1. Who is responsible?
Saransh Vashistha, operating as Cursis. Address: Business contact address awaiting confirmation.
Draft status: business contact postal address, provider contracts, regions and retention operations require confirmation. This notice describes observed code and proposed operational targets.
Cursis is Data Fiduciary (GDPR controller where applicable) for its account, security and direct inquiry purposes. For personal data a workspace customer places in its workspace, that customer normally acts as fiduciary/controller and Cursis as processor under documented instructions. Cursis remains responsible for any separate purposes it determines.
Customers must give notices, establish lawful grounds, manage employee/client permissions and instruct us on retention and rights. We must secure processing, bind approved providers, assist with rights/incidents, and return or delete data under the processing agreement. Workspace administrators may access workspace content.
2. Data, purpose and collection point
| Data | Purpose | Collection and storage |
|---|---|---|
| Onboarding progress, email preferences and report delivery records | Show your first-week checklist, deliver weekly owner reports and optionally a daily assigned-task digest; unsubscribe or turn these off in notification settings. | MongoDB workspace_activation, workspace_email_preferences, workspace_email_deliveries; Resend for delivery. Reports use saved task data. |
| Pending CSV task import | Preview and safely retry the task batch you requested. | Browser sessionStorage, scoped to your account and workspace, removed after confirmed import or when the browser tab closes; imported tasks are saved in MongoDB. |
| Signup source, when analytics is accepted | Attribute a new workspace signup to the Ordis demo. | Optional browser sessionStorage for 30 minutes; users.signupSource and consent timestamp after sign-in. |
| Email, name, avatar, user ID | Create and identify your account, show your profile and send service messages. | Signup, Google sign-in, profile; MongoDB/Firebase. |
| Password hash and random salt | Verify password login. Plaintext passwords are transient request inputs and must never be logged. | Password signup/login; MongoDB. |
| Session / identity tokens | Authenticate requests. Tokens contain identifiers; they are credentials. | HTTP-only session cookie, browser auth storage, Firebase verification. |
| IP, browser headers, timestamps, rate-limit keys | Deliver pages, prevent abuse and investigate incidents. | Hosting, authentication, link preview and unsubscribe endpoints. |
| Tasks, projects, CRM contacts, emails, documents, meeting notes, chat and AI inputs/outputs | Deliver the workspace and the AI features you request. | Dashboard/API; MongoDB and configured AI/integration providers. |
| Integration credentials, endpoints and payloads | Carry out explicitly configured external actions. | Integration settings/API; MongoDB and the selected destination. |
| Inquiry name/company, email, service, budget, requirements and generated proposal | Respond to a custom-build request. | Agency contact form/API; MongoDB. |
| Consent choices, version, age attestation, nominee name/email, grievance and erasure requests | Record choices and handle privacy rights. | Signup and privacy centre; MongoDB. |
| Cookie choices and local application preferences | Remember choices; optional analytics only after opt-in. | Browser localStorage/cookies. No analytics SDK was identified in this audit. |
| Contact name/email/message and newsletter email/consent | Reply to inquiries; send product updates only after separate newsletter opt-in. | Contact form and footer; MongoDB marketing_contacts and marketing_subscribers. See the retention schedule in this notice. |
| Anonymous daily event totals | Measure public-page engagement after analytics opt-in; no visitor identifiers or form values. | MongoDB marketing_event_totals; operational request logs are controlled separately by the host. |
3. Legal grounds and consent
Signup requires affirmative consent to account processing needed to deliver and secure your workspace. Inquiry consent covers replying to that inquiry. Optional analytics/storage have separate choices, default off. Neither signup nor inquiries authorise marketing.
A statutory legitimate use requires a specific Section 7 provision, such as voluntarily supplied details for a requested purpose under 7(a), or legally required disclosure under 7(d). DPDP has no general commercial legitimate-interest basis. Customers assess employment processing independently. Required legal retention is documented separately.
Where GDPR applies, necessary services may rely on contract, mandatory retention on legal obligation and optional analytics on consent. A security legitimate-interest basis needs a documented balancing assessment.
