Privacy Policy

Parity Cube Pvt Ltd, D/6 Goragandhi, Opp Railway Station, Chandavarkar Road, Borivali West, Mumbai 400091 (the "Operator") runs OpenTrust. For the purposes of the Digital Personal Data Protection Act, 2023 ("DPDP Act"), when and as it applies, the Operator is a data fiduciary for the data it decides how to use to run, secure and moderate the Service. For the content of Reports, the Merchant who submits a Report decides to share it, and is responsible for having a lawful basis and any notice or consent required; the Operator hosts and shows that content as an online intermediary.

• Merchants who register and use the Service, and their authorised users.
• Individuals whose mobile numbers appear in Reports. They have no relationship with us and did not give us their numbers. Merchants did, so we explain below what we do with them.

From Merchants

• Registration details: your name, business name, website, GSTIN (optional), work email, mobile number and password (stored only as a one-way hash). Your mobile number is used to reach you about your account and is never shown to other Merchants.
• Terms acceptance: time, version and IP address.
• Usage: API key identifiers (never the key itself), when keys were last used, Check and request counts, and technical logs such as IP address and user agent.
• Reports you submit and messages you send us.

About Individuals (in Reports and Checks)

• The mobile number, held as (a) a keyed cryptographic hash used for matching and (b) an encrypted copy readable only by authorised administrators for moderation and grievance handling, plus the last 4 digits.
• The category of experience, an optional short note written by the Merchant, and dates. Notes are screened to reject emails, links and phone numbers, but may still contain information we did not intend to receive. Tell us if you see any and we will remove it.
• We do not ask Merchants for customer names, addresses, order or payment data.
• Numbers that are only checked are not stored as such. We keep a count of Checks per Merchant, not a list of numbers checked.

We do not sell personal data, show advertising, build advertising profiles or allow bulk export.

• Other approved Merchants who check a number see the last 4 digits, how many Merchants reported it, and for each Report the category, note and date, marked as from a verified Merchant. They never see the full number or the name of the reporting Merchant.
• Authorised administrators can see full numbers and reporting Merchants, only to run, moderate and secure the Service and handle complaints. Admin actions are logged.
• Every Result carries a notice that Reports are unverified observations and not a finding about anyone.

We share data only with: (a) service providers who process it for us under written terms (for example hosting, and email delivery through Resend); (b) courts, regulators, law-enforcement and other authorities where we believe in good faith that the law or a lawful order requires it, or to protect rights, safety or the Service; (c) professional advisers, insurers and auditors under duties of confidence; and (d) a successor in a merger, acquisition or restructuring, who must honour this policy. We do not otherwise disclose the identity of reporting Merchants.

Reports are statements made by Merchants. We do not verify them and do not state or warrant that any of them is accurate, complete or lawful, and we are not responsible for their content. Where something is wrong, our process below exists to correct or remove it. Our responsibility for Merchant Content is governed by the Terms of Use, which also limit our liability.

• Reports: 5 years from submission, after which they are deleted or irreversibly anonymised, unless needed for an open complaint, legal claim or legal requirement. Reports removed by an administrator are deleted after 90 days.
• Merchant account data: while the account is active and 3 years afterwards for legal and audit purposes.
• Technical logs: 90 days. Audit logs of admin actions: 3 years.
• We may keep any data for longer where we reasonably need it to establish, exercise or defend legal claims, prevent fraud or abuse of the Service, or comply with law.

We use reasonable security practices appropriate to the data: keyed hashing and field-level encryption for numbers, hashed passwords and API keys, encrypted connections, role-based admin access with audit logging, and rate limiting. No system is completely secure and we do not promise that ours cannot be breached. If a personal data breach affects you we will notify the Data Protection Board of India and affected persons as the law requires.

Subject to Applicable Law, you may ask for a summary of the personal data we hold about you and how it is processed; ask us to correct, complete or update it; ask us to erase it; seek grievance redressal; and nominate another person to exercise your rights if you die or become incapacitated. Where processing rests on consent you may withdraw it at any time, without affecting what was done before. Write to [email protected]. We may need to verify who you are, and will respond within 30 days. We may decline or limit a request where the law allows, for example where it cannot be verified, is manifestly unfounded or excessive, or would prejudice the prevention or detection of fraud, the rights of others, or the establishment or defence of legal claims, and we will tell you why. If you are not satisfied you may approach the Data Protection Board of India once it is constituted.

If you believe a number of yours was recorded in error, or a note about you is inaccurate, write to the Grievance Officer from the number concerned, or otherwise show that you control it, and say why. Because numbers are stored as hashes, we can find matching Reports from the number you give us. We will review the Report, may ask the reporting Merchant to substantiate it without disclosing your identity to them beyond what is necessary, and will remove or correct it where we think it is not justified. Our decision is made in our reasonable discretion, and we will tell you the outcome.

The Service is for businesses and is not directed at children. Merchants must not submit Reports about numbers they know belong to a child. If we learn that one has, we will remove it.

We aim to store data in India. If a provider processes data outside India, we will do so only where the law permits and with appropriate safeguards.

We use a single first-party session cookie to keep Merchants and administrators logged in and to protect forms against forgery. We do not use advertising or third-party tracking cookies. Our pages load fonts from Google Fonts, which may receive your IP address.

We may update this policy at any time and will change the version and date above. We will tell registered Merchants about material changes by email or in the Service. Using the Service after the effective date means you accept the update.

Grievance Officer: Jimish Jobanputra, Co-Founder, Borivali West, Mumbai. Email: [email protected]. We acknowledge complaints within 24 hours and aim to resolve them within 15 days. General enquiries: [email protected].