Privacy policy

The short version

This page says what Daakiya collects, why, who else sees it, how long we keep it and how to get it deleted. It is plain on purpose, so you can read it.

• We collect what we need to run your account and to send form responses where you tell us to.
• We don’t sell personal data, and we don’t show ads.
• The answers people give your forms are yours. We handle them for you, and we don’t use them for anything of our own.
• You can delete responses, connections, members, your organization and your account in the dashboard.
• If anything is left after you close your account, email hello@daakiya.app and we’ll delete it. You don’t need an open account to ask.

Who we are

Daakiya is built and run by Puzzlers Labs Private Limited (“we”, “us”), CIN U58201UP2023PTC179875. This policy covers our website at daakiya.app, the dashboard at console.daakiya.app and the API that your forms send responses to. How you may use Daakiya is in our terms of service.

Write to us at hello@daakiya.app. That is the one address we use for privacy questions, account questions and everything else.

Your data and your respondents’ data

There are two kinds of personal data in Daakiya, and we have a different role for each.

• Your account, and how you use our site and dashboard. We decide why and how this is used, so we are responsible for it. In data protection terms we are the “controller”. Most of this policy is about this data.
• The responses people send through your forms. You decide what to ask and where it goes, so you are responsible for it. We process it for you, following the flows you set up. In data protection terms we are the “processor”.

If you collect personal data with Daakiya, you need your own privacy notice for the people who fill in your forms, and a good reason to ask for what you ask for. We can’t write that for you.

If you filled in a form that someone else made with Daakiya, that person decides what happens to your answers, so ask them first. If you can’t reach them, email hello@daakiya.app with the address of the form. We’ll pass your request on, and we’ll delete your answers if they tell us to or the law says we must.

What we collect

Your account

When you sign up and use the dashboard, we keep:

• your name, email address and password. The password is stored only as a one-way hash, never in plain text
• an optional profile photo, which is shown beside your name to the people in your organizations
• your language, time zone and light or dark choice, and where you are in the getting-started guide
• the organizations and teams you belong to, your role in each and the forms you pinned
• the details for two-step verification, if you turn it on: an authenticator secret, backup codes and the codes we email you

What you build

Your forms and their fields, the flows that send each response on, the pages you design and the settings you choose. We also keep your connections: the name of each one, and the sign-in or key that lets us send to Slack, email, Google Sheets or a webhook. Once you save a secret key or a webhook secret, the dashboard never shows it again.

Responses and who sent them

A response holds whatever your form asks for, so it can include names, email addresses and anything else you collect. For each response we also record when it arrived, how it was sent (a web page, the API or an embed) and the sender’s IP address and browser details.

Password fields are never stored. After the form checks one, the stored value is replaced by a placeholder.

What happened to each response

For each response we keep a timeline of the steps that ran: where each delivery went, whether it worked, how long it took and any error. We keep what the step was set to do and the destination’s answer. We don’t keep a second copy of the message we sent.

For each form we also keep a short request log: when each request arrived, the result, where it came from and a copy of what was sent, shortened if it is long, with passwords, keys, tokens and signatures masked. It is what tells you why a request was turned away.

Billing

Your plan, how much you used this month (responses, forms and members), your invoices and the email address invoices go to. Razorpay takes the payments. You type your card details into a form in the dashboard, and your browser sends them straight to Razorpay. They never go through our servers, and we never keep your card number. Razorpay tells us whether a payment worked, and handles payment data under Razorpay’s privacy policy (opens in a new tab).

When you write to us

Emails to hello@daakiya.app, and what is in them: your name and address, the account you tell us about and any details you choose to send. The form in our footer opens your email app and sends us your address. We use it to email you about what we ship, and you can ask us to stop at any time. The startup program works the same way: we use the account email and the address of the page that shows our badge to run it. We open that page when we check the badge, which is at least once in every term and may be at other times.

When you visit our website

If you accept, the website uses Microsoft Clarity to show us how people use it: which pages they visit, how far they scroll, where they click and move the mouse, what device and browser they use and roughly where they are. Clarity can also replay a visit as a recording. We use it to find pages that confuse people. We ask first, and if you reject, Clarity is not loaded and your browser sends nothing to Microsoft for it. We also tell Clarity that you have not agreed to advertising storage. Microsoft decides how it handles what Clarity collects, under Microsoft’s privacy statement (opens in a new tab). It says it keeps recordings for 30 days, and a selected few for up to 9 months.

Google hosts the site (Firebase Hosting). It handles each request to the site and may keep the technical logs that come with hosting, such as your IP address. Apart from Clarity, which loads only if you accept, your browser asks no other host for anything: the fonts and the search index come from our own site.

The dashboard

We use Microsoft Clarity in the dashboard too, only to improve Daakiya: which screens people use, and where they get stuck. It does not record what is on the screen, so the answers people send through your forms and the details in your account do not go to Clarity. We don’t ask a second time in the dashboard, because you agree to this policy when you create your account. We never share this data with advertisers and we never sell it. There is no advertising code in the dashboard.

How we use it

We use personal data to:

• run Daakiya: sign you in, show your forms and responses, and send each response to the places your flows name
• keep it safe, for example by limiting how many requests one address can make to a form, and by checking sign-ins
• bill you and send invoices
• email you about your account: verification and password reset, security codes, alerts you switched on and notices about the service
• answer your questions and fix problems
• learn how people use the site and the dashboard, so we can improve them
• meet our legal duties

We don’t use the answers your respondents give your forms for our own purposes. We don’t use them to market to anyone, to build profiles or to sell. We don’t sell personal data, and we don’t share it for advertising. The analytics we use are the ones we need to improve Daakiya, and nothing else.

Where the law asks us for a reason to use data, ours are these. We need your account and billing data to give you the service. Keeping a service safe, and understanding how our site is used, are legitimate interests that we balance against your rights. We email you updates because you asked us to, and you can take that back. Some records we keep because the law says we must.

Who we share it with

• The places you send it. When you connect Slack, email, Google Sheets or a webhook, the responses you choose to send go there, and we send only what your step includes. After that it is in their hands, under their privacy terms. Deleting a response from Daakiya does not delete the copy they hold.
• The people in your organization. Members see what their role allows. Your name, email address and photo are visible to the other people in your organizations.
• Companies that help us run Daakiya. They host our servers, send our email, take payments (Razorpay) and run our analytics on the site and in the dashboard (Microsoft Clarity). They may use the data only to do that job for us. If you want the current list, email hello@daakiya.app.
• When the law asks, or when someone has a reason we have checked. We may share data with a court or an authority if we have to. We may also share deleted data that we still hold, but only on a request where we have checked who is asking and why, for example because of a legal duty. We tell you first unless the law forbids it.
• If the business changes. If Daakiya is sold or merged, your data may move with it. We would tell you before it did.

Cookies and browser storage

Cookies are small files a site puts on your device. Browser storage does the same job without being sent to the server with every request. This is all we use.

Apart from Clarity’s, the dashboard sets no cookies. Your sign-in token is kept in browser storage. The one other thing that runs on a dashboard page is Razorpay’s payment script, which loads only when you open the card form to pay for a plan or change how you pay. It may set its own cookies, which Razorpay’s privacy policy (opens in a new tab) covers.

On the website we ask before Clarity loads, with a choice that is yours to change any time through Cookie settings in the footer. Reject, and Clarity is not loaded. Accept, and we tell Clarity that analytics storage is allowed and advertising storage is not. We remember your answer for 12 months, in your browser, and then ask again. Microsoft says some of the cookies in this table are used for advertising. We never use what Clarity collects for advertising.

You can also block Clarity, or clear what is stored, in your browser’s settings or with a tracking blocker. The site works the same without it.

How long we keep it

These are the periods that apply today.

When a period ends we delete the data from our live systems. Copies in backups are removed when those backups are replaced.