You may refuse optional processing and still use the service. Withdraw consent here or email us without signing in. Withdrawing essential account processing closes the account. Earlier lawful processing and mandatory retention are unaffected.
4. Transfers outside India
Providers may process abroad. Transfers must be checked against restrictions notified under Section 16, applicable Central Government orders under Rule 15 when effective, and stricter sectoral/localisation duties. Further restrictions require review if we become a Significant Data Fiduciary. Provider availability is not government approval. Prohibited flows must stop or be rerouted. Production regions are unverified.
Where GDPR applies, transfers separately need a valid Chapter V mechanism, such as adequacy or appropriate contractual safeguards, with transfer assessment and supplementary measures where needed.
5. Retention schedule
These targets require operational deployment and provider confirmation. Closure stops account access. Eligible records should be erased promptly, with active/provider/backup cleanup targeted within 90 days. This is not a universal statutory deadline and cannot override earlier duties or mandatory retention.
- Account/workspace records: while necessary for service, then eligible erasure within 90 days of closure. Customer-controlled shared records follow the customer's lawful instructions.
- Inquiry and generated proposal: 90 days after last substantive response without engagement; contracts use a separate documented schedule.
- New privacy requests and consent evidence: 12 months after recording, subject to approved legal holds/schedule. Nominees: until removed, replaced or account closure.
- Browser consent: renew after 180 days. Signed sessions: maximum 7 days. Device chat caches: clear on closure on that device; other devices need local cleanup.
- Security/processing logs: restricted 1-year schedule where final Rules 6/8 apply. CERT-In-covered ICT logs: at least 180 days within India.
- Personal data and processing/traffic logs within Rule 8(3): minimum 1 year from processing when effective, then erase unless another duty applies. This can exceed the closure target.
- GST records where applicable: 72 months from the relevant annual return due date; longer for proceedings. Separately assess company-law books retention of 8 financial years where applicable.
- Backups: proposed 90-day rotation except restricted legal archives; restores must reapply deletion blocks before reuse.
We will explain retained categories, legal reasons and review dates. Existing provider retention, restricted archives and backup rotation are not yet verified or fully automated.
6. Children and guardians
Cursis is for adults 18 or older. We do not offer a parental-consent signup path. Do not submit under-18 data. We prohibit tracking, behavioural monitoring and targeted advertising directed at children. A checkbox is not verifiable parental consent. A future child service requires separate verified parental consent and legal review; parental permission alone does not remove tracking restrictions.
Contact us if a child's data was submitted so we can restrict and investigate it. Lawful guardians may contact us for rights assistance; any necessary evidence must use an agreed secure channel.
7. Your rights and language choices
The Privacy Centre offers account JSON, profile correction, assisted access, erasure, consent withdrawal and nomination after death/incapacity. Access requests can seek a processing summary and recipient identities. JSON portability is an additional product feature; DPDP access is not a general portability right.
We verify identity and protect other people. Nomination grants no current login access; claims require identity and death/incapacity verification. Customer-controlled requests are routed to that customer. You can email us without an account.
For assistance, request English or your preferred Eighth Schedule language by email. Only English is currently implemented; translated notices and consent experiences still need provisioning.
8. Grievance contact
Name: Saransh Vashistha
Title: Operator and Grievance Contact
Email: official@cursis.in
We commit to acknowledgment within 72 hours and resolution within 30 calendar days. Online requests receive an immediate receipt. For management escalation, reply with your request reference. These are service commitments.
After exhausting our grievance process, you may complain to the Data Protection Board of India through its officially notified channel when available and applicable. Verify the channel at MeitY; keep your complaint and our response. Where GDPR applies, you can also complain to your competent supervisory authority.
9. Security and updates
Signed sessions, password hashing and access checks are present. A public endpoint check on 18 October 2026 found TLS 1.3 and TLS 1.2 support; it does not enforce TLS 1.3 only. Storage/backup encryption, key management, other connections and regions require infrastructure evidence. AES-256 on every stored copy is not verified. Incidents require notifications under applicable duties.
Material purpose changes require updated notice and new consent where required. See the DPDP Act and Rules, corrigendum and commencement notifications. Duties have phased commencement.