Commitment to privacy & confidentiality
datasecurely acts as a Data Fiduciary under the Digital Personal Data Protection Act, 2023. We collect and process only the minimal security telemetry required to conduct non-destructive scans, verify domain ownership, and generate confidential remediation reports.
We do not sell, rent, monetize, or disclose your scan telemetry or vulnerability records to third-party advertising brokers or unauthorized entities. Your security findings remain strictly segregated under your tenant account.
Categories of data collected
To provide vulnerability monitoring and automated security audits, we collect the following three specific classes of data:
Email address, system-generated UUID token, and Razorpay billing transaction identifiers.
Target hostnames, DNS verification TXT tokens, well-known file tokens, and ownership state.
Observed HTTP response headers, TLS handshake details, cookie security flags, and vulnerability fingerprints.
Purpose of data processing
Data is processed solely for purpose-bound, legitimate security operational uses:
Data retention & automated erasure
In strict compliance with the DPDP Act 2023 data minimization mandates, we enforce strict retention windows and automated deletion lifecycles:
Historical scan findings and PDF reports are preserved for 90 days to enable regression diffing.
When you delete a domain or account, all associated scans, findings, and PDFs are permanently purged within 48 hours.
Grievance officer & statutory contact
Pursuant to Rule 5(9) of the Information Technology (Reasonable Security Practices) Rules, 2011 and Section 8 of the DPDP Act 2023, you may address privacy concerns, data erasure requests, or grievances to: