Grievance Redressal & Data Retention

Last updated: September 2026 • Plain-English Compliance • DPDP Act, 2023 & 2026 Rules • MeitY Mandate

In accordance with India's Digital Personal Data Protection (DPDP) Act, 2023, implementing rules, and Rule 3(2) of the Information Technology (Intermediary Guidelines) Rules, 2021, MudraForge provides clear transparency regarding Data Principal rights, official grievance redressal, and our data retention standards across the three parts of our platform: the MudraForge Cloud Runtime (backend execution), the Adesha Management App (internal staff oversight and 1-tap approvals), and the Customer-Facing WhatsApp Deployment Service (front-end customer engagement connecting to your existing infrastructure).

1. Official Grievance Redressal Officer

2. Data Lifecycle & Retention Standards

MudraForge acts as a Data Processor on behalf of our enterprise business clients (the Data Fiduciaries). We enforce clear rules to manage data lifecycles responsibly:

• Virtual File System (VFS) Storage & Privacy:
  • User Personal Vault: Dedicated, permanent storage within each user's personal VFS partition for master contracts, research, and individual deliverables. Individual workspaces are cryptographically isolated and protected from arbitrary organizational intrusion or automated deletion.
  • Third-Party AI Shielding: Sensitive user files and working notes processed in the VFS are completely shielded from third-party AI model harvesting or public data retention.
  • Temporary Workspace: A 90-day working scratchpad for daily AI drafts and temporary exports, automatically cleaned up after 90 days unless saved by the user.
• 7-Year Statutory Audit Retention (Section 8(7) DPDP Act): In accordance with Indian statutory law and the Companies Act, 2013, records of manager approvals, financial actions, and automated executions are preserved in tamper-evident audit logs for seven (7) years to prevent fraud and ensure corporate accountability. These compliance audit records are legally exempt from data erasure requests.
• Domestic Indian Infrastructure: Database storage is hosted exclusively within domestic data center clusters located in Mumbai and Delhi, India, guaranteeing that your data remains on Indian soil.
• Zero AI Model Training: Under our binding enterprise agreements, customer text, documents, and voice recordings are strictly prohibited from being used to train or fine-tune public foundation AI models.

3. Data Principal Rights Under the DPDP Act

Any individual interacting with the MudraForge platform (including external customers interacting through our customer-facing WhatsApp deployment or authorized company personnel using Adesha) may exercise their statutory rights under the DPDP Act, 2023:

• Right to Access: Request a concise, plain-English summary of personal data processed and third-party service providers used.
• Right to Correction: Request the correction of inaccurate, outdated, or incomplete personal information.
• Right to Erasure: Request the deletion of personal data held in active operational databases (excluding mandatory 7-year statutory audit records required by law).
• Right to Nominate: Nominate an individual to exercise data rights in the event of death or incapacity.

4. Step-by-Step Redressal Procedure & Guaranteed Timelines (SLA)

To file a formal grievance or submit a Data Subject Access Request:

• Send an email from your registered corporate email address to [email protected] with your full name, organization name, contact number, and the specific details of your grievance or request.
• Our Guaranteed Timelines: In compliance with Indian statutory guidelines, our office will formally acknowledge receipt of your complaint within forty-eight (48) hours and complete full forensic investigation, verification, and resolution within thirty (30) calendar days.