1. Legal basis and alignment
SideCash.ai is designed around the Digital Personal Data Protection Act, 2023 (DPDP): purpose-limited collection, granular consent with records, data minimisation, security safeguards, breach notification readiness, and grievance redressal. Formal DPDP compliance certification and legal sign-off are pending and tracked in our production checklist.
2. Data categories and minimisation
We separate data by sensitivity: account/profile data, masked identity references (for example PAN last 4 digits), encrypted identity values, payout references, work product, and audit metadata. Interfaces default to the least sensitive representation that does the job; full values exist only where a payment or verification system needs them.
3. Access control model
Access is enforced server-side by a capability model: role determines capabilities, and attribute checks (team, region, project, workflow state, sensitivity) bound their reach. Notable rules:
- Authorized personnel of the Company may access and process PAN and Aadhaar information only where necessary to resolve payment or transaction-related issues, comply with legal or regulatory obligations, or as otherwise permitted under applicable law.
- Team leads and ops managers: identifiers are displayed masked by default, within their teams or regions.
- Finance: payout ledgers and batches, with access to the identity details required to make a payment.
- Compliance: KYC review with document access that requires a written reason and is always audited.
- Directors: analytics and approvals; sensitive document viewing is not part of the role.
- Founder break-glass access exists, still passes capability checks, and is logged at critical risk level.
4. Retention schedule
We keep data only as long as needed:
- Account and profile data: life of account + 90 days.
- Identity and payout records (PAN, Aadhaar and bank account details, stored encrypted): only while needed for verification, payout processing and record-keeping, then deleted unless the law requires otherwise.
- Payout and tax records: statutory retention (typically 7 to 8 years).
- Project work data: per client contract, handled only for the specific project it belongs to.
- Audit logs: minimum 3 years.
5. Security measures
- TLS for all traffic; secure headers; deny-by-default authorisation.
- Encrypted fields for identity and payout values (KMS-backed envelope encryption in production).
- Masked display everywhere outside restricted systems.
- Comprehensive audit logging with sanitisation so full identifiers can never enter logs.
- MFA for internal admin roles, rate limiting, and WAF planned before production (see checklist).
6. Breach response
We maintain an incident register with severity and ownership. In the event of a personal data breach we will notify the Data Protection Board of India and affected users as required by the DPDP Act. The full incident response runbook is part of the production hardening checklist.
7. Processors and clients
External providers (payments, storage, email, website analytics via Google Analytics, and advertising measurement via the Meta Pixel and Conversions API) operate under data processing agreements or their own controller terms. Analytics and advertising tools run only with the visitor's consent and never receive identity, bank or work data. Clients receive only finished project work under contracts that restrict use to the stated purpose.