1. Who we are
RapidScript Pro ("we", "us", "our") is the Data Fiduciary under the Digital Personal Data Protection Act, 2023 ("DPDP Act") for the personal data of users of the RapidScript Pro platform. Our registered address and Grievance Officer contact details are listed in Section 12.
2. Personal data we collect
- Account data: name, email address, organisation, role.
- Usage data: stories viewed, scripts generated, presets used, login timestamps, IP address, browser/device info.
- Content data: scripts, comments, and other content you create within the platform.
We do not knowingly collect Sensitive Personal Data or Information ("SPDI") as defined under the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules").
3. Purposes & lawful basis
We process your personal data for the following purposes, under the lawful bases of (i) consent obtained at the time of account creation and (ii) "certain legitimate uses" under Section 7 of the DPDP Act:
- To provide and operate the platform.
- To authenticate users and prevent fraud.
- To improve features and troubleshoot issues.
- To comply with legal obligations.
4. Retention
We retain your personal data only as long as necessary for the purposes above, or as required by applicable law. Account data is deleted within 90 days of account closure unless required for legal record-keeping.
5. Sharing & processors
We share personal data with vetted processors (cloud hosting, email delivery, analytics) bound by contractual confidentiality and security obligations. We do not sell your personal data.
6. Cross-border transfers
Personal data may be processed in jurisdictions outside India. Transfers occur only to countries not restricted by the Central Government under Section 16 of the DPDP Act, and remain subject to equivalent protection.
7. Rights of Data Principals
Under the DPDP Act you have the right to:
- Access a summary of the personal data we process.
- Correct, complete, update, or erase your personal data.
- Nominate another individual to exercise your rights in case of death or incapacity.
- Withdraw consent at any time (subject to existing lawful processing).
- Raise grievances with our Grievance Officer (Section 12) and, if unresolved, with the Data Protection Board of India.
8. Cookies
We use strictly-necessary cookies for authentication and session management. We do not use third-party advertising cookies.
9. Children's data
The platform is not intended for individuals under 18 years of age. We do not knowingly process the personal data of children without verifiable parental consent as required by Section 9 of the DPDP Act.
10. Security
We implement reasonable security practices in line with Rule 8 of the SPDI Rules and ISO/IEC 27001-aligned controls, including encryption in transit (TLS 1.2+), role-based access control, and row-level security on tenant data.
11. Breach notification
In the event of a personal data breach, we will notify the Data Protection Board of India and affected Data Principals as required under the DPDP Act.
12. Grievance Officer
Name: [To be filled]
Email: grievance@rapidscriptpro.com
Address: [Registered address, India]
Response within 30 days as required under the DPDP Act and Rule 5(9) of the SPDI Rules.
13. Changes
We may update this policy. Material changes will be notified by email and through the platform.