Privacy Policy

Last updated: 3 November 2026

This policy explains what personal data Doondo ("we") collects, why, and the choices you have. It is written to meet India's Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000. Doondo is run by Pramodan Kokkodan, an individual based in Kannur District, Kerala, India.

What we collect

• Details you give us: name, business name, mobile number, email address and website link.
• Verification: a one-time code (OTP) sent to your phone. We store only a scrambled (hashed) form of the code, and it expires after 10 minutes.
• Payment: Razorpay processes all payments. We receive only the order and payment reference and the amount. We never see or store your card number, UPI PIN or bank login.
• Your consent choices: what you allowed (analysis, email reports, WhatsApp), with the date and time.
• Business data you allow us to analyse: your public website and, if you connect them, accounts such as Google Search Console, Google Business Profile, Google Ads, Meta and YouTube.
• Technical data: IP address and basic device information, used for security and to show the site in your language. We remember your language choice in a single cookie.

Why we use it

• To create and secure your account, and to verify your phone number.
• To take payment for your plan.
• To analyse your business online and send you the reports you asked for.
• To notify you on WhatsApp — only if you ticked that box.
• To prevent fraud and abuse.

We do not sell your personal data. We do not use your data to train public AI models.

Who processes it for us

We use trusted service providers, each only for its task: Netlify (hosting and data storage), Razorpay (payments), Meta (WhatsApp messages), Resend (email), Google (website speed checks) and Anthropic (writing reports with AI). They may process data outside India under contracts that require them to protect it.

How long we keep it

We keep account data while your plan is active, and for up to 12 months afterwards unless the law requires longer (for example, tax records for 8 years). One-time codes are deleted after use or expiry. Reports are kept for 24 months.

Your rights

You can ask to see, correct or delete your data, withdraw any consent, or nominate someone to act for you. Withdrawing consent is as easy as giving it: reply STOP to any message, or email pramkok@gmail.com. We respond within 30 days.

Security

All traffic uses HTTPS encryption. Access to systems is limited and protected with two-factor authentication. Codes are hashed, payment signatures are verified, and every request is checked on the server.

Grievance Officer

Pramodan Kokkodan, Grievance Officer · Email: pramkok@gmail.com · Kannur District, Kerala, India. We acknowledge complaints within 48 hours and resolve them within 30 days. You may also complain to the Data Protection Board of India.

Changes

If we change this policy in an important way, we will tell you by email or WhatsApp before the change takes effect.