Privacy Policy

This policy explains how Truestock Private Limited, which operates TrueEngage, processes personal data. It is written to meet the Digital Personal Data Protection Act, 2023 and the rules made under it (together, the “DPDP Act”), and the Information Technology Act, 2000 with its rules on reasonable security practices.

We act in two roles:

• As a Data Fiduciary for personal data of website visitors, prospects, and the Authorised Users who sign in to the console. This policy covers that data.
• As a Data Processor for personal data of our customers’ End Users that customers send to the platform. Each customer decides why and how that data is processed and is responsible for its own privacy notice. If you are an End User of an app that uses TrueEngage, please contact that business directly; we will help it respond to you. Our commitments to customers are in the Data Processing Addendum.

We do not ask website visitors or Authorised Users for financial account numbers, health data, biometric data or other especially sensitive information, and we ask you not to send it to us.

• To provide the Services you or your organisation signed up for: creating accounts, signing you in, enforcing roles, and sending service emails such as invitations, password resets and security alerts. Basis: performance of the contract with your organisation, a legitimate use under the DPDP Act.
• To keep the Services secure: detecting abuse, investigating incidents, and keeping logs required by the directions of the Indian Computer Emergency Response Team (CERT-In). Basis: compliance with law.
• To bill and keep accounts: invoicing, collecting payment, and keeping records required under GST and income-tax law. Basis: compliance with law and contract.
• To answer enquiries and provide support. Basis: your request, which you can withdraw at any time.
• To send product updates and marketing about TrueEngage. Basis: your consent, which you can withdraw using the unsubscribe link in any email or by writing to us. Withdrawing consent does not affect processing that took place before.

We do not sell personal data and we do not use it to build advertising profiles.

We share personal data only with:

• service providers that host and run the platform for us, listed on our Sub-processors page, under contracts that bind them to process data only on our instructions;
• our payment partner and professional advisers such as auditors and lawyers, where needed;
• other Authorised Users in your organisation, who can see your name, email and role;
• law enforcement agencies, courts or regulators, when Indian law requires it. Where permitted, we will tell the affected organisation first;
• a buyer or successor in a merger or acquisition, who will be bound by this policy.

Console and customer data is hosted in India. Some of our service providers may access limited data from outside India to provide support, subject to contractual safeguards and to any restrictions the Government of India notifies under section 16 of the DPDP Act.

• Account and console data: for as long as your account is active, and deleted within 90 days after your organisation’s account is closed or you are removed from it, unless needed for an open dispute.
• Security and access logs: at least 180 days, as required by CERT-In directions, and then deleted on a rolling basis.
• Billing and tax records: 8 years from the end of the financial year, as required by Indian tax and company law.
• Sales and support correspondence: up to 3 years after our last interaction.

When personal data is no longer needed for its purpose and no law requires us to keep it, we erase it.

As a Data Principal under the DPDP Act you may:

• ask for a summary of the personal data we hold about you and how we process it, and the identity of those we have shared it with;
• ask us to correct, complete or update inaccurate or incomplete data;
• ask us to erase data that is no longer needed, unless the law requires us to keep it;
• withdraw consent you have given, as easily as you gave it;
• nominate another person to exercise your rights in the event of your death or incapacity;
• have your grievance addressed by us.

Write to privacy@true-engage.com from the email address linked to your account. We may need to verify your identity before acting. We acknowledge requests within 2 business days and resolve them within 30 days, and in any case within the period set by the DPDP rules.

If you are not satisfied with our response, you may complain to the Data Protection Board of India.

We use reasonable security safeguards, including encryption in transit and at rest, envelope encryption of provider credentials, role-based access, two-factor authentication, and audit logging. Details are on our Security page.

If a personal data breach affects you, we will inform you and the Data Protection Board of India as the DPDP Act requires, and report cyber incidents to CERT-In within the time its directions require.

TrueEngage is a business service. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, write to privacy@true-engage.com and we will delete it.

We use only the browser storage needed to run the website and console. See our Cookie Policy.

We will post updates to this policy on this page and change the date at the top. If a change materially affects how we use your data, we will tell you by email or in the console before it takes effect.

Questions, requests and grievances: privacy@true-engage.com.