DPDP Act Notice

1. Data Fiduciary

For the purposes of the Digital Personal Data Protection Act, 2023 (“DPDP Act”), Docusift is built and operated by Ekarche Private Limited (CIN U58200UW2026PTC253262, GSTIN 09AAJCE7033P1Z1), Mathura, Uttar Pradesh 281502, India. Ekarche Private Limited is the data fiduciary in respect of personal data processed through the docusift.co website and the Docusift document processing platform.

2. Purposes of Processing

We process personal data to provide and operate the Docusift service, including:

• Creating and managing your account
• Processing documents you upload to extract structured data and deliver the result to you
• Sending transactional communications (sign-in, alerts, billing receipts)
• Billing and payment processing for paid plans
• Responding to support requests and inquiries
• Monitoring service performance, security, and abuse
• Complying with applicable legal and regulatory obligations

3. Categories of Personal Data

• Account data — name, email address, organization name, role
• Document content you submit — the documents you upload for processing and the structured data extracted from them
• Billing data — collected directly by our payment processor; we do not store card numbers
• Usage and log data — IP address, browser type, pages visited, timestamps

4. Disclosure to Recipients

Personal data is disclosed only to categories of recipients necessary to provide the Service: cloud infrastructure providers, AI inference providers, email-delivery providers, and payment processors. The current named subprocessor register is available on request at hello@docusift.co.

Where you connect a QuickBooks (Intuit Inc.) or Xero (Xero Limited) workspace from your Docusift account, the structured data extracted from your documents is transmitted to that provider on your instruction, under the terms you accepted with them. You can disconnect the integration at any time from your Docusift settings.

5. Legal Basis

We process personal data on the basis of your consent (given when you create an account and accept the Privacy Policy) and where necessary to perform the service contract with you. Where processing is required to comply with law, we rely on that legal obligation as the basis.

6. Retention

Account data is retained while your account is active. Uploaded documents are retained for the period configured by your organization's admin in tenant settings; once that retention period expires, documents are permanently deleted. When you delete your account, all associated personal data is permanently removed within 30 days, except where retention is required by law.

7. Data Principal Rights

Under the DPDP Act you, as a data principal, have the following rights with respect to your personal data:

• Right to access a summary of your personal data and the processing activities carried out on it
• Right to correction and erasure of inaccurate, incomplete, or no-longer-required personal data
• Right to nominate another individual to exercise your rights in the event of death or incapacity
• Right of grievance redressal — see contact below
• Right to withdraw consent at any time, on terms no more onerous than the terms on which consent was given

To exercise any of these rights, contact us at hello@docusift.co. We will respond within the timelines required by law.

8. Cross-Border Transfers

Docusift is operated from India. All customer data is currently hosted in the United States (AWS, us-east-1). Personal data may be transferred to and processed in the United States and India to deliver the Service, subject to the safeguards required by the DPDP Act and notifications issued by the Central Government under Section 16 of the Act. Standard Contractual Clauses apply where required.

9. Children

Docusift is not intended for individuals under the age of 18. We do not knowingly process personal data of children. Where we become aware that we have, we will delete it.

10. Security

We implement reasonable security safeguards in accordance with the DPDP Act, including encryption in transit and at rest, application-layer encryption for sensitive secrets, workspace isolation, and strict access controls. See our security page for the fuller description.

11. Grievance Officer

Ekarche Private Limited has designated a Grievance Officer for all matters relating to personal data processing through Docusift:

• Name: Kanha Upadhyay (Director, Ekarche Private Limited), serving as Grievance Officer
• Email: grievance@docusift.co (mirrored to hello@docusift.co)
• Address: Ekarche Private Limited, Mathura, Uttar Pradesh 281502, India

Grievances will be acknowledged within seven (7) working days and resolved within the timelines required by the DPDP Act and the rules framed under it. If you remain unsatisfied with the resolution, you may approach the Data Protection Board of India.

12. Changes to This Notice

We may update this notice from time to time to reflect changes in our processing, in the law, or in our organization. Material changes will be notified by email or by a notice on our website. The “last updated” date is shown at the top of the page.

13. Contact

For any questions about this notice or about how Docusift processes personal data, contact us at hello@docusift.co.