DPDP-Act Notice

Legal name

Cedr AI Labs

Office

Sector 137, Noida 201305, Uttar Pradesh, India

Status under DPDP

Data Fiduciary, we determine the purpose & means of processing your personal data

Data Protection Officer

dpo@cedrailabs.in

Grievance Officer

grievance@cedrailabs.in

Postal contact

Attn: Grievance Officer, Cedr AI Labs, Sector 137, Noida 201305

For the comprehensive enumeration, see our Privacy Policy §2. In summary, we process:

• Identifiers, name, mobile, email, hashed credentials.
• KYC where required, PAN, masked Aadhaar reference, address proof.
• Business records you enter, properties, tenants, leases, payments, ledgers.
• Communications, emails, in-app messages, and support tickets you send us.
• Device & usage telemetry, IP, device type, anonymised app analytics.

Under §6 of the DPDP Act, we process your personal data only for the specific purpose for which you have given consent, or for which processing is otherwise lawful: to provide and improve the Cedr products you have signed up for, and to comply with our legal obligations.

We do not use your data to train third-party models. We do not sell your data. We do not pass your data to advertisers.

You give consent by creating an account and ticking the box that accepts these terms. You can withdraw consent at any time from Settings → Privacy → Withdraw consent inside the product, or by writing to the Grievance Officer above.

Withdrawing consent stops further processing but does not retroactively invalidate processing that was lawful at the time it occurred. In most cases, withdrawing consent means we can no longer run the product for you; we will delete your data per the timelines in our Privacy Policy §7.

Under §11 to §14 of the DPDP Act, every Data Principal has these rights. Cedr provides each as a self-serve flow inside the product. You should never have to email us to use a right that ought to be a button.

• Right to access: export your full dataset as CSV/JSON from Settings → Data.
• Right to correction: edit name, phone, address, KYC and business records from the app.
• Right to erasure: permanently delete your account; we retain only anonymised audit logs required by tax law.
• Right to portability: the export above is in standard CSV/JSON.
• Right to nominate: under §13, nominate another individual to exercise rights on your behalf in case of incapacity.
• Right to grievance redress: email grievance@cedrailabs.in; we respond within 7 working days.

Cedr does not transfer personal data outside India. All primary storage and backups sit on AWS India (ap-south-1, Mumbai). If the Central Government notifies a country to which transfer is restricted under §16, our processing already complies with that restriction by default.

Cedr products are not intended for users under 18. We do not knowingly process the personal data of a child. Where a user is a person with a disability whose lawful guardian acts on their behalf, the consent of the guardian is obtained, as required under §9 of the Act.

If we experience a personal-data breach as defined under the Act, we will:

• Notify the Data Protection Board of India within 72 hours of becoming aware.
• Notify every affected Data Principal within 72 hours, by email and in-app banner.
• Publish a public post-mortem at cedrailabs.in/security within 30 days, including timeline, root cause, and remediation.

If something we've done with your personal data feels wrong, this is the path:

1. Write to the Grievance Officer at grievance@cedrailabs.in. We acknowledge within 24 working hours and resolve within 7 working days.
2. Escalate to the DPO at dpo@cedrailabs.in if the response is unsatisfactory.
3. Approach the Data Protection Board of India under §27 of the Act if the issue remains unresolved after our two-step process.