Deleting your data

In the dashboard

• A response, or many at once. In the inbox, after a confirmation. You can’t restore it afterwards.
• A connection. Disconnecting it wipes the sign-in or key we stored for it.
• A member. Remove someone from your organization or a team.
• An organization. You type its name to confirm. We delete its forms, responses, flows and connections. You can’t restore it, and we keep the deleted copy for 3 months before it is erased.
• Your account. In Settings, under Security, choose Delete account. You confirm with your email address and your password.
• A single form. The dashboard can’t delete one form on its own yet. Until it can, email hello@daakiya.app and we’ll delete the form and its responses.

What closing your account does

When you delete your account we remove your profile and photo, take you out of every organization and team you belong to and cancel the invitations you sent. An organization that only you belong to is deleted with you, as above. If you are the admin of an organization that has other people in it, we ask you to hand it over or delete it first, so that you don’t leave them without one. Things you made in an organization that carries on show as made by “Deleted user”.

Asking us to delete what is left

Some things can’t be deleted in the dashboard, and some are left after you close an account. You can ask us to delete them by email. You don’t need an open account to ask.

• Write to hello@daakiya.app. Use the address your account used, or tell us which address it was.
• Say what you want deleted: everything linked to your account, or something specific.
• We may ask you to confirm it’s you, for example by replying from the account’s address. That is so nobody can delete your data but you.
• We delete it from our live systems within 30 days, and tell you when it is done, including anything we kept and why. Data that was already deleted leaves our systems when its 3 months end.

What we may keep

Deleted responses and organizations stay with us for 3 months, closed to everyone, and are then erased. You can’t restore them. We won’t give a copy to anyone, you included, except on a request where we have checked who is asking and why, such as a court order, a regulator or a legal duty.

We keep what the law requires, such as invoices and accounting records. We may also keep what we need to settle a dispute or to protect the service from abuse, for as long as that need lasts.

We can’t delete data that has already left Daakiya for a place you connected, such as a Slack message or a row in a Google Sheet. Ask whoever owns that place.

Your rights

Wherever you live, you can ask us to:

• tell you what personal data we hold about you, and give you a copy
• correct what is wrong (you can edit your profile yourself in Settings)
• delete it, as described above
• limit how we use it, or stop using it for a purpose such as analytics
• send it to you in a form you can reuse (in the dashboard you can export responses as a CSV file)
• stop emailing you updates

To make any of these requests, email hello@daakiya.app. We don’t charge for handling a request. We may ask you to confirm it’s you first. The next section says how quickly we answer each kind of request.

If you live in the EEA or the UK and think we handled your data wrongly, you can complain to your data protection authority. We’d like the chance to put it right first.

If you live in California, we don’t sell your personal information or share it for cross-context advertising, and we won’t treat you worse for using these rights. You can ask what we collect, and ask us to correct or delete it, in the same way.

How quickly we respond

These are the times we hold ourselves to. “Working days” are Monday to Friday, leaving out public holidays where we are. The other times are calendar days.

If a request is complex, or we get many from you at once, we can take up to 60 more days. We tell you why within the first 30.

Security

We can’t promise that nothing will ever go wrong. This is what we do:

• Passwords are stored only as a one-way hash.
• The sign-ins and keys for your connections are stored encrypted. They can be saved but not read back, and the dashboard never shows them again.
• People in an organization can only do what their role allows.
• Our servers don’t write respondents’ answers, email addresses or IP addresses to our own application logs.
• The site and the dashboard are served over HTTPS.

If we learn that your data was exposed, we will tell you without undue delay, and tell the authorities where the law says we must. If you think something is wrong, email hello@daakiya.app straight away.

Data in other countries

Our servers and the companies we use may be in a different country from you. For example, Microsoft keeps Clarity data in its Azure cloud. Where the law requires safeguards for sending data abroad, we use them.

Children

Daakiya is for people who run forms for work or for a project. It isn’t meant for anyone under 16, and we don’t knowingly collect their data. If you think a child has given us data, email hello@daakiya.app and we’ll delete it.

Changes to this policy

We put changes on this page and update the date at the top. If a change affects how we use your data in a way you wouldn’t expect, we’ll email the owner of the account at least 14 days before it takes effect.

Contact us

Puzzlers Labs Private Limited, CIN U58201UP2023PTC179875, hello@daakiya.app. Putting “Privacy” in the subject helps us find your message.