Privacy policy

TDACorp Identity is operated by TDACorp Private Limited, a company incorporated in India on 17 July 2026. It is the shared sign-in, session, token and access-control service that TDACorp products use. TDACorp Private Limited decides why and how the personal data described on this page is processed, so for this platform it is the party responsible for that data. Where an organization invites you to an account, that organization has its own reasons for the invitation, and this page says so in the sections on lawful basis and organizations.

This notice covers your account, sessions and credentials on TDACorp Identity, and the same data processed on behalf of any TDACorp product that uses this platform to sign you in and enforce your permissions. It describes data the platform itself holds.

The table lists every category of personal data the platform holds, what it is used for, where it sits, how long it stays and who else receives it. "Recipients" means parties beyond the operator: infrastructure vendors are named on the subprocessor page, and applications you sign in to receive only the claims in the scopes they request, and third-party applications only with your consent.

We do not use your data for advertising or behavioural profiling. The platform stores two notification preferences, product updates and marketing email (marketing off by default); nothing in the platform sends product-update or marketing email today, and the preferences are stored, shown on your notifications page and included in your export.

TDACorp Private Limited is an Indian company, and its own processing of your data is governed by Indian law, including the Digital Personal Data Protection Act, 2023. The repository documents the following basis for each way an account comes to exist; it documents no other.

The repository's specification also names obligations such as reporting of cyber incidents to the national CERT within 6 hours and to the Data Protection Board within 72 hours for the classes it lists, and honouring erasure on withdrawal of consent. It tracks the phased dates of the 2025 rules as targets and does not treat their enforcement dates as a trigger. This page does not otherwise assert how any statute applies to TDACorp.

Three infrastructure vendors are involved in running this platform: hosting, the primary database and transactional email. The subprocessor page is the single place to check them.

A disclosure to a third-party application you sign in to follows your consent, which you can review and revoke on the Connected apps page. Not on this list on purpose: cloud key management, a storage vendor, social sign-in vendors, analytics and advertising. This list changes when any of them is added.

The platform specification places the primary database in India. The database provider has no Indian region, so for the pre-production period the owner has waived that placement, to be revisited before launch. The primary database is therefore not in India. The function runs in Vercel region iad1 (US East, N. Virginia) and the database is in Neon on AWS US East 1 (N. Virginia). This page makes no claim about where a vendor's staff or backups sit. Anchors of the audit chain, which contain only hashes, may be stored abroad according to the specification; none is published to an outside location in the committed configuration.

Every cookie set by the platform is strictly part of signing you in or protecting the sign-in. There are no tracking, advertising or analytics cookies, and no analytics or third-party script is loaded. All cookies on the identity host carry the __Host- prefix, so they are Secure, have path / and have no Domain attribute, and all are HttpOnly with SameSite=Lax. The separate administrative console sets two cookies of its own, listed in the last rows.

SameSite=Lax is one layer of this platform's protection against cross-site request forgery; the other is a same-origin check on every request that changes state. Removing a device from your account page stops the account recognising its device cookie. The platform does not use local storage or session storage to hold personal data as part of its sign-in; clearing browser storage does not affect your account.

The table gives the retention of each kind of record as the code enforces it. Background jobs run from a daily scheduled job and from ordinary traffic on the current hosting plan, so a deletion can run up to about a day later than its nominal time.

What erasure removes and what it keeps

Deleting your account deactivates it at once: every session, token and personal access token is revoked and you cannot sign in again. Thirty days later a background job erases your personal data.

Erasure is not total, and this page states that rather than hiding it. Whether to change any of these retentions is an open owner decision.

You can see, correct, export and remove most of your data yourself, signed in. Each of these acts on the requester's own account only, which is why they require being signed in. If you cannot sign in, or need something these pages do not cover, email security@tdacorp.in; the response time for such a request is not promised here.

TDACorp Identity is not designed for children. No date of birth is collected, and the repository documents no age check and no parental consent flow. If you believe a child has registered, contact security@tdacorp.in. The platform specification tracks the children's-data provisions of the 2023 Act as not expected to apply to an enterprise identity service; that is a design note, not a legal conclusion.

The security practices page is the full account. In summary:

No system is unbreakable, and this page does not claim one is.

At the end of every sign-in a risk engine assesses the attempt and decides to allow it, to ask for a stronger factor, or to refuse it. It is a rule-based score, not a machine-learning model.

This policy is revised as the product changes, not on a fixed schedule. The date at the top of every trust page, "Last reviewed", is updated when the text is reconciled against the code, and the figures on the pages are pinned to the code by tests so they cannot silently drift. The repository states no commitment to notify you individually of a change, so none is made here.

Email security@tdacorp.in. The same address is published in the machine-readable security.txt file. No postal address, telephone number or named officer is stated here because none is recorded in the repository.

• This is not legal advice, and not a substitute for it.
• TDACorp holds no privacy or security certification (no SOC 2, no ISO 27001) and offers no uptime guarantee.
• The primary database is not in India during pre-production; the placement the specification calls for was waived by the owner for this period and is to be revisited before launch. The database is in AWS US East 1 (N. Virginia).
• It does not cover a product built on this platform beyond authentication and permissions: that product is responsible for its own data and its own notice.
• It does not cover tdacorp.in, whose privacy policy is a separate document.
• Erasure is not total: a past session's user-agent hash, the address an invitation was sent to, device rows and audit events keyed by an account identifier remain, as set out above. Whether to change that is an open owner decision.
• Audit records are currently retained without automatic pruning.
• Background jobs, including exports and erasure, can run up to about a day late on the current hosting plan.
• The retention of application logs held by the hosting provider is that provider's and can change with its plan; this page does not guarantee it.
• No data protection officer, grievance officer or Indian representative is named, no response time to a rights request is promised, and no complaint procedure is described.
• No statement is made that any particular statute does or does not apply beyond the documentation already in the repository.
• No transfer safeguard, standard contractual clause or adequacy finding is claimed for any vendor.
• The platform does not guarantee that a vendor on the subprocessor page handles your data as this page does; the vendors' own terms govern them.