Privacy policy
Last updated [effective date]
This is a draft pending legal review. It was written to describe how Chumbaq works today and has not yet been checked by a lawyer.
This policy explains what personal data Chumbaq collects about you, why, how long we keep it, and how you can use your rights under India's Digital Personal Data Protection Act, 2023 (the DPDP Act) and the DPDP Rules, 2025.
For the data in this policy, Chumbaq is the Data Fiduciary: we decide why and how it is processed. The Chumbaq entity responsible is [contracting entity: Qleverlabs Technologies Pvt Ltd or Qleverlabs Technologies Inc, and for which users].
You can ask us for this notice in English or in any language listed in the Eighth Schedule to the Constitution of India.
1. Who this policy covers
This policy covers:
- people who visit this website, and
- people who have a Chumbaq dashboard account, including team members an account owner adds.
It does not cover the users of our customers' apps and websites. When a customer sends us data about its own users, the customer is the Data Fiduciary and Chumbaq is its Data Processor. That data is covered by the customer's own privacy notice and by our data processing agreement. See section 4.
2. What we collect and why
We collect only what we need to run your account and keep it secure.
| Data | Why we use it |
|---|---|
| Your name and email address | To create your account, sign you in, and send you account email. |
| Your password | To sign you in. We store only a one-way hash of it (bcrypt), never the password itself. |
| Two-step sign-in details, if you set them up: passkeys, an authenticator app secret and recovery codes | To protect your account. For passkeys we store only the public key. The authenticator secret is encrypted. Recovery codes are stored as keyed hashes. |
| Sign-in and security records: the time, the type of event (for example a sign-in, a failed sign-in or a password change), your IP address and your browser's user agent | To keep accounts secure, spot misuse, show you your own recent sign-in activity, and keep the records Indian cybersecurity rules require. |
| Signed-in devices (sessions), with the IP address and user agent each one started from | So you can see where you are signed in and sign out other devices. |
| Team details: who is on a team, added by the account owner | To give team members access. |
| What you write to us when you email support | To answer you. |
| Billing details [what billing data is collected, once billing is live] | To charge you and keep the tax records the law requires. |
The sign-up form on this website does not store anything on this website. It passes the email address and app name you type to the sign-up page of the Chumbaq dashboard, where you create your account. If you ask to join a waitlist, we use your email address only to tell you when that feature is ready.
We process this data with your consent, or where the DPDP Act allows it without consent, for a legitimate use under section 7, such as data you gave us yourself to open an account, or to meet a legal duty. [lawyer to confirm the basis for each purpose above]
3. Cookies and storage in your browser
We do not use advertising cookies or analytics cookies, on this website or in the dashboard.
This website
This website sets no cookies. If you switch between light and dark mode, your choice is saved in your browser's local storage under the name theme. It never leaves your device. The fonts are served from this website, not from a third party.
The Chumbaq dashboard
| Name | Type | What it does | How long |
|---|---|---|---|
chumbaq_refresh | Cookie, strictly necessary | Keeps you signed in. It is HttpOnly, so scripts on the page cannot read it, and it is sent only to our sign-in endpoints. | Until you sign out or your session ends. A session lasts at most 30 days by default. |
sidebar_state | Cookie, preference | Remembers whether the sidebar is open. | 7 days |
chumbaq_signed_in, chumbaq_session_limit | Local storage | Remember that you are signed in and when your session will end, so the dashboard can explain why it asks you to sign in again. | Until you sign out or clear your browser |
chumbaq_theme, chumbaq_accent | Local storage | Remember your colour choices. | Until you clear your browser |
| A few short-lived notes | Session storage | Remember, for one browser tab, that you dismissed a banner or that a support view is open. | Until you close the tab |
The map on the dashboard's analytics page loads map images from Stadia Maps. When it does, your browser sends your IP address to Stadia Maps, as with any website you load. No other data is sent.
Our customers' websites
Our JavaScript SDK sets a cookie named chumbaq_did on the websites of customers who install it. That cookie is part of the customer's processing, not ours. The customer's own privacy notice explains it.
