Privacy Notice

1. Who we are

Sammati (“we”, “our”, “us”) is the Data Fiduciary operating the Sammati consent management platform at sammati.app. Our grievance officer can be reached at dpdpa.sammati@gmail.com.

2. Data we collect

When you use the Sammati platform or website, we may collect:

• Account information (name, email, organisation) when you sign up
• Usage data (pages visited, API calls, feature usage) for platform improvement
• Consent records you create — stored as an immutable, hash-chained ledger
• Technical identifiers (IP address, browser type) for security and fraud prevention

We do not sell your personal data. We do not use it for advertising.

3. Purposes and legal bases

4. Your rights under DPDPA

As a Data Principal, you have the right to:

• Access a summary of your personal data we process
• Correct inaccurate or incomplete personal data
• Erasure (“right to be forgotten”) — we erase via crypto-shred, not row deletion
• Grievance redressal — contact our grievance officer (details below)
• Nominate another person to exercise your rights on your behalf

To exercise any right, email dpdpa.sammati@gmail.com. We will respond within 30 days.

5. Data retention

Consent ledger records are retained for as long as required to fulfil our contractual obligations and any applicable statutory retention periods. Account data is retained while your account is active and for 90 days after deletion to allow recovery.

6. Sub-processors

We use the following categories of sub-processors:

• Cloud infrastructure (hosting and database services)
• Email delivery (transactional notifications)
• Analytics (aggregate, privacy-first analytics — no cross-site tracking)

A full sub-processor list is available on request at dpdpa.sammati@gmail.com.

7. Grievance officer

8. Changes to this notice

We may update this notice as our practices evolve or regulations change. We will notify you by email or in-app notice at least 14 days before material changes take effect.