DPDP Compliance

How Sacchi approaches the DPDP Act, 2023

Sacchi processes personal data (name, phone number, order details, and voice-note content) as a Data Processor on behalf of the Shopify brand, who is the Data Fiduciary under India's Digital Personal Data Protection Act.

Consent

• Sending a review-request WhatsApp message relies on the consent a customer already gave the brand at checkout (an existing customer relationship).
• Any use of a review beyond display on the brand's own product page — for example, pooled/aggregate use across brands — requires a separate, explicit "marketing_consent" flag, stored per review, defaulting to off.
• Every consent grant or withdrawal is written to an append-only audit log (kind, source, timestamp) — never overwritten, never silently changed.

Opt-out

Replying STOP (or an equivalent keyword) at any point immediately halts further messages and is logged as a withdrawal of consent — no further action required from the customer.

Data minimisation

We only ask for what's needed to produce a verified review: the voice note or text itself, the order it's tied to, and the phone number to reach you on. We don't request unrelated personal data.

Grievance contact

For any DPDP-related request (access, correction, erasure, grievance), reach us at the email in the footer — we aim to acknowledge within a reasonable period, in line with the Act.