DPDP Act Compliance Notice

1. Who we are and our role

Cinute InfoMedia, a sole proprietorship of Sandeep Maske, is the Data Fiduciary for personal data processed through Massthread. We determine the purpose and means of that processing.

Where a customer uploads or imports a newsletter subscriber list, that customer is the Data Fiduciary for those subscribers and we act as a Data Processor on their instructions. We will still help any subscriber who contacts us directly.

We are not, at present, notified by the Central Government as a Significant Data Fiduciary under Section 10, so the additional obligations that attach to that category — including the mandatory appointment of a Data Protection Officer based in India — do not currently apply to us. We have nevertheless published a Grievance Officer at section 8 below.

2. Notice under Section 5

Section 5 requires us to tell you, in clear and plain language, what personal data we process, for what purpose, how you may exercise your rights, and how you may complain. This is that notice.

2.1 The personal data we process, and why

2.2 How to exercise your rights and complain

You may exercise every right in section 6 by writing to tech@massthread.com. You may complain to our Grievance Officer (section 8), and you may complain to the Data Protection Board of India (section 9). You do not have to complain to us first, although we would prefer the chance to put things right.

3. Our lawful basis

We process your personal data on the basis of your consent under Section 6, given for the specified purposes in section 2.1 above.

A limited amount of processing rests on the legitimate uses in Section 7 — in particular where you voluntarily provide data for a purpose that is obvious from the act itself, such as writing to us through the contact form, and where processing is necessary to comply with a legal obligation, such as retaining invoices.

4. How consent is taken, and what we record

Consent under the DPDP Act must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the data necessary for the stated purpose. Section 8(1) places the burden on us to demonstrate that we obtained it.

5. Withdrawing consent

You may withdraw your consent at any time, and it must be as easy to withdraw as it was to give. In practice:

• For a platform: press Disconnect in Massthread, or revoke access at the platform itself.
• For newsletters: use the unsubscribe link in any e-mail.
• For browser notifications: turn them off in Massthread or in your browser.
• For everything: write to tech@massthread.com and ask us to close your account.

Withdrawal does not affect the lawfulness of processing carried out before it. After you withdraw, we stop processing for that purpose and erase the data within a reasonable period, unless retention is required by law.

6. Your rights as a Data Principal

6.1 Right to access information — Section 11

You may ask us for a summary of the personal data we process about you, the processing activities involved, and the identities of the other Data Fiduciaries and Processors with whom we have shared it, together with a description of what was shared. Our processor list is published in section 7 of the Privacy Policy. Workspace owners can also export a complete machine-readable copy of their data from inside the product at any time.

6.2 Right to correction and erasure — Section 12

You may ask us to correct inaccurate or misleading data, complete incomplete data, update data, and erase data we no longer need for the purpose it was collected for. Most profile and brand data can be corrected directly in the product.

6.3 Right of grievance redressal — Section 13

You have the right to a readily available means of grievance redressal in respect of any act or omission of ours regarding your rights or our obligations. Our Grievance Officer is named in section 8. We acknowledge grievances within 72 hours and respond substantively within 30 days. You must have exhausted this route before approaching the Data Protection Board on the same matter.

6.4 Right to nominate — Section 14

You may nominate another individual to exercise your rights under the Act on your behalf in the event of your death or incapacity. Send the nominee's name and contact details, signed by you, to tech@massthread.com. We record nominations manually against your account and confirm receipt in writing — the product does not yet have a field for this, so the record is held by us rather than shown in your account.

7. Your duties — Section 15

The Act places duties on Data Principals too. You must:

• comply with applicable law when exercising your rights;
• not impersonate another person when providing personal data;
• not suppress material information when providing personal data or an official identifier;
• not register a false or frivolous grievance or complaint; and
• provide only verifiably authentic information when seeking correction or erasure.

Breach of these duties may attract a penalty under the Act.

8. Grievance Officer

9. Escalating to the Data Protection Board of India

If we do not respond within the period above, or you are not satisfied with our response, you may complain to the Data Protection Board of India, the adjudicating body established under Chapter V of the Act. The Board accepts complaints through the means it publishes from time to time; details are available through the Ministry of Electronics and Information Technology. Complaining to the Board does not cost you anything and does not require you to go through us first, although Section 13 expects you to have tried.

10. Children's data — Section 9

Massthread is a business tool intended for adults. We do not knowingly process the personal data of anyone under 18. We do not undertake tracking or behavioural monitoring of children, and we do not direct advertising at children — we run no advertising at all.

If we learn that a child's personal data has reached us without verifiable consent from a parent or lawful guardian, we will erase it. Tell us at tech@massthread.com.

11. Security safeguards — Section 8(5)

We are required to take reasonable security safeguards to prevent a personal data breach. The measures actually implemented are listed in section 9 of the Privacy Policy and include bcrypt password hashing, AES-256-GCM encryption of platform tokens at rest, optional two-factor authentication, hashed one-time tokens, same-origin request checks, signed OAuth state, upload type verification and membership checks on every workspace request.

Two limitations are disclosed there and repeated here: rate-limit counters are held in application memory rather than a shared store on our current deployment, and media files are served from public URLs that anyone holding the link can open.

12. Personal data breach — Section 8(6)

In the event of a personal data breach we will notify the Data Protection Board of India and each affected Data Principal, in the form and within the timelines prescribed under the Act and its Rules. Our notice to you will describe, in plain language, the nature and extent of the breach, when it occurred, the likely consequences, the measures we have taken, and what you can do to protect yourself.

13. Retention and erasure — Section 8(7)

We must erase personal data once you withdraw consent or the purpose is no longer being served, unless retention is required by law. Our retention periods are in section 10 of the Privacy Policy.

Where the Rules require erasure after a period of user inactivity, we will give at least 48 hours' advance notice to your registered e-mail address before erasing. We state plainly that this is not yet automated: no job currently measures inactivity or issues that notice, and we will not claim otherwise. Building it is on our roadmap.

14. Processing outside India — Section 16

Massthread relies on service providers located outside India, so your personal data is transferred out of India in the ordinary course of running the service. Section 16 permits such transfer to any country other than one the Central Government has restricted by notification. As of the effective date of this notice we transfer to:

We rely on each provider's contractual data-protection terms. If the Central Government restricts a country in which one of these providers operates, we will move that processing and update this notice.

15. Changes to this notice

We will update the version and effective date above whenever this notice changes, and we will e-mail account holders before any change that materially affects their rights takes effect.

16. A note on how this notice is written

Several paragraphs above say plainly that something is manual, or not yet automated. That is deliberate. Section 8(1) makes us accountable for demonstrating compliance, and a notice describing controls we have not built would be worth less than one that tells you exactly where we stand. Each of those gaps is on our roadmap, and this notice will be updated as each one closes.