Privacy Policy

This Privacy Policy is the privacy notice of Marg (the “Service”), operated by Pascalblue Studio Pvt Ltd(“Company”, “we”, “us”, “our”), a company incorporated under the laws of India. Under the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Digital Personal Data Protection Rules, 2025 (“DPDP Rules”), we act as a Data Fiduciary for personal data we determine the purpose and means of processing. You are the Data Principal for your personal data.

This notice is provided separately from our Terms of Service. It explains what personal data we process, why, with whom we share it, how long we keep it, and how you can exercise your rights under the DPDP Act. We process digital personal data in accordance with the DPDP Act and DPDP Rules.

This notice is published in English. If you need it in another language listed in the Eighth Schedule to the Constitution of India, contact us at hello@pascalblue.studio and we will provide a reasonable assistance path.

1. Scope

This Policy applies to personal data we process when you:

• Visit or use Marg (including gomarg.in and related staging hosts);
• Create or use an account;
• Contribute tips, flows, votes, or other content;
• Use MargAI (voice assistant) or other product features;
• Join the Rewards Programme or request a redemption;
• Contact support or otherwise communicate with us.

2. Personal Data We Process and Why

Under the DPDP Act, we process personal data only for the purposes described below (purpose limitation). We do not sell personal data.

2.1 Data you provide

2.2 Data collected automatically

MargAI warning: voice sessions are not a private channel. Do not share passwords, OTPs, Aadhaar, financial secrets, health records, or other sensitive personal data in MargAI. Content you share may be logged for the purposes above.

3. Consent and Lawful Processing

Where the DPDP Act requires consent, we obtain it in a free, specific, informed, unconditional, and unambiguous manner — for example when you create an account, enable a feature, or opt into Rewards. Consent is not obtained solely by agreeing to our Terms of Service.

We may also process personal data for legitimate uses recognised under the DPDP Act (for example, complying with law, detecting and preventing fraud or abuse, employment-related processing where applicable to our staff, and other uses expressly permitted by the Act), without treating those uses as consent-based where the Act so provides.

3.1 Withdrawing consent

You may withdraw consent as easily as you gave it, to the extent processing is based on consent. Ways to withdraw include:

• Closing your account or requesting erasure (see Section 6);
• Turning off optional features that rely on consent (where available in-product);
• Emailing hello@pascalblue.studio with the subject line “DPDP Withdraw Consent”.

Withdrawal does not affect processing already lawfully carried out. We may continue processing where another lawful ground under the DPDP Act applies (for example, legal compliance or fraud prevention), or where data has been anonymised so it is no longer personal data.

4. Sharing with Others (Including Data Processors)

We share personal data only as needed to run Marg, comply with law, or with your direction. Categories of recipients include:

• Public Contributions: tips, flows, votes, and your public display name / badge are visible by design on the Service.
• Data Processors / service providers who process data on our instructions, including (as used for Marg):
  • Clerk — authentication and account identity;
  • Supabase — database and related backend storage;
  • AWS Amplify / hosting & CDN providers — application hosting;
  • PostHog — product analytics (when telemetry capture is enabled);
  • Sentry — error monitoring;
  • Razorpay — payments for MargAI plans / boosters and related billing;
  • Google (including Gemini / Places-related services) — AI features, maps/places enrichment where configured;
  • Other infrastructure or AI tooling vendors engaged to deliver specific features (subject to contracts and purpose limits).
• Legal / safety: disclosure when required by law or to protect rights, safety, or integrity of the Service and users.
• Business transfers: if we merge, acquire, or sell assets, personal data may transfer subject to continuity of protection consistent with this Policy and applicable law.

