We believe in complete transparency. Here is exactly how your personal, financial, and family data is collected, encrypted, and protected under Indian law.
Effective: September 2026
Governing Law: DPDP Act 2023 (India)
Grievance Officer: Dasari G.
Response Time: Within 30 Days
Legal Compliance Transparency: All clauses below are drafted in strict accordance with the Digital Personal Data Protection Act 2023 (DPDP Rules 2025). Marked for internal legal review.
01
Who We Are (Data Fiduciary)
SmartWill Digital Technologies India (operating as "SmartWill India", "we", "us", or "our") acts as the Data Fiduciary under the Digital Personal Data Protection Act 2023 (DPDP Act).
As a Data Fiduciary, SmartWill India determines the purpose and means of processing personal data collected from individuals ("Data Principals") who use our software platform to create legal testamentary documents.
Registered Operations Address: SmartWill Digital Technologies India, Financial District, Gachibowli, Hyderabad, Telangana 500032, India. Official Support Email:smartwillindia.help@gmail.com
02
Personal Data We Collect
To generate a legally enforceable Will under Section 63 of the Indian Succession Act 1925, our platform collects itemized categories of information directly from you:
Category
Specific Data Points
Legal Purpose
Identity Data
Full Legal Name, Date of Birth, Gender, Religion / Personal Law
Testator identification and applying applicable succession law (Hindu Succession Act, Indian Succession Act, etc.).
Government ID
ID Type (PAN Card, Voter ID, Passport, Aadhaar) + Last 4 Digits only
Establishing statutory identity. We deliberately never ask for or store full 12-digit Aadhaar numbers.
Contact Info
Mobile Number, Email Address
Account verification, transactional receipts, and secure PDF delivery via email.
Mandatory statutory testator domicile recital in the Will document.
Financial Assets
Bank Name & A/C Last 4 Digits, Fixed Deposits, Property addresses, Mutual Funds, Stocks, Gold/Jewelry, Vehicles
Asset schedule formulation required to bequeath and distribute estates legally.
Beneficiaries
Full Names, Relationships, Contact numbers, Govt ID digits, Minor Guardian names
Identifying heirs and appointing legal trustees for minor beneficiaries under the Guardian & Wards Act 1890.
Will Executor
Executor Full Legal Name, Relationship to Testator
Designating the trusted person responsible for distributing the estate according to your wishes.
Transaction Data
Order ID, Amount (₹299), Payment timestamp, Cashfree reference
Fulfilling your purchase order and maintaining statutory accounting records.
03
How and Where We Store Your Data
We protect your legal and financial information using modern client-side and cloud encryption protocols:
Storage Location
Data Stored
Encryption & Protection
Your Local Browser (Device Only)
In-progress Will draft, selected language, session recovery ID
AES-GCM 256-bit Client Encryption via native Web Crypto API. Key derived via PBKDF2. Protects against casual inspection on shared or family computers.
Google Firestore (Encrypted Cloud)
Authenticated user draft, sync state, referral balance
Protected by TLS 1.3 in transit, Google AES-256 at rest, and Firebase Security Rules allowing access strictly to the authenticated owner.
Cashfree Payments
Customer name, email, phone, order amount
PCI-DSS Level 1 certified gateway. SmartWill never sees or stores card numbers, CVVs, or UPI PINs.
04
Legal Basis for Processing (Consent)
Under Section 4 and Section 6 of the DPDP Act 2023, personal data is processed strictly on the basis of your free, specific, informed, unconditional, and unambiguous consent.
Affirmative Action: You provide explicit consent by checking the unticked DPDP consent box on Step 1 of the Will builder.
In-Memory Gating: No data is persisted to encrypted browser storage or cloud servers until this affirmative consent is given.
Right of Withdrawal: You may withdraw your consent at any time by deleting your account or emailing our Grievance Officer.
05
Third-Party Data Processors
SmartWill India engages trusted third-party service providers bound by strict confidentiality and data protection obligations:
Zero Marketing Sale Guarantee: SmartWill India will never sell, lease, rent, or trade your personal or financial data to insurance brokers, banks, advertising networks, or third parties.
06
Data Retention Schedules
Local Draft Data: Encrypted browser draft data auto-expires after 24 hours of inactivity or is wiped immediately upon clicking "Clear Data" or deleting your account.
Cloud Account & Will Draft: Retained in encrypted form for the life of your account until you initiate an account deletion request.
Financial Payment Records: Retained for 7 years to comply with mandatory Indian tax and financial audit regulations.
Analytics Telemetry: Retained for 14 months per Google Analytics standard retention policies (applicable only after explicit consent).
07
Your Rights under DPDP Act 2023
As a Data Principal under Sections 11, 12, and 13 of the DPDP Act 2023, you hold full legal rights over your personal data:
Right to Access
You have the right to obtain a full summary of personal data held about you. Click "Download My Data (JSON)" in your dashboard or email us.
Right to Correction
You can review and modify any personal, asset, or family information at any time directly through the interactive Will wizard.
Right to Erasure
You have the "Right to be Forgotten". Click "Delete My Account & Data" to permanently purge your local and cloud records.
Right to Withdraw
You may withdraw your consent at any time without penalty. Future processing stops immediately upon withdrawal.
Right to Nominate
You have the right to nominate another individual who shall exercise your data rights in the event of death or incapacity.
Right to Redressal
You have the right to have grievances addressed within 30 days, with the right to escalate to the Data Protection Board of India.
08
Browser Storage & Cookies
We do not use tracking cookies. We only use browser storage strictly necessary to operate the application:
Storage Key
Classification
Purpose
smartwill_draft
Essential
Holds AES-GCM encrypted Will draft to prevent work loss on page refresh.
sw_dpdp_consent
Essential
Stores audit timestamp proving that DPDP consent was granted.
smartwill_device_id
Essential
Device identifier used in client encryption key derivation.
smartwill_lang
Preference
Remembers your chosen language (English / Telugu / Hindi).
sw_analytics_consent
Optional
Stores whether you accepted or declined optional Google Analytics.
09
Technical & Operational Security
Transport Encryption: 100% of website traffic is enforced over TLS 1.3 HTTPS with HSTS preloading.
Client-Side Scrambling: Unencrypted plain text is never committed to localStorage; Web Crypto AES-GCM 256-bit prevents casual inspection.
Least Privilege Cloud Access: Firestore Security Rules enforce strict UID matching, preventing any user from accessing another user's Will documents.
No Payment Storage: We adhere to PCI-DSS standards; card numbers and UPI PINs never touch SmartWill servers.
10
Minors Policy
Under Section 9 of the DPDP Act 2023, we do not knowingly process personal data of individuals under 18 years of age as account holders. To create a Will in India under the Indian Succession Act 1925, the testator must be a major of sound mind. If a minor beneficiary is named in a Will, an adult guardian must be designated.
11
Updates to This Policy
We may update this Privacy Policy from time to time to maintain compliance with notifications issued by the Data Protection Board of India. The date of the latest update will always be noted at the top of this document. Continued usage after notification constitutes acceptance.
12
Grievance Redressal Mechanism
In compliance with Section 13 of the DPDP Act 2023, SmartWill India has designated a dedicated Grievance Officer:
🛡️ Grievance Officer Contact Details
Name: Dasari G.
Designation: Grievance Officer, SmartWill Digital Technologies India
Statutory Resolution Timeline: Within 30 calendar days of receipt.
If your grievance is not resolved to your satisfaction within 30 days, you have the statutory right under Section 13(3) of the DPDP Act 2023 to register a complaint with the Data Protection Board of India.
