DPDP Compliance

1. Our commitment

Yours Honestly asks people some of the most personal questions they will ever answer. We think that only works if the way we handle those answers is as honest as the answers themselves.

India’s Digital Personal Data Protection Act, 2023 (the “DPDP Act”) and the Digital Personal Data Protection Rules, 2025 (the “DPDP Rules”) set out how personal data must be handled in India. Under them, [Legal entity name], which runs Yours Honestly, is the data fiduciary: we decide why and how your data is used, and we are responsible for it. You are the data principal: the data is about you, and the rights are yours.

This page explains, in plain language, how we meet each duty the law places on us. It sits alongside our Privacy Policy, which lists exactly what we collect and why.

The DPDP Rules come into force in phases. The Data Protection Board provisions applied from 13 November 2025, consent manager registration from 13 November 2026, and most duties on data fiduciaries, including notice, security, breach reporting, erasure and rights, apply from 13 May 2027. We have designed Yours Honestly to meet them from launch.

2. At a glance

3. Notice and consent

Before you share anything, we show you a notice that stands on its own, separate from our terms. It lists, item by item, the personal data we will collect, what each item is used for, and what you get in return. It also tells you how to withdraw consent, how to use your rights and how to complain to the Data Protection Board.

• Clear action: you agree by actively ticking a box and continuing. Nothing is pre-ticked, and silence is never taken as consent.
• Separate choices: consent for the service and consent for optional extras, such as WhatsApp updates, are asked for separately. Saying no to an extra never stops you using the service.
• Your sharing is your choice: nobody can see your profile or run a report with you unless you give them your YH code.
• Consent records: we keep a record of what you agreed to, which version of the notice you saw and when, so we can show it if asked.
• Withdrawing consent: you can withdraw at any time, in your dashboard or by writing to our Grievance Officer. It is as easy as giving consent. Once you withdraw, we stop processing and erase your data as described below, unless a law requires us to keep part of it.
• Consent managers: once consent managers registered with the Data Protection Board are operating, you will be able to give, review and withdraw consent through one of them too. [Confirm when supported.]

4. Only what we need

We collect only what is needed to build an honest profile and give you an honest report, and we use it only for that.

• We don’t sell personal data, share it for advertising or build advertising profiles.
• We don’t ask for documents, ID numbers or anything we don’t use.
• Your answers are not used to train any AI model. [Confirm this with your AI provider’s terms.]
• If we ever want to use data for a new purpose, we will ask for your consent first.

5. The Compatibility Engine

Your answers are read only by the Compatibility Engine, our automated system. No person at Yours Honestly reads your answers, your profile or your chats, and our team’s tools are built so that they can’t. [Confirm admin tools have no access to answers.]

• The Compatibility Engine uses your answers to write your portrait, verify your profile and produce the reports and chat answers you ask for.
• It never reveals or quotes a private answer to anyone else.
• Its assessment is an automated reading of your own answers. It is not a background check, a criminal-record check or a medical or psychological diagnosis.
• If you think something in your verified profile is wrong, write to us and we will look into it.

6. Our technology and where your data lives

These are the services that run Yours Honestly, what each one handles, and where. Every provider that processes personal data for us does so under a contract that limits it to our instructions and requires security safeguards at least as strong as ours.

[Check every row against the live setup, including regions, before publishing.]

7. Security safeguards

The DPDP Rules list the minimum safeguards a data fiduciary must take. Here is how we meet each one.

• Encryption: all data travels over encrypted connections (HTTPS/TLS) and is encrypted at rest in our database and backups. Chats are encrypted on your device.
• Access control: each member’s data can be read only by that member’s account and the Compatibility Engine. Service credentials are held by as few people as possible, with multi-factor sign-in. [Confirm MFA on Supabase, Google Cloud, Netlify, Razorpay and Resend.]
• Visibility: access to personal data is logged and monitored so unusual access can be detected and investigated. Logs are kept for at least one year.
• Continuity: regular backups let us restore data if something fails, so your profile isn’t lost.
• Processors: our contracts require every provider to protect data to this standard, to tell us about breaches and to erase data when we ask.
• Payments: card and UPI details are handled by Razorpay. We never see or store your full card number.

8. If something goes wrong

If a personal data breach ever affects you, even if it affects only one person:

• We tell you without delay, by email (and WhatsApp if you have opted in), explaining what happened, when, what it may mean for you, what we are doing about it, what you can do to protect yourself, and who to contact.
• We tell the Data Protection Board of India without delay, and send a detailed report within 72 hours covering what happened, why, what we have done and how we informed the people affected.
• We investigate the cause, fix it, and record what we changed so it doesn’t happen again.

9. Keeping and erasing data

• While your account is open, we keep your profile so it stays verified and shareable.
• When you delete your profile or withdraw consent, we erase your answers, profile and reports within [X] days, and ask our providers to do the same, including from backups as they cycle out.
• If your account is inactive for [period], we erase it. We tell you at least 48 hours before, so you can sign in to keep it.
• What we must keep: payment and tax records for as long as Indian law requires [confirm period], and access logs for at least one year, as the DPDP Rules require. Nothing else.

10. Your rights, and how to use them

To protect you, we confirm a request comes from you by checking the email address or mobile number on your account. We reply within [X] days, and never later than 90 days.

11. Adults only

Yours Honestly is only for adults aged 18 and over, and every member confirms their age when they join. Because the service is not for children, we don’t process children’s data. If we learn that someone under 18 has joined, we delete the account and its data.

12. Data outside India

Some of our providers may process data outside India. The DPDP Act allows this unless the Government of India restricts a country or type of data. We transfer data only as the Act and the DPDP Rules allow, only to providers bound by contract to protect it, and we will stop if a restriction applies. [List any provider that processes data outside India, and where.]

13. Grievance Officer

Our Grievance Officer answers questions about your data and handles complaints.

• Name: [name]
• Email: [privacy@yourshonestly.com]
• Address: [registered address]

If you’re not satisfied with our answer, you can complain to the Data Protection Board of India. See also Contact and grievances.

14. How we keep this up to date

We review how we handle personal data at least once a year, and whenever we add a provider or change how the service works. When something changes in a way that matters, we update this page and tell members by email before it takes effect.