5. Retention

We keep personal data only as long as needed for the purposes above, or as required by law. Illustrative periods:

• Account data: while your account is active, plus up to 90 days after deletion for backup/recovery (unless a longer legal hold applies).
• Contributions: may remain as community knowledge; we may anonymise attribution after account deletion where feasible.
• MargAI session logs: up to 180 days, then deleted by scheduled cleanup (unless needed longer for an active investigation or legal requirement).
• Redemption / financial records: typically at least 7 years for tax and audit compliance.
• Security / activity logs: retained as reasonably needed for breach detection and security (including periods consistent with DPDP Rules requirements for logs), then deleted or aggregated.
• Telemetry: up to about 12 months in identifiable form, then aggregated or deleted where practicable.

6. Your Rights under the DPDP Act

As a Data Principal, you may:

• Right to access — request a summary of personal data we process about you and the processing activities;
• Right to correction and erasure — request correction of inaccurate or incomplete personal data, and erasure of personal data that is no longer necessary for the stated purpose (subject to legal retention and legitimate uses);
• Right to data portability — where applicable under the Act and technically feasible, request your personal data in a commonly used machine-readable format;
• Right to withdraw consent — as described in Section 3.1;
• Right of grievance redressal — raise a complaint with our Grievance Officer (Section 7);
• Right to nominate — nominate another individual to exercise your rights in the event of your death or incapacity, in the manner prescribed under the DPDP Act / Rules (contact us to register a nomination).

To exercise these rights, email hello@pascalblue.studio with subject “DPDP Data Principal Request”, and include enough detail for us to verify your identity and locate your data. We aim to respond within the timelines prescribed under the DPDP Rules (including the applicable outer limit for fulfilling requests).

7. Grievance Redressal

If you have a concern about how we process your personal data, contact our Grievance Officer:

We will acknowledge grievances and endeavour to resolve them within 90 days (or such shorter period as the DPDP Rules may require for particular request types). If you are not satisfied after exhausting this process, you may escalate to the Data Protection Board of India as provided under the DPDP Act.

8. Security Safeguards

We implement reasonable security safeguards appropriate to the nature of the data and risks involved, including:

• Encryption in transit (TLS/HTTPS);
• Access controls and least-privilege practices for internal systems;
• Encryption or restricted handling for sensitive fields (e.g. payment-related identifiers, legal name where stored);
• Logging and monitoring aimed at detecting misuse or incidents;
• Vendor contracts and operational controls for processors.

No method of transmission or storage is perfectly secure. If a personal data breach occurs that is notifiable under the DPDP Act / Rules, we will notify affected Data Principals and the Data Protection Board as required (including without delay to affected individuals where mandated, and within prescribed Board reporting timelines).

9. Children's Data

Marg is intended for users who are 18 years of age or older. We do not knowingly offer the Service to children. We do not knowingly process personal data of a child (under 18) without verifiable consent of a parent or lawful guardian as required by the DPDP Act. If you believe a child has provided us personal data, contact us and we will take steps to delete it promptly where required.

10. Cross-Border Transfers

Your personal data may be processed in India and in other countries where our processors operate (for example, cloud, authentication, AI, analytics, or payment infrastructure). Under the DPDP Act, transfers outside India are permitted except to countries or territories restricted by the Central Government. We will not transfer personal data to a restricted country or territory in violation of such directions, and we use contractual and operational safeguards with processors.

11. Cookies and Similar Technologies

• Essential: authentication, session security, load balancing — required for the Service to function.
• Preferences: language, theme, onboarding acknowledgements.
• Analytics: product usage metrics when telemetry is enabled for the environment (not used for third-party advertising).

You can control cookies through your browser. Blocking essential cookies may prevent sign-in or core features from working. We do not use third-party advertising cookies.

12. Changes to This Notice

We may update this Privacy Policy to reflect product, legal, or operational changes. Material changes will be communicated through in-app notice, email, and/or an updated effective date on this page. Where required by the DPDP Act, we will provide a fresh notice and obtain fresh consent before processing for a new purpose that needs consent.

13. Contact (Data Fiduciary)

Related documents: Terms of Service · Rewards Programme Terms. This Policy is intended to meet DPDP notice expectations; it is not legal advice to users.