India Privacy Notice (DPDP Act)

This notice adds India-specific information to the Tanqory Global Privacy Policy. It applies when India's Digital Personal Data Protection Act, 2023 ("DPDP Act") applies to how Tanqory Inc. ("Tanqory", "we", "us") handles your digital personal data. Where this notice and the Global Privacy Policy differ for a person in India, this notice applies.

The DPDP Rules, 2025 were notified on 13 November 2025 and phase in: the rules on Consent Managers apply from 13 November 2026, and most duties of Data Fiduciaries apply from 13 May 2027. We already offer the rights and choices below today.

Official references:

• DPDP Act, 2023 (Gazette of India): https://egazette.nic.in/WriteReadData/2023/248645.pdf
• Ministry of Electronics and Information Technology (MeitY): https://www.meity.gov.in/

---

1. Who is responsible

• Tanqory Inc. is the Data Fiduciary for personal data about merchants, developers, visitors to Tanqory websites and users of Tanqory apps. Tanqory Inc., c/o Harvard Business Services, Inc., 16192 Coastal Highway, Lewes, DE 19958, USA.
• Merchant stores: when you buy from a store that runs on Tanqory, the merchant is the Data Fiduciary and Tanqory is its Data Processor under our Data Processing Addendum. Ask the merchant first about your rights; we help the merchant answer.
• Contact (s.8(9)): privacy@tanqory.com answers questions about how we process your data. Please write "DPDP request" in the subject line.

2. What we collect and why (ss.4 to 7)

The categories of data, purposes, recipients and retention periods are listed in the Global Privacy Policy (sections "Personal Data We Collect", "How We Use Personal Data", "Sharing of Personal Data with Third Parties" and "Data Retention and Deletion"). The DPDP ground we rely on for each purpose is:

Consent under the DPDP Act must be free, specific, informed, unconditional and unambiguous, and withdrawing it must be as easy as giving it (s.6(4)). Use the unsubscribe link, your account settings, or email us. Withdrawing does not affect processing done before.

This notice is in English. Section 5(3) of the Act lets you ask for it in English or any language in the Eighth Schedule to the Constitution; write to us and we will work on a translation for you.

3. Your rights (ss.11 to 14)

You can:

• get a summary of the personal data we process about you and the processing activities, and the identities of the other Data Fiduciaries and Data Processors we have shared it with (s.11);
• ask us to correct, complete, update or erase your personal data (s.12);
• raise a grievance with us about any act or omission concerning your data (s.13);
• nominate another person to exercise your rights if you die or become incapable (s.14).

Send requests to privacy@tanqory.com. We will check your identity before we act, for example by your account email or phone number. We answer grievances within 90 days at the latest, as Rule 14 requires, and aim to answer well within 30 days. Requests are free.

If you are not satisfied with our answer, you can complain to the Data Protection Board of India. The Act asks you to raise the grievance with us first (s.13(3)).

4. Children

Tanqory is built for businesses and is not meant for children. Under the DPDP Act a child is anyone under 18 (s.2(f)), and you must be 18 or older to open a merchant account. We do not knowingly process children's data, and we do not track, monitor the behaviour of, or target advertising at children (s.9(3)). If we learn that we processed a child's data without verifiable parental consent, we delete it.

5. Cookies and similar technologies

Strictly necessary cookies are always on. For other cookies (analytics and ad measurement) on Tanqory websites, visitors in India see our cookie notice and can switch them off at any time in the cookie settings. We also honour Global Privacy Control signals from your browser. The full list is in our Cookie Policy.

6. Transfers outside India (s.16)

Tanqory is a US company. Today our platform data is hosted by DigitalOcean in Singapore, and some of our service providers process data in the United States and other countries (see the subprocessor list). The DPDP Act allows transfers outside India except to countries the Central Government restricts by notification, and we will follow any such restriction and any requirement set under Rule 15.

7. Security and data breaches (s.8(5) and (6), Rules 6 and 7)

We protect personal data with the measures described in the Global Privacy Policy section "Data Security Measures". If a personal data breach happens, we inform the Data Protection Board and each affected person without delay, and send the Board a detailed report within 72 hours of becoming aware of it, as Rule 7 requires. When we act as a Data Processor, we tell the merchant without undue delay so that it can meet its own duties.

8. How long we keep data (s.8(7))

We keep personal data only as long as the purposes in section 2 need, or longer if a law requires it (for example tax records). Periods are listed in our Data Retention Policy. After that we delete the data, and we ask our Data Processors to delete it too.

9. Changes

We will post changes to this notice here and change the "Last updated" date. For a material change we will also tell you prominently, for example by email or with a notice on our website or app. Disputes are handled as set out in the Global Privacy Policy; nothing in it limits your right to complain to the Data Protection Board of India.

Change history