Compliance Documentation

Privacy Policy

Last Updated: July 7, 2026

Not a substitute for legal review: This policy is provided as a good-faith, plain-language reference and has been prepared with awareness of India's DPDP Act and the EU's GDPR, but it has not been reviewed by a lawyer. It should not be treated as a final compliance document. Please have it reviewed by qualified legal counsel before relying on it as your binding privacy policy or terms of service, particularly before scaling to handle real payments or significant EU traffic.

CoreDhristi ("we," "our," or "us") operates the website coredhristi.com. We are committed to protecting the privacy and security of your personal data. This Privacy Policy details our practices regarding data collection, processing, and storage, designed in line with the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Digital Personal Data Protection Rules, 2025 (India), and with reference to the General Data Protection Regulation (GDPR) for our global users.

Note on the DPDP Act's rollout: The DPDP Rules, 2025 were notified on November 14, 2025, with selected provisions commencing earlier and broader compliance obligations taking effect in phases. CoreDhristi is voluntarily aligning its practices with the Act ahead of the remaining phased deadlines. This policy is provided for transparency and is not a substitute for legal advice.

1. Data We Collect

When you request early access or enroll in the CoreDhristi waitlist, we collect the following personal details provided directly by you:

Identity Information: Full name.
Contact Details: Email address.
Professional Information: Your self-selected role (Company, Developer, Agency, Investor or Partner) and your company or project name (optional).
User Messages: Any details or requirements you voluntarily provide in the message text field.
Technical Identifiers: IP address, browser information, UTM referral parameters (source, medium, campaign), and the landing page URL.

If you use the CoreDhristi AI Product Guide (the on-site chat widget), we separately collect your name, email address, and self-selected role once, before your first question, under the same consent standard described in this policy. This is asked only once per browser and is used solely so the founding team can follow up if useful.

2. Purpose of Data Processing

We process your personal details strictly for the following purposes:

To register your early access request and allocate founding cohort slots.
To send you personal updates, early access invitations, and news regarding CoreDhristi (only with your explicit consent).
To customize follow-up communications (for instance, Developer signups are provided with builder-community Discord invitations, whereas Company profiles are routed for manual call scheduling).
To analyze marketing campaigns and traffic channel efficiency.

3. Legal Basis under the DPDP Act and GDPR

Our processing of your personal data is based entirely on your free, specific, informed, unconditional, and unambiguous Consent, which you provide by ticking the consent checkbox on our waitlist form or on the AI Product Guide's one-time lead-capture gate. Under GDPR, this same processing relies on Article 6(1)(a) consent as its legal basis. You have the right to withdraw this consent at any time, and withdrawal will not affect the legality of processing carried out before it.

4. Data Controller

For the purposes of the DPDP Act and GDPR, CoreDhristi is the data controller (data fiduciary) responsible for the personal data described in this policy. [Placeholder: CoreDhristi's registered legal entity name and registered address will be inserted here once company registration is complete. Until then, use the contact details in Section 12 for any controller-related query.]

5. Data Storage and Retention

Your details are logged securely into our database and a localized CSV backup. We do not sell or lease your data. In plain terms: we keep waitlist data for as long as the waitlist and private beta remain open, and for a limited period after public launch to facilitate onboarding founding members, after which inactive records are deleted or anonymized. If you'd like the specific retention date that applies to your own submission, or want it deleted sooner, email us and we will act on that request directly. Once we receive a valid erasure request, we aim to act on it within 7 days, in line with the response timeline set out in Rule 14 of the DPDP Rules, 2025.

6. Security Measures

We implement reasonable server-side security measures to prevent unauthorized access, alteration, or disclosure of signup data. Direct access to data logs (including signups.csv) is restricted and blocked via Apache configuration files. Data transmissions are encrypted via secure HTTP protocols (SSL/TLS).

7. Personal Data Breach Notification

If we become aware of a personal data breach affecting waitlist data, we will investigate promptly, take reasonable steps to contain and remediate the issue, and notify affected users and applicable authorities where required by law. For users covered by GDPR, we aim to notify the relevant supervisory authority within 72 hours where the breach is likely to result in a risk to rights and freedoms, unless an exception applies.

8. International Data Transfers

Some visitors to this waitlist, including visitors in the EU, may have their data processed or stored outside their home country or region. [Placeholder: the specific safeguard relied on for any such transfer, for example EU Standard Contractual Clauses or an adequacy decision, will be confirmed here once our hosting and processor arrangements are finalized and reviewed by counsel. We are not asserting a specific mechanism is already in place until this section is updated.] If this matters to your decision to sign up, email us and we will tell you plainly what we currently know.

9. Rights of Data Principals (DPDP Act)

As a Data Principal under the DPDP Act, you have the following rights:

Right to Access: Request a summary of the personal data we hold about you and how it is processed.
Right to Correction and Completion: Request correction of inaccurate details or completion of incomplete data.
Right to Erasure: Request deletion of your personal data once it is no longer needed for the purpose it was collected for, or after you withdraw consent.
Right to Withdraw Consent: Withdraw your consent for future processing and communications at any time.
Right to Nominate: Nominate another individual to exercise these rights on your behalf in the event of your death or incapacity.
Right to Grievance Redressal: Raise a complaint with us directly, and escalate to the Data Protection Board of India if it remains unresolved.

To exercise any of these rights, please email us directly at info@coredhristi.com, along with enough detail for us to identify your request (for example, the name and email you used to sign up).

If you are located in the European Union or European Economic Area, you have the following rights under GDPR, distinct from (though overlapping with) the DPDP rights above:

Right to Access: Obtain confirmation of whether we process your data, and a copy of it.
Right to Rectification: Have inaccurate or incomplete personal data corrected.
Right to Erasure: Request deletion of your personal data ("right to be forgotten"), subject to applicable exceptions.
Right to Restriction of Processing: Ask us to limit how we use your data in certain circumstances.
Right to Data Portability: Receive your data in a structured, commonly used, machine-readable format, or have it transferred directly where technically feasible.
Right to Object: Object to our processing of your data, including for direct marketing purposes.

You also have the right to lodge a complaint with a supervisory authority in your country of residence, place of work, or the place of the alleged infringement. Which authority that is depends on where you are based; we're happy to point you to the right one if you email us.

11. Cookies and Tracking

This site uses Google Analytics (GA4) to understand how visitors use the waitlist page: pages viewed, general location at a country or city level, device and browser type, and referral source. GA4 does not load, and no analytics cookie is set, until you accept the cookie banner shown on your first visit. If you decline, GA4 stays off for that browser.

You can also opt out of Google Analytics tracking generally using your browser's cookie settings, or by installing the Google Analytics Opt-out Browser Add-on. We do not currently use any other third-party tracking or advertising cookies on this waitlist.

12. Grievance Redressal

If you have any questions, concerns, or grievances regarding our data handling practices, please contact us at the details below. We aim to acknowledge and resolve grievances within 90 days. If you remain unsatisfied, you may escalate your complaint to the Data Protection Board of India (DPDP Act) or your local supervisory authority (GDPR), once the relevant complaint-handling process is operational for your case.

Email: info@coredhristi.com
Address: CoreDhristi Legal Operations, India.

13. Not Legal Advice

This Privacy Policy is provided for transparency about our own practices and reflects our current, good-faith understanding of the DPDP Act, 2023, the DPDP Rules, 2025, and GDPR. It is general information, not legal advice, and it will be updated as our understanding of the law and its phased rollout develops. If you need advice specific to your situation, please consult a qualified lawyer.