Data rights (DPDP Act 2023)

The Digital Personal Data Protection Act, 2023 grants you specific rights over your personal data. This page summarizes how to exercise them on CBC.

Your rights

• Access — a copy of all personal data we hold about you, plus your uploaded documents.
• Correction — fix inaccuracies. Most fields are editable directly from your dashboard.
• Erasure — delete your account and personal data.
• Withdraw consent — opt out of marketing communications at any time without affecting service-essential messages.
• Grievance redressal — escalate complaints through our designated officer.

How to exercise them

From the dashboard: Settings → Data & privacy. Or email privacy@cbc.in from the email associated with your account.

Erasure: what is and isn't deleted

• Anonymized in the database: phone replaced with a hash, email cleared, contact name + designation + company address cleared, bio and free-text fields redacted.
• Deleted from storage: profile photo, logo, GST certificate, MSME / Udyam certificate, all uploaded income tax returns, ID proof, address proof, experience certificate, education certificate. The storage objects are removed from thevendor-media and vendor-docs buckets.
• Retained (legal requirement): GST invoices and payment records (8 years per Indian tax law), audit logs of administrative actions, and the bare record that an account by that anonymized id existed.
• Earned credits: forfeited on erasure.
• Outgoing referral attributions: retained without your personal data — the businesses you referred remain attributed to your former (now anonymized) account so their attribution chain isn't broken.

How verification documents are protected

Sensitive documents (GST certificate, MSME, ITRs, ID proof, address proof, experience certificate, education certificate) are stored in a private Supabase Storage bucket. They are not publicly accessible by URL. Both you and authorised admin staff view them only via short-lived (15-minute) signed URLs generated on demand. Profile photos and logos are stored separately in a public bucket because they are designed to appear on your public profile.

Quiet hours

We do not send promotional messages between 21:00 and 09:00 IST.

Grievance officer

A formal grievance officer will be designated post-incorporation. Until then, complaints route to grievance@cbc.in.

Cross-border

Data is processed in India where feasible (Supabase, Mumbai region; the current preview project runs in us-west-2 pending migration before public launch). Some platform components (Vercel CDN, observability) are global by design. We do not transfer personal data outside India for purposes other than service delivery.