Template — not legal advice. This starter text must be reviewed and completed by the business operating this deployment and its legal adviser before launch (company name, address, grievance officer, governing law, retention periods).

Privacy notice

This notice explains how [Operator legal name] processes personal data in CivilMargin, including under India’s Digital Personal Data Protection Act, 2023. [Confirm applicability and complete with counsel.]

Data we process

Account data: name, email, hashed password, session records.
Workspace data you provide: projects, BOQs, bills, supplier and client names, GSTINs, measurements, variations, cash items.
Optional WhatsApp number, only if you opt in to alerts.
Technical logs without document contents or secrets.

Uploaded documents

Uploaded files are processed and discarded by default. Extracted text is kept only until the document is confirmed or discarded. Originals are stored only if your workspace enables file storage and the uploader consents.

Service providers

Hosting (Vercel), database (MongoDB Atlas), and — only where your administrator enables them — email (Resend), WhatsApp (Meta), AI extraction (OpenAI or Anthropic) and payments (Razorpay). [List regions, transfer safeguards and agreements.]

Your rights

You may request access, correction or deletion of your personal data, and withdraw consent for optional processing such as WhatsApp alerts. [Grievance officer name and contact; response timelines.]

Retention

[Retention periods for workspace data after cancellation, backups and audit logs.]