DPDP Act 2023

We collect only what's necessary to run the platform: your name, email, and the creative data you enter (rate cards, media kits, invoices, deal notes). We do not sell your data to third parties or use it for advertising.

• Right to access — Download a complete JSON archive of everything we hold about you from your Data & Privacy settings.
• Right to correction — Update your name, email, and other profile details directly from your account settings.
• Right to erasure — Request permanent deletion of your account and all associated data. We honor this with a 30-day grace period (allowing you to cancel if it was a mistake). Request deletion from your Data & Privacy settings.
• Right to grievance redressal — Contact our Data Fiduciary at privacy@mediakitlab.com. We respond within 7 working days.

We retain your data for as long as your account is active. On account deletion (after the 30-day grace period), all personal data is permanently erased from our databases and backups within 90 days.

Aggregated, anonymized analytics data (with no personally identifiable information) may be retained indefinitely for platform improvement.

We use the following third-party processors to operate the platform:

• MongoDB Atlas — Database storage (us-east-1)
• Vercel — Application hosting and CDN
• Upstash Redis — Caching layer
• Resend — Transactional email delivery
• PostHog — Usage analytics (anonymized)

All processors are bound by data processing agreements and are prohibited from using your data for any purpose other than providing their services to us.

Passwords are hashed with bcrypt (12 rounds). Sessions are encrypted with AES-256-GCM (iron-session). All data is transmitted over HTTPS. We do not store raw payment information — invoice bank details are stored in your account and masked in all shared views.

For any DPDP-related requests or questions, contact our Data Protection Officer: