DPDP Compliance
Last updated: August 4, 2026
ReportAPI acts as a Data Fiduciary under India's Digital Personal Data Protection Act, 2023 (DPDP Act) for the personal data of our users. This page explains how we apply its principles today. We're a small team and this is an evolving area of law — this page is a good-faith summary, not a substitute for your own legal advice.
Consent and purpose limitation
We only collect personal data (your email, submitted report data, billing identifiers) for the specific purpose of running the service — see our Privacy Policy for the full list. Creating an account is how you provide consent for this processing.
Data storage location
Our primary database (Supabase) is hosted in the ap-south-1 region (Mumbai, India). Some processing — generating the report narrative (Groq), payments (Stripe), transactional email (Resend), and application hosting (Vercel) — happens on infrastructure outside India. We only send these providers the minimum data each needs to do its job.
Your rights as a Data Principal
Under the DPDP Act, you have the right to:
- Access a summary of the personal data we hold about you.
- Correct or update inaccurate personal data.
- Request erasure of your personal data, subject to legal retention requirements.
- Withdraw consent at any time by deleting your account.
- Register a grievance if you believe we've mishandled your data.
Grievance redressal
To exercise any of the rights above or raise a grievance, contact our grievance officer at utkarsh.mankad@gmail.com. We aim to acknowledge grievances within 7 days and resolve them within 30 days.
Current limitations
We don't yet run automated PII-detection on data submitted for report generation — if the data you submit contains personal information about third parties, that's processed the same way as any other input. Don't submit data you're not authorized to share. We're evaluating dedicated PII scanning as a future feature.