Legal
Privacy policy
What Vocal4Locals collects about a customer and about a business, why, how long it is kept, and what you can require us to do with it under the DPDP Act 2023.
- Last updated
- 27 August 2026
- Sections
- 9
- Length
- About 1,200 words
Contents
About this document
- What changed
- First published on this date. Nothing in it has changed since.
Not yet reviewed by a lawyer
This document was written in-house and has not been reviewed by counsel. It describes what Vocal4Locals actually does today and is published so that a reader can see the terms before signing up, not as a substitute for legal advice. It will be reviewed before the product takes its first payment.
This policy explains what personal data Vocal4Locals collects, why, who it is shared with, and what you can require us to do with it. It is written for the Digital Personal Data Protection Act, 2023 ("the DPDP Act"). Vocal4Locals is the Data Fiduciary for the personal data described here.
The contact details for our Data Protection point of contact and Grievance Officer are not published yet. They will appear on this page and on the contact page before the product takes its first payment. Until then, requests can be made through the contact page.
In short
Two kinds of people use this product. A customer needs no account to search — only to ask for a phone number. A business owner gives us more, and chooses how much.
Two kinds of people use this product and the data we hold about each is different.
- A CUSTOMER (a “lead”) searches the directory and asks to see a business’s phone number. Searching and browsing need no account; an account is created only at the point a number is requested.
- A BUSINESS OWNER claims or creates a listing, may send documents for verification, and may in future hold a subscription.
In short
A mobile number is the only thing we cannot do without, because it is how you sign in. Most of the rest is what you chose to give us, for a reason named beside it; the technical logs at the end of this section are collected automatically.
From a customer
| What we collect | Why we need it |
|---|---|
| Mobile number | To create your account and to send the one-time password that signs you in. Without it we cannot establish that a request came from you. |
| Name, if you give one | It is shown to a business when you ask for their number, so they know who called. |
| Which businesses you asked for the number of, and when | So you can find them again, and so the business can see the request it is paying to receive. |
| Language preference | So we message you in the language you chose. |
From a business owner
| What we collect | Why we need it |
|---|---|
| Mobile number | For sign-in, by one-time password, as above. |
| Listing information you enter: business name, trade, address, area, contact number, description and photographs | This is published, and it is meant to be. |
| Verification documents, if you choose to be verified: identity and business documents | These are NOT published. They are read by a person here, a decision is recorded, and the documents are retained only as long as needed to evidence that decision. |
| Payment information, once subscriptions begin | Card and bank details are handled by our payment processor and are not stored on our systems. |
Collected automatically
- Technical logs: IP address, browser type, pages requested and timestamps. Used to keep the service running, to investigate abuse, and for nothing else.
- Strictly necessary cookies, to keep you signed in. This marketing site sets no advertising or analytics cookies.
Most processing here rests on your consent, given when you create an account or submit information, and consent can be withdrawn. Some processing rests on the “certain legitimate uses” the DPDP Act allows, for example retaining records we are required by law to keep, or acting on a request you voluntarily made.
Withdrawing consent is as easy as giving it: write to us through the contact page. Where withdrawal means we can no longer provide part of the service (we cannot sign you in without your mobile number, for instance), we will say so plainly rather than continuing to process it.
In short
We do not sell it and we do not share it for advertising. It goes to the business you asked to contact, to the processors that run the service, and where the law requires it or a legal claim has to be made or defended.
We do not sell personal data and we do not share it for anybody else’s advertising. It is shared in exactly these circumstances.
- With a business you asked to contact: your name, if you gave one, and the fact and time of the request. This is the point of the product and it happens only because you asked.
- With Data Processors acting on our instructions: an SMS provider to deliver one-time passwords, a payment processor to take subscription payments, and hosting and storage providers. Each is bound by contract to process only as we instruct.
- Where the law requires it, or to establish or defend a legal claim.
Data is stored on servers in India. Some processors we rely on may process data outside India; where that happens it is only with a processor bound to equivalent protections, and only to the extent the DPDP Act permits.
| What | How long we keep it |
|---|---|
| Account data | While your account is open. Erased when you close it, except where a record must be kept by law. |
| Verification documents | Only as long as needed to evidence the verification decision, and then erased. |
| Contact-request records | While both accounts remain open, because they are the record a business is paying for. |
| Technical logs | A short operational period, and then discarded. |
You can ask us to erase your personal data, and we will erase it where we are not required to keep it. Requests go through the contact page, and we aim to answer within thirty days.
- To ask what personal data we hold about you and what we have done with it.
- To have inaccurate or incomplete data corrected, updated or completed.
- To have your data erased, where we are not required to keep it.
- To withdraw consent at any time.
- To nominate somebody to exercise these rights on your behalf if you are unable to.
- To have a grievance heard by us, and to escalate to the Data Protection Board of India if you are not satisfied with our answer.
Requests go through the contact page. We aim to answer within thirty days, and we will tell you if a request will take longer and why.
This service is not intended for anyone under 18 and we do not knowingly create accounts for children. We do not carry out behavioural tracking or targeted advertising directed at children. If you believe a child has created an account, tell us and we will erase it.
Access to personal data is restricted to people who need it, transport is encrypted, and verification documents are held separately from published listing data. No system is perfect. If a personal data breach occurs we will notify the Data Protection Board of India and every affected person, as the DPDP Act requires, and we will say what happened rather than what we would prefer to have happened.
When this policy changes materially, the date at the top of this page changes and account holders are told directly. We will not quietly widen what we collect.