Privacy Policy

RegShield AI ("RegShield", "we", "us") provides an AI-powered compliance platform that maps customer security policies and evidence to global compliance frameworks. This policy explains what personal data we process, why, and the rights you have. It is designed to align with India's Digital Personal Data Protection Act, 2023 (DPDPA) and the EU/UK GDPR.

Who is responsible for your data

For data about your account and use of our website, RegShield is the data controller / data fiduciary. For the evidence and policy content you upload into your workspace, you are the controller and RegShield acts as a processor on your behalf — governed by our Data Processing Agreement.

What we collect

• Account data: name, work email, organization name, hashed password, role.
• Usage data: log and device information, IP address, and actions taken in the product (for security, auditing, and reliability).
• Customer content: documents and evidence you upload, and the analyses and reports generated from them.
• Sales enquiries: details you provide when you book a demo or contact us.

How we use it

• To provide, operate, and secure the service and your workspace.
• To analyze evidence against frameworks and generate readiness reports (the core feature you request).
• To communicate with you about your account, support, and (where permitted) relevant product updates.
• To detect, prevent, and respond to fraud, abuse, and security incidents.
• To comply with legal obligations.

Legal bases

We process personal data to perform our contract with you, on the basis of your consent (where required), to comply with legal obligations, and for our legitimate interests in operating and securing the service.

Sharing & service providers

We do not sell your data. We share it only with vetted service providers who help us run the platform (hosting, AI processing, email), bound by confidentiality and data-protection terms. A current list of these providers is available on request.

Data location & retention

Production data is hosted in India. Some service providers (e.g. AI and email providers) may process limited data outside India under appropriate safeguards. We retain your data for as long as your account is active. When your account is closed, we delete your compliance data — evidence, reports, policies, integrations and related records — within 90 days, unless you ask us to delete it sooner. We keep limited billing records and a security audit trail for a further period where required by law or to defend against fraud and security incidents. You can request an export or deletion of your data at any time.

Your rights

Subject to applicable law, you may access, correct, export, or delete your personal data, withdraw consent, and lodge a complaint with a supervisory authority / the Data Protection Board of India. To exercise any right, email info@regshield.in.

Security

We apply technical and organizational measures to protect personal data — see our Security page.

Contact

Questions or requests about this policy or your data: info@regshield.in. [Insert registered entity name and address, and your Grievance Officer / Data Protection Officer contact, before publishing.]