Privacy policy

1. Who is responsible

The Data Fiduciary (the person who decides why and how your personal data is processed) is [legal name of the entity or proprietor], [registered address, India], operating as "Tekensa" ("we", "us"). Our Grievance Officer is named in section 17.

2. Who this applies to

This policy applies to you if you (a) send a message to the Tekensa account on Instagram or WhatsApp, whether or not you have a Tekensa account; (b) sign in at tekensa.com; or (c) use the Tekensa mobile application. Content kept only on your phone by the mobile application, and never sent to us, is not processed by us and is outside this policy except where you choose to back it up (section 3.6).

3. The personal data we process

3.1 What you send

The message or item itself, exactly as sent: text, a link, a photo, a video or reel, a voice note, a document. Some of these may contain personal data of yours or of other people (a name in a photograph, a voice, an address on a bill). We process it only for the purposes in section 4.

3.2 What we derive from it

A title, a category, tags, a short description, text found inside an image or document, a transcript of a voice note, dates, amounts, and named products or brands. Each derived note records whether a rule found it or a model inferred it, and you can correct any of it.

3.3 Account and contact data

Your email address (used to sign in by one-time code); your Instagram-scoped user id or WhatsApp number and display name (used to reply to you and to link your messages to your account); the time you first and last messaged us.

3.4 Technical and usage data

The platform message id, the channel (Instagram, WhatsApp, web, app), the time each item arrived, which processing steps ran and how long they took, and the corrections you made. We count events (an item kept, a reply sent, a model read) to run and cost the service; these counts contain no content.

3.5 Data we deliberately do not store

Email addresses and phone numbers found inside what you send are counted, not stored. Contact cards shared on WhatsApp are refused. Anything that looks like a password, PIN, one-time code, card security code or door code is kept as sent and is never read, transcribed or sent to any model.

3.6 Backups from the mobile application

If you turn on backup in the application, the items kept on your phone are copied to our servers under your account, and this policy applies to that copy.

4. Why we process it, and on what basis

Under the DPDP Act we process personal data either with your consent or for a "legitimate use" listed in section 7 of the Act. The table shows each purpose and its basis.

We do not process your personal data for advertising, profiling for advertising, or sale to anyone, and we do not use it to train any model of ours or of any provider.

5. What we never do

• Read your Instagram or WhatsApp beyond the messages you send to the Tekensa account.
• Read, transcribe or send to a model anything that looks like a credential (section 3.5).
• Store the contact details of other people found inside what you send.
• Sell, rent or share your personal data for anyone else's purposes.
• Use your content to train any model.
• Keep anything after you delete it, beyond the short windows in section 7.

6. Who processes it on our behalf

We engage the following Data Processors under contracts that limit them to processing on our instructions (DPDP Act, section 8(2)). Each sees only what its role requires.

Google and Groq receive an item only at the moment it is read, and only the item. They do not receive your email address, your platform id, or your other items.

7. How long we keep it

Before you have an account

Everything you send is kept for 30 days from your last message. If you have not linked within 30 days, it is erased: the files first, then the records, then the identity. Each new message restarts the 30 days.

While you have an account

For as long as your account exists, or until you delete the item.

One item you delete

Hidden at once; you can undo for one day; then erased with its files and derived notes.

Your whole account

Erased on request (section 9.3): files first, then every record, then your sign-in. No copy is kept.

Unlinked channel

Items already in your account stay with your account. New messages from that channel are treated as those of a person without an account, with the 30-day rule above.

Operational records

Event counts with no content, and server logs, are kept for up to [90 days] and then deleted, unless the law requires longer.

Inactivity

If you do not use your account for [24 months] we will write to your email address and, absent a reply within 30 days, erase the account as above (DPDP Act, section 8(7)).

8. How we protect it

• Every table is behind row-level security: your data can be read only by a session signed in as you, or by our own server functions.
• Files are in a private store, never public; a signed, expiring link is required to read one.
• Your Instagram id or WhatsApp number is looked up only through a keyed hash, so it does not appear in queries or logs.
• Messages from Instagram and WhatsApp are accepted only when their signature verifies; our own internal calls carry secrets that are never in the code.
• The link in a reply is a one-time key sent down the channel itself: 32 random bytes, stored only as a SHA-256 hash, spent on first use, expiring within a day (30 minutes for a first-time sender). The older six-digit code, where it is still offered, is limited to five guesses per code and ten wrong attempts an hour.
• Data is encrypted in transit and at rest by our hosting provider.
• Every action on your data leaves a record you can see on the item.

9. Your rights

9.1 Access (section 11)

You can see everything we hold about you at any time: every item, every derived note, the record of what was done to it, and the processors named in section 6. Sign in at tekensa.com/home; the counts on the You page are complete by construction.

9.2 Correction and updating (section 12)

You can correct any title, category, tag, summary or note on any item. A correction is final: no later processing overwrites it. To correct your email address, write to us.

9.3 Erasure (section 12)

You can delete one item from the item itself, or everything from the You page by typing DELETE EVERYTHING. Without a sign-in, follow tekensa.com/delete-account or write to privacy@tekensa.com. Erasure is carried out as in section 7 unless a law requires us to retain particular data, in which case we will tell you what and why.

9.4 Grievance redressal (section 13)

Write to the Grievance Officer in section 17. We will acknowledge within [48 hours] and respond within [30 days]. If you are not satisfied, you may complain to the Data Protection Board of India.

9.5 Nomination (section 14)

You may nominate a person to exercise these rights on your behalf if you die or become incapacitated, by writing to us.

9.6 Taking a copy

You can export your items from the application, and we will provide a copy of your server-held items in a common format on request.

10. Consent, and withdrawing it

You give consent by creating an account and by linking a channel, after this notice. You can withdraw it at any time, as easily as you gave it: unlink a channel from the You page, or delete your account. Withdrawal does not affect processing done before it. After withdrawal we stop processing and erase your data as in section 7, except where a law requires retention.

If you send a message before you have an account, that processing rests on the legitimate use in section 4, not on consent; you can end it by asking us to erase what you sent (section 9.3).

11. Children

Tekensa is for people aged 18 and over. We do not knowingly process the personal data of a child, and we do not track children or direct advertising at them. If you believe a child has sent us something, write to us and we will erase it.

12. Where your data is stored and transferred

Your data is stored with Supabase in [region]. Items are sent to Google and Groq at the moment they are read, and messages pass through Meta, each of which may process data outside India. We make such transfers as permitted by section 16 of the DPDP Act, and not to any country the Central Government has restricted by notification.

13. If something goes wrong

If a personal data breach affects you, we will inform you and the Data Protection Board of India in the form and time the DPDP Act and the Rules under it require, and we will tell you what happened, what data was involved, and what we are doing about it.

14. Instagram and WhatsApp in particular

When you message the Tekensa account, Meta sends us the message, its attachments, and your Instagram-scoped id or WhatsApp number. We use this only to keep what you sent, to reply to you, and to link your messages to your account when you enter the code. We do not access your profile, your followers, your other conversations, or anything you have not sent to the Tekensa account. Our use of data received from Meta complies with Meta's Platform Terms and Developer Policies. You can stop us from receiving your messages at any time by not messaging the account, and you can remove what we already hold by the means in section 9.3.

15. Cookies and local storage

tekensa.com sets no advertising or analytics cookies. Signing in stores a session token in your browser's local storage so you stay signed in; signing out removes it. The mobile application stores your items on your phone in its own storage.

16. Changes to this policy

If we change this policy in a way that affects you, we will tell you by email or in the service before the change takes effect, and where the change needs your consent we will ask for it. Earlier versions are available on request.

17. Grievances and contact

Grievance Officer: [name], [postal address, India], privacy@tekensa.com. General questions: hello@tekensa.com.

This policy is governed by the laws of India. Nothing in it limits any right you have under the DPDP Act or any other law.