Privacy Notice
This Privacy Notice describes how Shipcheck ("Data Fiduciary") collects, processes, stores, and protects personal data of users ("Data Principals") in accordance with India's Digital Personal Data Protection (DPDP) Act, 2023 and associated rules.
[LEGAL REVIEW REQUIRED] Note for Legal Counsel
This notice has been prepared to align with Sections 5, 6, 8, 11, 12, 13, and 14 of the DPDP Act 2023. Specific clauses designated with [LEGAL REVIEW REQUIRED] must be verified by qualified Indian legal counsel prior to final regulatory submission or enforcement.
1. Identity of the Data Fiduciary
Shipcheck (a product of ZSR, based in India) acts as the Data Fiduciary responsible for determining the purpose and means of processing your personal data.
Data Fiduciary: Shipcheck / ZSR
Jurisdiction: Republic of India
Official Contact Email: support@shipcheck.pro
Grievance Redressal Officer Email: privacy@shipcheck.pro
2. Personal Data Collected & Specified Purposes of Processing
In accordance with Section 5 of the DPDP Act, personal data is processed solely for specified, lawful purposes to which you have granted explicit consent, or for legitimate uses defined by law.
| Data Category | Specific Data Elements | Specified Processing Purpose | Legal Basis |
|---|---|---|---|
| Account Identity Data | Full Name, Email Address, Account Creation Timestamp | Authentication, magic link sign-in, account management, and critical security notifications. | Explicit Consent (Sec. 6) |
| Project & Audit Data | Target Website URLs, API endpoints, Staging URLs, Slack/Discord Webhook URLs, Audit History Metrics | Executing pre-launch automated audits (SEO, Security, Performance, Links, DNS) and delivering audit notification alerts. | Contractual Performance / Consent |
| Payment & Transaction Metadata | Customer ID, Subscription Plan status, Transaction ID, Payment Amount, Renewal Dates (No raw card data stored) | Subscription management, invoicing, fee collection, and statutory tax compliance via merchant of record. | Legal Obligation & Consent |
| Technical Telemetry & Usage | IP Address, User-Agent, Browser type, Page View Telemetry (Gated by banner) | SSRF protection, rate limiting, platform security monitoring, and opt-in UX optimization. | Opt-in Consent / Legitimate Use |
| Communications & Support | Support message content, Feedback submissions, Grievance details | Resolving customer service inquiries, bug fixes, and DPDP grievance redressal. | Consent & Statutory Mandate |
3. Notice & Granular Consent (DPDP Act Sec. 5 & 6)
Under Section 6 of the DPDP Act 2023, consent must be free, specific, informed, unconditional, and unambiguous with clear affirmative action:
- Unticked Opt-in Checkboxes: Consent checkboxes at data collection points (signup form, contact section) are unticked by default.
- Per-Purpose Consent: Service terms consent and optional marketing communication consent are requested separately and granularly.
- Unconditional Service Provision: Access to core auditing services is not conditional on consenting to non-essential marketing processing.
- Consent Audit Trail: Every consent decision (granted or withdrawn) is logged with a timestamp, IP address, user-agent, and policy version in our
ConsentRecorddatabase.
4. Data Retention & Erasure Schedule (DPDP Act Sec. 8(7))
Personal data is retained only for as long as necessary to fulfill the specified processing purpose or to satisfy statutory legal requirements.
5. Third-Party Data Processors & Cross-Border Transfers (Sec. 8(6) & 16)
We engage vetted third-party Data Processors under strict data processing agreements to operate our infrastructure. Cross-border transfers comply with Section 16 of the DPDP Act 2023 and applicable Central Government notifications.
Dodo Payments
Merchant of Record & Payment Gateway
Processes payments, billing identity, and subscription metadata. Operates as an independent Data Fiduciary / Processor.
Resend Inc.
Transactional Email Delivery
Processes recipient email addresses to transmit magic links, security alerts, and system notices.
PostHog Inc.
Product Analytics & Telemetry (Gated)
Processes opt-in page interaction metrics. Gated behind explicit cookie consent banner.
Upstash Inc.
Managed Redis & QStash Scheduler
Processes IP rate-limiting keys and scheduled audit job triggers.
6. Rights of Data Principals under DPDP Act, 2023 (Sec. 11–14)
As a Data Principal in India, you hold enforceable statutory rights regarding your personal data:
A. Right to Access Information (Sec. 11)
You have the right to request a summary of personal data being processed by Shipcheck, the identities of all Data Processors sharing your data, and any related processing details.
B. Right to Correction, Completion & Erasure (Sec. 12)
You have the right to correct inaccurate or misleading personal data, complete incomplete personal data, and request complete erasure of your data when processing is no longer necessary.
C. Right to Withdraw Consent (Sec. 6(4))
You may withdraw your consent for personal data processing at any time. Ease of withdrawal matches ease of granting consent. Processing conducted prior to withdrawal remains lawful.
D. Right to Grievance Redressal (Sec. 13)
You have the right to an accessible grievance redressal mechanism provided by Shipcheck. You may also escalate unresolved grievances to the Data Protection Board of India (DPBI).
E. Right to Nominate (Sec. 14)
You have the right to nominate any individual who shall, in the event of your death or incapacity, exercise your data rights on your behalf.
7. Grievance Officer & Statutory Contact Details (DPDP Act Sec. 8(10))
For any privacy concerns, complaints, data rights requests, or statutory grievances under the DPDP Act 2023, please contact our designated Grievance Redressal Officer:
Grievance Redressal Officer
Designation: Data Protection & Grievance Officer
Entity: Shipcheck / ZSR
Grievance Email: privacy@shipcheck.pro
Postal Address: ZSR Compliance Division, India
Response SLA: Mandatory acknowledgement within 48 hours; final resolution within 30 calendar days as required by DPDP Rules.
[LEGAL REVIEW REQUIRED] Attorney Validation Checklist
The following clauses in this Privacy Notice require formal review by qualified Advocates / Legal Practitioners in India:
- Section 4: Data Retention Schedule compliance with Central Government rules under DPDP Sec. 8(7).
- Section 5: Cross-Border Data Transfer compliance under DPDP Sec. 16 notifications.
- Section 6: Nomination procedure validity under DPDP Sec. 14 rules.
- Section 7: Grievance Officer SLA timelines and Data Protection Board escalation language.
Last Updated: March 2026 | DPDP Act (India) Compliance Release v1.0