Privacy policy

How TagConsent collects, uses, and protects your personal data.

Last updated: 5 November 2026

In plain language: TagConsent exists to help you manage consent and protect privacy. We practise what we preach — we collect only what we need, store it securely in India, and never sell your data.

1. Who we are

TagConsent ("we", "us", "our") is a consent management platform operated from India. We act as a Data Fiduciary under the Digital Personal Data Protection Act, 2023 ("DPDP Act") for the personal data we collect from you when you use our website and services.

2. What data we collect

Account data

When you create a TagConsent account, we collect:

  • Name, email address, and contact number
  • Organisation name and billing address
  • Password (stored as a salted hash, never in plain text)

Usage data

When you use the TagConsent platform, we collect:

  • Domains you register and their consent configuration
  • Consent records collected from your website visitors
  • Dashboard activity and feature usage (aggregated)

Technical data

Our servers automatically log:

  • IP address, browser type, and device information
  • Pages visited and timestamps
  • Referring website URL

3. Why we collect this data

Under Section 4 of the DPDP Act, we process your personal data only for the following lawful purposes:

  • Service delivery: To provide, maintain, and improve TagConsent
  • Account management: To authenticate you and manage your subscription
  • Communication: To send service updates, security alerts, and support responses
  • Compliance: To meet our obligations under applicable Indian law
  • Analytics: To understand how our platform is used and improve it (aggregated only)

4. Consent

In accordance with Section 6 of the DPDP Act, we obtain your free, specific, informed, unconditional, and unambiguous consent before processing your personal data. You may withdraw consent at any time by contacting us at [email protected].

5. Data storage and security

All data is stored on servers located in India. We implement industry-standard security measures including:

  • TLS/SSL encryption for all data in transit
  • Encrypted database storage for sensitive fields
  • Role-based access control with multi-factor authentication
  • Regular security audits and vulnerability assessments
  • Automated backups with encrypted storage

6. Data retention

In accordance with Section 8(7) of the DPDP Act, we retain your personal data only for as long as necessary to fulfil the purpose for which it was collected:

  • Account data: Retained while your account is active, deleted within 30 days of account closure
  • Consent records: Retained per your configured retention policy (default: 3 years)
  • Technical logs: Retained for 90 days, then automatically purged

7. Your rights as a Data Principal

Under Sections 11–14 of the DPDP Act, you have the right to:

  • Access your personal data and obtain a summary of processing
  • Correct inaccurate or incomplete personal data
  • Erase your personal data (subject to legal retention requirements)
  • Withdraw consent for any or all processing activities
  • Nominate another person to exercise your rights on your behalf
  • Grievance redressal — file a complaint about data handling

To exercise any of these rights, email [email protected]. We will respond within 72 hours.

8. Data sharing

We do not sell, rent, or trade your personal data. We share data only in these limited circumstances:

  • Service providers: Cloud infrastructure and email delivery (bound by data processing agreements)
  • Legal requirement: When required by a court order or lawful government request
  • Business transfer: In the event of a merger or acquisition (you will be notified)

9. Cookies

Our marketing website uses only essential cookies required for the site to function. We do not use tracking cookies, analytics cookies, or advertising cookies on our marketing pages. The TagConsent application dashboard uses a session cookie for authentication.

10. Children's data

TagConsent is a business tool and is not directed at children under 18. We do not knowingly collect personal data from children. If we become aware that a child's data has been collected, we will delete it promptly.

11. Changes to this policy

We may update this privacy policy from time to time. Material changes will be communicated via email and a notice on our platform at least 15 days before they take effect.

12. Grievance Officer

In accordance with Section 8(10) of the DPDP Act, our Grievance Officer can be reached at:

13. Contact

For any questions about this privacy policy or our data practices, contact us at: