Privacy Policy & DPDP Act (2023) Compliance

Marsys Group • LeadPulse AI • Kabza • HRNexto • SchoolService • ToonShala • Pillion

● Statutory Alignment: Digital Personal Data Protection Act, 2023 (India) & GDPR

1. Scope & Entity Classification

This Policy applies to Marsys Group and all its operating technology platforms, including LeadPulse AI, Kabza, HRNexto, SchoolService, ToonShala and Pillion. Marsys Group is the brand of Toonshala (sole proprietorship of Ashish Rai, Udyam Reg. No. UDYAM-DL-02-0119198, East Delhi, Delhi – 110096), which is the legal entity behind these products. Under India's Digital Personal Data Protection Act, 2023 (DPDP Act), Toonshala (trading as Marsys Group) operates as the Data Fiduciary, and users, business customers, and interaction leads are classified as Data Principals.

2. Data Principal Rights & Self-Service Controls

We uphold all statutory rights guaranteed to Data Principals under Chapter III of the DPDP Act:

Right to Access & Portability

Download all your account records, business configurations, interaction transcripts, and metadata via self-service API export (GET /api/auth/me/export).

Right to Correction

Update, rectify, or complete inaccurate personal information anytime directly through platform settings.

Right to Erasure (Deletion)

Request instant cascading deletion of your account and all associated operational data (DELETE /api/auth/me).

Right to Grievance Redressal

Direct escalation to our Data Protection Officer with guaranteed resolution within 72 business hours.

3. Technical Safeguards & Edge Security

Encryption in Transit: TLS 1.3 & TLS 1.2 enforced across all subdomains with HSTS preload.
Multi-Tenant Database Isolation: Strict tenant-level foreign key boundaries and cryptographic password hashing (bcrypt / argon2).
Financial PCI Compliance: Payment and card data are handled exclusively by certified gateways (Razorpay, Cashfree); Marsys servers never store credit card or CVV details.
Audit Logging: Real-time security access logs, constant-time HMAC signature checks for Meta & payment webhooks.

4. Statutory Grievance Redressal Officer & DPO

In accordance with Section 10 of the DPDP Act (2023), Data Principals may register grievances or exercise data rights by reaching our Data Protection Office:

Designation: Data Protection & Grievance Redressal Officer

Desk: Marsys Group Legal & Compliance

Email: [email protected] / [email protected]

Statutory SLA: Acknowledgment within 24 hours, resolution within 72 hours.