Who we are
DesiData ("we", "us") is an open catalogue of India-focused datasets, available at www.desidata.in. For the purposes of the Digital Personal Data Protection Act, 2023 ("DPDP Act"), DesiData is the Data Fiduciary responsible for the personal data described in this policy.
This policy explains what personal data we collect, why we collect it, what we never do with it, and how you can exercise your rights under the DPDP Act.
What we collect
We keep data collection to the minimum the service needs:
- When you sign in with Google: your name, email address and profile picture, provided by Google and stored in our database. If you post in the Weekly Bench discussion, the name on your profile and the comment you submit are shown publicly; your email address and profile picture are not shown with the comment. Signing in is needed for tracked downloads and community posting.
- When you (or your code) download a dataset: the dataset, time, access method, and a shortened technical user-agent string. Website downloads are linked to your signed-in account. Python and API downloads require a DD token linked to your account; we store the token's hash, not its usable value. Catalogue browsing and previews remain public.
- When you post a Weekly Bench comment or suggestion: the comment text, the display name on your profile, and the time it was posted. Anyone can read these comments, including people who are not signed in.
- Technical logs from our hosting providers (such as request IPs and timestamps), processed by them for security and reliability.
- We do not run advertising or analytics trackers, and we do not build behavioural profiles of visitors.
What we never do
- We never sell or rent your personal data.
- We never use your data for targeted advertising.
- We never share your data with third parties for their own marketing.
- We do not send marketing email — the only email you might get from us is a reply to something you asked us.
Why we process it, and on what basis
We process personal data to operate the service you asked for: creating your account when you sign in, serving your downloads, showing download counters, keeping the platform secure, and hosting the public Weekly Bench discussion you choose to join. Under the DPDP Act we rely on your consent (given when you sign in) for account-linked processing, and on the limited legitimate uses the Act permits for purposes such as network and information security.
Download counts shown publicly on the site are aggregates. Your profile shows your own account-linked download history; operators can view attributed download records to run the service and maintain usage counts.
Cookies and local storage
We use only one strictly necessary cookie: your sign-in session, which keeps you logged in and cannot be read by scripts. We use no advertising cookies, no cross-site trackers and no fingerprinting. If you never sign in, no cookie identifying you is set.
Who we share it with
We use a small set of service providers to run DesiData. They process personal data only on our instructions:
- Google — you sign in with your Google account; your password never reaches us.
- Supabase — our database, sign-in and file storage backend.
- Vercel — our website hosting and content delivery network.
How long we keep it
- Account data (name, email, profile picture): kept while your account exists, deleted when you ask us to.
- Legacy anonymous API download logs: kept for up to 12 months, then deleted or aggregated. New API downloads require a DD token and are linked to the account.
- Account-linked download history and DD token records (including revocation status): kept while your account exists, deleted with it on request.
- Community comments: kept until you delete a comment, your account is deleted, or an administrator removes it. Comments are public while they remain on the site.
Your rights under the DPDP Act
You can exercise any of these rights by writing to hello@desidata.in — we act on verified requests within 30 days:
- Access a summary of the personal data we hold about you and the way we process it.
- Correction, completion or updating of your personal data.
- Erasure of your personal data (deleting your account and its records).
- Withdraw consent at any time — withdrawing consent does not affect processing already done.
- Nominate another individual to exercise your rights if you are unable to.
- Raise a grievance with our Grievance Officer (below), and escalate to the Data Protection Board of India if unresolved.
Children
DesiData welcomes students, but under the DPDP Act we must not process the data of a child (under 18 years) without verifiable consent of a parent or lawful guardian. By signing in you declare you are 18 or older, or that such consent exists. If you believe a child's account was created without consent, write to us and we will delete it.
How we protect it
- All traffic is encrypted in transit (HTTPS).
- Database access is locked down with row-level security; admin rights are separate and audited.
- Download links are short-lived. DD tokens are shown once, stored as one-way hashes, and can be revoked from your profile.
- Only the operators of DesiData can access personal data, and only to run the service.
Grievance Officer
Per the DPDP Act, our Grievance Officer is the first point of contact for any concern about your personal data:
Grievance Officer, DesiData — hello@desidata.in
We acknowledge every grievance and respond within 30 days. You may also escalate to the Data Protection Board of India established under the Act.
Changes to this policy
If we change how we handle personal data, we will update this page and the date below. If a change is significant and affects signed-in users, we will also notify them by email.