4. Data about your app's users
If you are a customer, the data you send us about your app's users (user IDs, traits, events, device and push tokens, email addresses, phone numbers, consent choices and similar) is yours. You are the Data Fiduciary for it and we are your Data Processor. We process it only on your instructions, as set out in the data processing agreement.
If you are one of our customers' app users and you want to use your rights, please contact that app directly. If you write to us instead, we will pass your request to the app and help it respond.
5. Who we share data with
We share personal data only with the service providers on our sub-processor list, who process it for us under contract, and when the law requires us to, for example in response to a valid order from a court or government authority.
We never sell personal data, and we never use it for advertising.
A small number of Chumbaq staff can view an account to give support or investigate misuse. Every such view is recorded in an audit log that staff cannot edit, and a support view of an account is read-only and ends after 30 minutes.
6. Where your data is stored
Our cloud service is hosted by [hosting provider] in [hosting region]. Account email is sent through Brevo, whose location is shown on the sub-processor list.
Under section 16 of the DPDP Act, personal data may be transferred outside India, except to countries the Government of India restricts by notification. We will not transfer personal data to a restricted country.
7. How long we keep it
- Account details: while your account is open, and for [number of days] after it is closed, unless the law requires us to keep them longer.
- Sign-in and security records: 365 days by default, then deleted automatically. We never keep them for less than 180 days, because India's CERT-In directions of April 2022 require it, and the DPDP Rules ask for logs to be kept for at least one year. In the dashboard you can see your own activity from the last 90 days.
- Signed-in device records: deleted 30 days after the session is signed out or expires.
- One-time links (email verification and password reset): deleted 7 days after they are used or expire.
- Support email: [retention period for support email].
- Billing records: for as long as tax and accounting law requires [period].
8. Your rights
Under the DPDP Act you have the right to:
- get a summary of the personal data we hold about you and how we process it (section 11);
- have your data corrected, completed, updated or erased (section 12);
- withdraw consent you gave us, as easily as you gave it (section 6(4));
- have a grievance answered by us (section 13);
- nominate another person to use your rights if you die or become unable to (section 14).
In the dashboard you can change your password and sign-in methods, see your recent sign-in activity, and sign out any device yourself. For anything else, including correcting your name or email address, closing your account or erasing your data, email our Grievance Officer (section 11 below). We may need to confirm it is you before we act.
If you withdraw consent, we stop the processing that relied on it, and erase the data unless the law requires us to keep it. Processing done before you withdrew stays lawful. Without some data, such as your email address, we cannot run your account.
9. Security
We protect your account with hashed passwords, two-step sign-in with passkeys or an authenticator app where you turn it on, sessions you can review and end, and automatic notices when something important changes on your account. See the security page for more. If a personal data breach affects you, we will tell you and the Data Protection Board of India as the DPDP Rules require.
10. Children
Chumbaq is a service for businesses. Accounts are for adults acting for a business, and we do not knowingly collect personal data about anyone under 18 on this website or in the dashboard. If you believe a child has given us personal data, contact our Grievance Officer and we will delete it.
11. Grievance Officer and complaints
If you have a question or complaint about how we handle your personal data, or want to use any of your rights, contact:
- Grievance Officer: [name]
- Email: [grievance officer email]
- Data Protection Officer: [name and contact, if one is appointed]
We will acknowledge your message and respond within [90 days, the maximum the DPDP Rules allow; confirm the period].
If you are not satisfied with our answer, you can complain to the Data Protection Board of India. The DPDP Act asks you to come to us first.
12. Changes to this policy
If we change this policy, we will update the date at the top of this page. If a change affects how we use data you have already given us, we will email account owners before it takes effect.
Who we are
Chumbaq is built and operated by Qleverlabs Technologies Inc (USA) and Qleverlabs Technologies Pvt Ltd (India). Registered addresses: [registered address of Qleverlabs Technologies Pvt Ltd] and [registered address of Qleverlabs Technologies Inc].