Privacy Policy

Review notice: This policy has been drafted to follow the structure required under India's DPDP Act, 2023, and general international privacy practice. It is not a substitute for review by qualified Indian legal counsel. Diviniel Technologies Private Limited should have this reviewed and formally adopted before relying on it as a binding commitment to users, particularly the Grievance Officer designation in Section 13, which has a specific statutory requirement.

1. Introduction and scope

This Privacy Policy (“Policy”) describes how Diviniel Technologies Private Limited (“Diviniel,” “the Company,” “we,” “us,” or “our”) collects, uses, discloses, and protects personal data in connection with our website (diviniel.com and its subdomains) and the products we make available (collectively, the “Services”). This Policy applies to visitors, account holders, and anyone who otherwise interacts with the Services (collectively, “you” or “User”).

This Policy does not apply to third-party websites, products, or services that may be linked from our Services, even if co-branded or accessed through our Services. We encourage you to review the privacy policies of any third party before providing personal data to them.

2. Definitions

• “Personal Data” means any data about an individual who is identifiable by or in relation to such data, as defined under the Digital Personal Data Protection Act, 2023 (“DPDP Act”).
• “Data Fiduciary” means the entity that determines the purpose and means of processing Personal Data — Diviniel, in relation to the data described in this Policy.
• “Data Principal” means the individual to whom the Personal Data relates — generally, you.
• “Processing” means any operation performed on Personal Data, including collection, storage, use, disclosure, or erasure.
• “Document Content” means the substantive content of any file, document, or record a User processes using the Services (e.g., the text, images, or data within a PDF being signed, converted, redacted, or verified). Document Content is expressly distinguished from Personal Data throughout this Policy because of how it is processed — see Section 4.2.

3. Who we are

Diviniel Technologies Private Limited is a company incorporated in India, with its registered office in Maharashtra, India (CIN: U62011MR2026PTC478880; Udyam Registration Number: UDYAM-MH-27-0277472). Under the DPDP Act, Diviniel acts as a Data Fiduciary in respect of the Personal Data described in this Policy.

4. What we collect

4.1 Categories of Personal Data

4.2 What we deliberately do not collect: Document Content

Diviniel does not receive, store, or process the content of any document you use our tools on. All document processing (compression, conversion, redaction, watermarking, signing, OCR, verification) occurs entirely client-side, within your browser, using local computation. Document Content is never transmitted to, or received by, Diviniel's servers. This is an architectural fact, independently verifiable by any User with basic technical means (see our Proof section), not merely a policy commitment we ask you to trust.

Because Document Content is never received by Diviniel, it falls outside the scope of “Personal Data processed by Diviniel” for the purposes of this Policy, even where a document a User processes happens to contain personal data belonging to the User or a third party. Diviniel has no visibility into, and exercises no control over, Document Content.

5. Sources of Personal Data

We collect Personal Data: (a) directly from you, when you create an account, fill out a form, or email us; (b) automatically, through cookies and similar technologies, subject to your consent as described in Section 7; and (c) from third parties, specifically authentication providers (Google, Microsoft) when you choose to sign in through them, and our payment processor (Razorpay) in connection with a transaction.

6. Purposes of processing

Consistent with the DPDP Act's purpose-limitation principle, we process Personal Data only for the specific purpose for which it was collected and for which you have given consent, or where processing is otherwise permitted under the DPDP Act (for example, to comply with a legal obligation). We process Personal Data to:

• Create and administer your account and authenticate your access to the Services;
• Process payments and maintain billing records;
• Respond to inquiries submitted through our contact form or via email;
• Understand aggregate usage of our website, where you have consented to analytics cookies;
• Detect, prevent, and respond to fraud, abuse, or security incidents;
• Comply with applicable law, regulation, legal process, or governmental request.

We do not use Personal Data for any purpose incompatible with the purpose for which it was collected, and we do not sell Personal Data to third parties.

