Consent-first engagement for Indian apps
India's DPDP Act 2023 and the DPDP Rules 2025 make you answerable for what your engagement tools do with your users' data. Chumbaq works as your processor and helps you comply: it checks consent before it sends, and deletes or exports a person when they ask.
Chumbaq helps you comply. It is not a certification, and none exists under the Act.
Consent checked on every send
Your app tells Chumbaq what each person agreed to, and Chumbaq checks it when it picks who a message goes to. On every channel, that covers campaigns, journey steps and A/B tests alike, so none of them can reach someone who said no.
- Email, SMS and WhatsApp go only to people who opted in, unless you change that per channel
- One-click unsubscribe in every campaign email, and STOP replies honoured on SMS and WhatsApp
- Push skips devices with push turned off, on campaigns, journeys, A/B tests, recurring sends and test sends
- Do-not-track stops Chumbaq storing that device's behaviour, and stops using it to pick audiences
- Every consent change is recorded with its time and where it came from
| Channel | Chumbaq won't send after |
|---|---|
| No opt-in, an unsubscribe, a bounce or a complaint | |
| SMS | No opt-in, or a STOP reply |
| No opt-in, or a STOP reply | |
| Push | Push turned off for that device in your app |
Do-not-track set by your app covers that device. When the project owner records an objection for a signed-in user (through the dashboard API; there is no screen for it yet), it covers every device of theirs. Do-not-track doesn't block messages: each channel's own opt-in decides that.
Deletion and export, when a user asks
On a person's page, the project owner can Export data as a JSON file or Delete person. Deleting asks you to type their id and to have signed in within the last 15 minutes, and our staff can't do it while viewing your account.
Your backend can do the same with POST /api/privacy/erasures and POST /api/privacy/exports, naming the person by user id or device id. They need a key with the server-only privacy permission: it is refused on every SDK endpoint, it takes a recent sign-in to create, and we email the owner when one is made.
A deletion is one database transaction, so it never stops halfway. Repeat it and it reports that there is nothing left to delete. Each request goes into a log that keeps the person's ids only as keyed hashes.
curl -X POST "$CHUMBAQ_HOST/api/privacy/erasures" \
-H "x-api-key: $CHUMBAQ_PRIVACY_KEY" \
-H "Content-Type: application/json" \
-d '{"externalUserId": "user_8231"}'What a deletion doesn't remove
Every deletion response lists these, so nobody assumes otherwise:
- Other devices that are not signed in as this user, and events recorded under their ids or under ids never linked to this user (anonymous ids before sign-in, earlier ids)
- History recorded on a shared device before this user signed in: it goes with the device, not the user
- Opt-outs, kept as one-way hashes so the person is not messaged again if their address is added later
- Mixpanel cohort membership, which comes back at the next cohort sync unless you delete the person in Mixpanel too
- Campaign totals, as anonymous numbers
- A log entry recording this request, with their ids stored only as keyed hashes
- An opt-out or delivery failure for an address another record in this project also holds, kept as it is
- Database backups until they expire, and application logs
- Data already sent to your providers and tools (FCM, APNs, SES, Resend, Brevo, Twilio, Meta, Gupshup, Interakt, Mixpanel, webhooks)
What an export leaves out
The export holds the newest 5,000 rows of each kind, and says when there were more. It has no push token values and nothing from your settings or credentials. It leaves out:
- Rows recorded under an id that was never linked to this person (anonymous ids before sign-in, earlier ids)
- Email, SMS and WhatsApp delivery and opt-out history, because an address can pass between people; contact Chumbaq support if you need it
- Mixpanel cohort memberships that Mixpanel did not match to this user id
- The last-activity time on each device
Self-host, and your data stays on your servers
Chumbaq is open source. Run it on your own servers, including your own cloud account in India, and your users' data never reaches us. You keep the same SDKs, journeys and reports, and you send through your own email, SMS and WhatsApp provider accounts.
The self-hosting quickstart is published with the open-source release. Until then, see the self-hosting guide or open source.
What the DPDP Act asks of your engagement vendor
Each duty, and what Chumbaq gives you for it. Legal documents marked as drafts are pending legal review.
| What the Act asks | What Chumbaq gives you | Status |
|---|---|---|
| Use a processor only under a valid contractSection 8(2) | Our data processing agreement names you as the Data Fiduciary and us as your processor, acting only on your instructions. | Draft, pending legal review |
| Erase personal data when consent is withdrawn or the purpose is served, and have your processor erase itSection 8(7) | Delete a person from the dashboard or through the erasure API. See deletion and export for what is kept. | In the product |
| Stop processing once a person withdraws consentSection 6(6) | Email, SMS and WhatsApp sends skip people who opted out, unsubscribed or replied STOP. Push sends skip devices with push turned off, and do-not-track stops behavioural tracking. | In the product |
| Be able to show the consent you relied onSection 6(10) | Chumbaq records each consent change your app or your users make, with its time and source. There is no screen or export for this history yet. The notice and the consent request themselves are yours to keep. | Recorded; no screen yet |
| Take reasonable security safeguardsSection 8(5), Rule 6 | Our security page and section 6 of the DPA list the measures in place. Some hosting details are still being confirmed. | In place; hosting details pending |
| Report a personal data breach to the Board and to each affected personSection 8(6), Rule 7 | The DPA commits us to tell you within [number of hours] hours, with the details you need for the Board's 72-hour report. | Draft, pending legal review |
| No tracking, behavioural monitoring or targeted advertising directed at childrenSection 9(3) | Chumbaq doesn't know your users' ages. The DPA sets out that you must not use it to track or target users under 18 unless an exemption applies to you. | Your duty, set out in the DPA |
| Stay responsible for processing done on your behalfSection 8(1) | Our sub-processor list names the companies we use, and the providers you connect with your own accounts. | Draft, pending legal review |
DPDP, answered
Is Chumbaq DPDP certified?
Who is the Data Fiduciary?
When do the duties apply?
Do you transfer data outside India?
Does do-not-track stop messages?
What do you have for our procurement team?
Engagement your users agreed to
Free up to 2,500 monthly active users. No card, no sales call.