DPDP Act 2023 Compliance
MSMEMate handles the personal data of India’s entrepreneurs under the Digital Personal Data Protection Act, 2023 — not as a checkbox, but as the way the platform is built. आपका डेटा, आपका अधिकार — भारत में ही सुरक्षित।
Data residency: India, always
Every piece of personal data at rest lives in our primary datastore in Mumbai (ap-south-1). AI processing runs on Indian, sovereign providers. Our cache layer holds no personal data at all — only rate-limit state.
Consent before anything
Registration requires explicit, informed consent shown in English and Hindi. Our servers reject any registration without it, and the consent plus its timestamp is recorded on the profile and in the audit trail.
Purpose limitation
Your data is processed only to register your enterprise, classify it into ONDC categories, and recommend seller platforms — nothing else. No marketing use. No resale. Ever.
Right to erasure, honoured fully
An erasure request removes your profile and every derived AI artifact — classification results and match results included. The erasure itself is logged in the audit trail without keeping the erased data.
Voice & documents never stored
Audio you speak and certificates you upload are processed in memory to extract fields, then discarded. Only the confirmed profile fields are saved — never the raw recording or file.
Locked-down access
Signed JWT authentication with role-based access on every private endpoint; bulk personal-data access is administrator-only; database tables enforce deny-all row-level security; passwords exist only as bcrypt hashes; failed logins lock out.
What we keep, and for how long
| Data | Retention |
|---|---|
| Voice recordings & uploaded documents | Not persisted — processed in memory, then discarded |
| MSE profile (incl. mobile number) | Until erasure request or account closure |
| Derived AI results | Same lifecycle as the profile; deleted on erasure |
| Audit logs | 180 days; no raw personal payloads |
| Authentication data | bcrypt password hashes only — never plain text |
The full detail — your rights, grievance officer, and how to exercise erasure — lives in our Privacy Policy.
Read the Privacy Policy