7. Cookies and tracking technologies

We use three categories of cookies, matching the choices presented in the cookie banner on every page of our website:

You may change your cookie preferences at any time via the “Cookie settings” link in the footer of any page. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

8. Disclosure of Personal Data to third parties

We disclose Personal Data only to the following categories of recipients, each acting either as an independent Data Fiduciary for their own purposes or as our processor under contractual obligations of confidentiality and security:

We may also disclose Personal Data where required by law, in response to a valid legal process, or to protect the rights, property, or safety of Diviniel, our Users, or the public.

9. Cross-border data transfers

Some of the third parties listed in Section 8 may process data outside India. Under Section 16 of the DPDP Act, cross-border transfer of Personal Data is permitted except to countries restricted by the Central Government by notification. [To confirm with counsel: current jurisdictional footprint of each named processor, and whether any additional contractual safeguards should be documented here.]

10. Data retention

11. Data security

We apply administrative, technical, and organizational measures designed to protect Personal Data against unauthorized access, alteration, disclosure, or destruction, including access controls limiting Personal Data access to personnel who need it, encryption of data in transit, and the architectural minimization described throughout this Policy — because Document Content is never received, the single largest category of sensitive data a document platform would otherwise need to secure simply does not exist on our servers. No system is completely secure, and we cannot guarantee absolute security of information transmitted to us.

12. Children's data

Our Services are not directed to, and are not intended for use by, individuals under the age of 18. We do not knowingly collect Personal Data from children. If we become aware that we have inadvertently collected Personal Data from a child without the consent required under Section 9 of the DPDP Act, we will take steps to delete that data promptly.

13. Your rights as a Data Principal

Under the DPDP Act, you have the right to:

• Access a summary of the Personal Data we hold about you and the processing activities undertaken;
• Correction and erasure of your Personal Data, and the right to have us inform any third party to whom we have disclosed that data of the correction or erasure, where feasible;
• Withdraw consent at any time, as easily as it was given, without affecting the lawfulness of processing before withdrawal;
• Nominate another individual to exercise these rights on your behalf in the event of your death or incapacity;
• Grievance redressal — the right to have any complaint about our processing of your Personal Data addressed by our Grievance Officer (see below) before escalating to the Data Protection Board of India.

To exercise any of these rights, contact us at privacy@diviniel.com. We aim to acknowledge requests within 5 business days and to substantively resolve them within 30 days, though complex requests may take longer, in which case we will inform you of the expected timeline.

Grievance Officer

In accordance with the DPDP Act, our designated Grievance Officer is:

Name: Suhasini Oliveira
Email: privacy@diviniel.com
Registered address: [registered office address — to be inserted]

If you are not satisfied with our response, you may file a complaint with the Data Protection Board of India.

14. HIPAA-ready architecture

Diviniel's products are architected to support HIPAA-aligned workflows for organizations handling protected health information, because Document Content is never transmitted to or stored on our servers. This is a statement about architecture, not a claim of HIPAA certification. Diviniel is not currently a signed Business Associate under HIPAA. Organizations with HIPAA obligations should conduct their own independent compliance assessment, including execution of a Business Associate Agreement where legally required, before relying on any Diviniel product for protected health information workflows.

15. International Users

If you access our Services from outside India, please note your Personal Data will be processed in accordance with this Policy and Indian law. Where applicable data protection law in your jurisdiction (such as the EU General Data Protection Regulation) grants you additional rights, we intend to honor the substance of those rights on request, though we do not currently represent formal GDPR compliance certification.

16. Automated decision-making

We do not currently use Personal Data for any automated decision-making process that produces legal or similarly significant effects concerning you.

17. Data breach notification

In the event of a Personal Data breach, we will notify the Data Protection Board of India and affected Data Principals as required under the DPDP Act, without undue delay.

18. Changes to this Policy

We will update the “last updated” date above whenever this Policy changes. For material changes affecting how we process your Personal Data, we will notify account holders directly (e.g., by email) in addition to updating this page, rather than relying on a silent update.

19. Governing law

This Policy is governed by the laws of India. Any dispute arising from this Policy is subject to the exclusive jurisdiction of the courts of Maharashtra, without prejudice to your statutory rights to approach the Data Protection Board of India.

20. Contact us