Privacy Policy
This is a draft, published for review. It is not yet in force.
Draft, for review by a lawyer. Flags for the reviewer are in square brackets. Written to comply with both India's Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025 ("DPDP"; most duties apply from May 2027; check the e-Gazette for an earlier date) and the EU General Data Protection Regulation ("GDPR"), with the IT Act, 2000 and SPDI Rules, 2011 that apply in India until DPDP does. Where the two differ, this policy follows the stricter rule, and says which law it comes from.
Effective: [date of publication] · Version: 1
This policy explains how Thothica Private Limited ("Thothica", "we", "us") handles personal data in unrigid, our website hosting and content management service at unrigid.ai, app.unrigid.ai and mcp.unrigid.ai. The detail behind it (every kind of data, where it is kept and for how long) is on How unrigid handles data.
1. Who we are
Thothica Private Limited, C-29 F/F, Mayur Vihar Phase-1, Acharya Niketan, Opposite Pocket-1, East Delhi, Delhi 110091, India. GSTIN 07AAKCT4418L1ZY. Email hello@thothica.com, phone +91 83184 39450.
Thothica is the Data Fiduciary (DPDP) and controller (GDPR) for the data described in section 3. [EU representative under GDPR Art. 27: to decide with the lawyer, see section 14.]
2. Two roles
- For customers (anyone with an unrigid account) we decide why and how your data is used: we are the Data Fiduciary / controller.
- For visitors to our customers' websites, including people who fill in their forms, the website's owner decides. We process that data only on the owner's instructions, under our Data Processing Addendum. We are the owner's Data Processor (DPDP) / processor (GDPR). If you visited or wrote to a website hosted on unrigid, its own privacy notice applies, and requests about your data should go to its owner. If you cannot reach the owner, write to us and we will pass your request on.
3. What we collect, why, and on what legal basis
DPDP lets us process personal data either with your consent or for certain legitimate uses; GDPR needs one of six lawful bases. For each purpose:
| Data | Purpose | GDPR basis | DPDP basis |
|---|---|---|---|
| Email address and name | creating your account, signing you in, service emails | contract (Art. 6(1)(b)) | consent, given at sign-up |
| Your sites, roles and the changes you make | running the CMS, history and undo, sharing | contract | consent |
| Your sites' content, code, media and settings | hosting and publishing your sites | contract | consent |
| Billing details (name, state; for businesses legal name, address, GSTIN) and payment records | taking payment, GST invoices, tax records | contract; legal obligation (Art. 6(1)(c)) for tax records | consent; legal obligation (s.7(c), (d)) |
| Support requests and attachments | helping you | contract | consent |
| Security records: hashed sign-in codes, sessions, devices, rate-limit keys; logs | keeping accounts and the service safe, stopping abuse | legitimate interests (Art. 6(1)(f)) in security; legal obligation for logs India requires | legitimate use for legal obligations (logs, DPDP Rules); consent |
| Information disclosed to authorities | complying with court and government orders | legal obligation | legitimate use (s.7(c), (d)) |
| Emails about changes to our terms, prices or policies | telling you what changes | contract; legal obligation | consent |
We collect this from you, from people who invite you to a site or offer you one, and from Razorpay (confirmation of your payments). We do not send marketing email without separate consent, which you can withdraw at any time.
Withdrawing consent (DPDP). You may withdraw consent at any time, as easily as you gave it, by closing your account in the app or writing to us. Withdrawal does not affect what we did before, and we will then stop providing the service and delete your data as section 8 describes.
Objecting (GDPR). Where we rely on legitimate interests you may object; we will stop unless we have compelling grounds, such as protecting the service from attack.
No automated decisions. We make no decisions about you based solely on automated processing that have legal or similarly significant effects (GDPR Art. 22).
4. What we do not do
We do not sell personal data. We do not show advertising. We do not use your content, or your visitors' data, to train AI models or to profile anyone.
6. International transfers
Thothica is in India and our providers process data in India and abroad (Cloudflare stores our databases in its Asia-Pacific region and serves websites worldwide; Resend and Google process data in the United States).
- DPDP: transfers outside India are allowed except to countries the Government restricts; we will follow any restriction.
- GDPR: when we receive personal data from the European Economic Area, the UK or Switzerland, or send it onward, we protect it with the European Commission's Standard Contractual Clauses (and the UK Addendum), or rely on an adequacy decision such as the EU-US Data Privacy Framework where a provider is certified under it. [Reviewer: confirm each provider's mechanism; see the data-practices table.] You may ask us for a copy of the safeguards.
8. How long we keep it
Until the purpose is served, and then we delete it (DPDP s.8(7); GDPR storage limitation), except what the law makes us keep: invoices and payment records for 8 years (GST), account activity records for 7 years, records of activity and faults for at least 1 year (DPDP Rules; raw operational log lines are kept for only a few days), and records of removed content and closed accounts for at least 180 days (IT Rules). The full schedule is on How unrigid handles data. Copies in backups expire within 90 days.
9. Security
Data is encrypted in transit; sign-in codes, sessions, devices and tokens are stored only as keyed hashes; staff access is limited by role, time-limited and recorded. No system is perfectly secure.
If a breach affects your personal data we will tell you without undue delay, saying what happened, what it may mean for you and what we are doing about it (DPDP requires every breach to be told to affected people; GDPR requires it where the risk is high: we follow DPDP and tell you in every case). We report it to the Data Protection Board of India (within 72 hours with the full report), to the relevant EU supervisory authority within 72 hours where GDPR requires, and to CERT-In within 6 hours.
10. Your rights
Under DPDP and GDPR you may ask us to:
| Right | DPDP | GDPR |
|---|---|---|
| Access: a copy of your data, how we use it, who we shared it with | yes (s.11) | yes (Art. 15) |
| Correction: correct, complete or update it | yes (s.12) | yes (Art. 16) |
| Erasure: delete it, except what law makes us keep | yes (s.12) | yes (Art. 17) |
| Restriction: keep it but stop using it while a question is settled | yes (Art. 18) | |
| Portability: your data in a machine-readable form (JSON and CSV), to take elsewhere | yes (Art. 20). You can do it yourself: Settings → Export your data | |
| Objection: to processing based on legitimate interests | yes (Art. 21) | |
| Withdraw consent | yes (s.6(4)) | yes (Art. 7(3)) |
| Nominate someone to act for you if you die or cannot act | yes (s.14) | |
| Complain to us, then to the regulator | Data Protection Board of India | your EU or UK supervisory authority |
We give these rights to everyone, wherever you live.
How to ask: write to our Grievance Officer at siraj@thothica.com from your account's email address (or tell us the account's email), or use the app's Help page. We may ask you to confirm your identity. We acknowledge within 24 hours and answer within 7 days, and never later than one month (GDPR's limit; extendable by two months for complex requests, with notice to you; DPDP allows up to 90 days, so the GDPR limit is the stricter and applies). Requests are free unless they are clearly unfounded or excessive.
11. Children
unrigid is for people aged 18 and over (DPDP treats under-18s as children; GDPR's age of digital consent is 13 to 16, so DPDP is the stricter). We do not knowingly create accounts for children. Customers whose websites are meant for children are responsible for the consents the law requires for their visitors.
12. Changes to this policy
You are asked to read and agree to this policy when you first sign in, and again, the next time you sign in, after any new version takes effect. We publish any new version here with its date. Before a change takes effect we email every account holder with a summary written for their situation: at least 30 days before for changes that reduce your rights. Earlier versions stay available on request. Until you agree to a new version you can still export your data and close your account.
13. Language
This policy is written in English. Ask us for a translation into Hindi or any language in the Eighth Schedule to the Constitution of India and we will provide one (DPDP s.5(3)).
14. EU representative
[Decide with the lawyer. GDPR Art. 27 requires a company outside the EU that offers services to people in the EU to name a representative in the EU, unless its processing is occasional and low-risk. If unrigid is marketed to EU customers, name one here (name, address, email). If unrigid is offered only to India and the GCC, say so and take steps that show it, such as INR pricing and no EU marketing.]
15. Grievance Officer and contact
Siraj Ahmad Abbasi, Grievance Officer (DPDP; IT Rules) and privacy contact (GDPR) Thothica Private Limited, C-29 F/F, Mayur Vihar Phase-1, Acharya Niketan, Opposite Pocket-1, East Delhi, Delhi 110091, India siraj@thothica.com · +91 83184 39450