Privacy Policy

We process your personal data for the following purposes:

• Service Delivery: Operating the Platform, managing your account, facilitating Commitments, processing payments, and delivering notifications
• Identity Verification: Verifying your identity to maintain trust, prevent fraud, and comply with applicable regulations
• Anti-Fraud and Gaming Detection: Analyzing usage patterns to detect self-dealing, sham commitments, related-party manipulation, and other forms of platform abuse
• Dispute Resolution: Reviewing evidence submitted by parties to adjudicate disputes
• Reputation System: Calculating and displaying reputation scores, completion rates, and related public metrics
• Communications: Sending transactional emails, in-app notifications, WhatsApp messages (if opted in), and urgent alerts related to your Commitments
• Platform Improvement: Analyzing aggregate usage data to improve features, fix bugs, and enhance user experience
• Legal Compliance: Meeting legal obligations, responding to lawful requests from authorities, and enforcing our Terms of Service
• Safety and Security: Protecting the Platform and its Users from security threats, unauthorized access, and malicious activity

Under the DPDP Act 2023 and applicable law, we process your data based on:

• Consent: You provide explicit consent when creating your account and using our Services
• Contractual Necessity: Processing necessary to fulfill our obligations under the Terms of Service
• Legitimate Interest: Fraud prevention, platform security, and service improvement
• Legal Obligation: Compliance with applicable laws and regulations, including KYC requirements

We do not sell your personal data. We share your information only in the following circumstances:

• With Other Users:Your name, profile picture, reputation score, and commitment-related information are visible to the other party in a Commitment. Your email may be shared with the other party as necessary for the Commitment.
• Service Providers:We share data with trusted third-party service providers who assist in operating our Platform, including:

• Legal Requirements:When required by law, court order, or governmental authority, or to protect our rights, property, or safety, or that of our Users
• Business Transfers:In connection with a merger, acquisition, reorganization, or sale of assets, your data may be transferred as part of the transaction
• Developer API:If you use a third-party application integrated via our Developer API, that application's developer may receive data about your Commitments as authorized by you

We implement industry-standard security measures to protect your personal data:

• Encryption: All data transmitted between your browser and our servers is encrypted using TLS/SSL. Passwords are hashed using bcrypt and never stored in plaintext.
• Secure Storage: Verification documents and uploaded files are stored in encrypted AWS S3 buckets with restricted access policies.
• Access Controls: Access to personal data is restricted to authorized personnel on a need-to-know basis. Employee/admin access is role-based and audited.
• Payment Security: Card and payment data is handled exclusively by Razorpay, a PCI-DSS Level 1 compliant processor. We never receive, process, or store your card details.
• Authentication: JWT-based authentication with automatic token refresh and session management.
• Monitoring: Automated systems monitor for suspicious activity, unauthorized access attempts, and potential security breaches.

While we strive to protect your data, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security but commit to promptly notifying affected Users in the event of a data breach as required by law.

We retain your personal data for as long as necessary to provide the Services and fulfill the purposes described in this policy:

• Account Data: Retained for the duration of your active account and for up to 3 years after account deletion to comply with legal and regulatory requirements.
• Commitment Data: Retained for 5 years after Commitment completion/resolution for record-keeping, audit, and dispute reference purposes.
• KYC Documents: Retained for the duration of your active account and for 5 years after account closure as required by applicable anti-money laundering and KYC regulations.
• Payment Records: Retained for 7 years as required by Indian tax and financial regulations.
• Usage Logs: Retained for up to 12 months for security analysis and then anonymized or deleted.

After the applicable retention period, data is securely deleted or irreversibly anonymized.

Under the DPDP Act 2023 and applicable data protection laws, you have the following rights:

• Right to Access: Request access to the personal data we hold about you
• Right to Correction: Request correction of inaccurate or incomplete personal data through your account settings or by contacting us
• Right to Erasure: Request deletion of your personal data, subject to legal retention obligations and resolution of active Commitments
• Right to Withdraw Consent: Withdraw your consent for data processing at any time. Note that withdrawing consent may limit your ability to use certain Services
• Right to Grievance Redressal: Lodge a complaint with us or with the Data Protection Board of India if you believe your data rights have been violated
• Right to Nominate: Nominate another individual to exercise your data rights in the event of your death or incapacity, as provided under the DPDP Act

To exercise any of these rights, contact us at support@commitsure.com. We will respond within 30 days of receiving your request.

We use the following types of cookies and similar technologies:

• Essential Cookies: Required for authentication (JWT tokens), security, and basic Platform functionality. These cannot be disabled.
• Preference Cookies: Store your settings such as theme preference (dark/light mode) and language.
• Analytics: We may use anonymized analytics to understand usage patterns and improve the Platform. We do not use third-party advertising trackers.

You can manage cookie preferences through your browser settings. Disabling essential cookies may prevent you from using the Platform.

Transactional Communications: Emails and notifications related to your Commitments, payments, account security, and dispute activity are essential service communications and are sent regardless of marketing preferences.

WhatsApp Notifications: Optional. You may link your WhatsApp number and opt in to receive Commitment-related notifications via WhatsApp. You can unlink your number and opt out at any time through your account settings.

Marketing: If we send promotional communications, they will include an unsubscribe option. We currently do not send marketing emails.

You may request deletion of your account and associated personal data by contacting us or through your account settings. Please note:

• Active Commitments must be resolved before account deletion
• Certain data may be retained as required by law (tax records, KYC documents)
• Anonymized data that cannot be traced back to you may be retained for analytics
• Data already shared with other Users (e.g., Commitment details, reputation scores) may persist in their view
• Wallet Credits are forfeited upon account deletion and are non-refundable