SMS (sign-in codes and notices) | [to be confirmed by Lingsaa operations] |
| Meta (WhatsApp Business) | WhatsApp messages, only where the person chose WhatsApp | Possibly outside India [to be confirmed by Lingsaa operations] |
| Payment gateways (Razorpay, Cashfree, CCAvenue) | Taking payments | [to be confirmed by Lingsaa operations] |
| AI providers | Only for AI features a customer's admin switches on | As each customer's switch says |
5.2 We do not sell personal data, and we do not use it for advertising.
5.3 We disclose data when a law, a court or a government authority lawfully requires it.
6. Data outside India
6.1 Lingsaa keeps customer data in India by default. Some providers (for example WhatsApp) may process limited data outside India. The Act (s.16) allows this except to countries the Central Government restricts by notification; Lingsaa follows any such restriction. [lawyer to confirm whether any notification under s.16(1) is in force]
7. How we protect it
7.1 The safeguards rule 6 of the Rules lists: encryption in transit and at rest (secrets sealed with Lingsaa's data key), access by role with two-step sign-in for admins, no standing access for Lingsaa's staff to customer records, a tamper-evident audit trail, daily encrypted backups that are restored and checked every day, and a written process for incidents. The Trust centre and the Data Processing Terms say more.
7.2 If a personal data breach affects your data, Lingsaa tells you and the Data Protection Board as rule 7 of the Rules requires (to the Board: at once, and in detail within 72 hours), and tells CERT-In within 6 hours of noticing a reportable cyber incident (CERT-In Directions).
8. Your rights
8.1 You may ask Lingsaa, for the data in section 2.1:
- for a summary of the personal data we hold about you and what we do with it (the Act, s.11);
- to correct, complete or update it, or to erase it when it is no longer needed for its purpose or a law no longer requires it (s.12);
- to withdraw your consent at any time, as easily as you gave it (s.6(4)); what was done before stays lawful (s.6(5));
- to nominate someone to use these rights if you die or cannot (s.14);
- to have a grievance answered (s.13): we answer within 90 days at most (the Rules, rule 14(3)), and aim to answer far sooner. If you are not satisfied, you may complain to the Data Protection Board of India after using our process (s.13(3)).
8.2 One thing an erasure keeps. If you accepted Lingsaa's terms for your organization, the record of that acceptance keeps your name, email and internet address as they were then, for the period in section 4, as the evidence of the contract: a law may need it (the Act, s.8(7)(a) and s.12(3): erasure unless retention is necessary for compliance with any law; the Indian Contract Act 1872; IT Act 2000, s.10A; Limitation Act 1963, Schedule, Article 55). It is used for nothing else, and it is removed at the end of that period. The answer to an erasure request says so. [lawyer to confirm]
8.3 Ask through the Help button, or write to the grievance officer (section 1.2). We check it is you before we answer, using a one-time code to your email or mobile number.
8.4 For data a Lingsaa customer holds about you (section 2.2), ask that customer: its CCC has its own privacy page and grievance officer.
9. Children
9.1 Lingsaa's own services are for organizations and are not meant for children. We do not knowingly collect a child's personal data for Lingsaa's own purposes. A customer that records children's data (a school, for example) obtains the verifiable consent of a parent as the Act requires (s.9 and rule 10 of the Rules). [lawyer to confirm]
10. Cookies and the website
10.1 Lingsaa's website stores nothing that identifies you unless you allow it. With your permission it keeps a small counter in your own browser to count visits by page. You can change your choice at any time on the Cookie notice page.
11. Changes to this policy
11.1 We publish each new version with its number and effective date. When a change matters to how we use your data, we tell our customers' admins in the CCC and by email before it applies.
12. Language
12.1 This policy is written in English. A translation is for help only; the English text applies.
Sources
| Short name | What | Official source |
|---|---|---|
| the Act | The Digital Personal Data Protection Act, 2023 (No. 22 of 2023) | India Code: https://www.indiacode.nic.in/handle/123456789/22037; Gazette: https://egazette.gov.in/WriteReadData/2023/248045.pdf |
| the Rules | The Digital Personal Data Protection Rules, 2025, G.S.R. 846(E) of 13 November 2025 | Gazette: https://egazette.gov.in/WriteReadData/2025/267650.pdf |
| Commencement | Notification G.S.R. 843(E) of 13 November 2025 under s.1(2) of the Act | Gazette: https://egazette.gov.in/WriteReadData/2025/267647.pdf |
| CERT-In Directions | Directions under s.70B(6) of the IT Act, 2000, No. 20(3)/2022-CERT-In, 28 April 2022 | https://www.cert-in.org.in/PDF/CERT-In_Directions_70B_28.04.2022.pdf |
| CGST Act | The Central Goods and Services Tax Act, 2017, s.36 (keeping records) | India Code: https://www.indiacode.nic.in/ (search "Central Goods and Services Tax Act, 2017") |
| Companies Act | The Companies Act, 2013, s.128(5) (books of account for 8 years) | India Code: https://www.indiacode.nic.in/ (search "Companies Act, 2013") |
When the law applies. Read from the Gazette: most duties of the Act (ss.3 to 5, s.6 except s.6(9), ss.7 to 17) and the Rules that go with them (rules 3 and 5 to 16) apply from 13 May 2027. Lingsaa follows this policy from its effective date, ahead of that day.