Privacy Policy

TrustIndex India operates an online directory where consumers read and publish reviews of businesses in India. For the personal data described below we are the Data Fiduciary — we decide why and how it is processed. You are the Data Principal.

Contact for all privacy matters: hello@trustindexindia.com · +91 89680 27027

• Account data — name, email address, password (stored only as a hash), profile photo, and any two-factor authentication settings you enable.
• Content you publish — reviews, ratings, photos, replies and reports. This is public by design and is shown with your display name.
• Business data — if you register a listing: business name, address, contact details, category, opening hours, logo and any verification documents you upload.
• Technical data — IP address, device and browser information, and session cookies needed to keep you signed in and to detect fake or duplicate reviews.
• Communications — emails you send us, including grievances and takedown requests.

We do not ask for financial account details, government identifiers or biometric data, and you should not post them in a review.

We process personal data only for the purposes below. Where the DPDP Act requires consent, you give it when you create an account, publish content or register a business; where the Act permits processing as a “certain legitimate use” (§7) — for example responding to your own request, or complying with a law — we rely on that.

• Creating and securing your account, and signing you in.
• Publishing your reviews, ratings, photos and replies on the platform.
• Verifying that a review is genuine and that a business listing is real, including fraud and spam checks.
• Sending service email — verification, password reset, review status, replies to your review.
• Handling grievances, takedown requests and legal notices.
• Producing aggregate statistics (for example a category’s average rating) that do not identify you.

We do not sell your personal data, and we do not use it for automated decisions that produce legal effects on you.

Consent is asked for in clear terms, is limited to the purposes listed above, and can be withdrawn at any time — from your profile or by writing to us. Withdrawing is as easy as giving.

Withdrawal does not make earlier lawful processing unlawful, and we may still keep data the law requires us to keep. If you withdraw consent for account processing, we close the account and stop processing except where retention is legally required.

• Right to information and access (§11) — a summary of the personal data we process about you, what we do with it, and who we have shared it with.
• Right to correction and erasure (§12) — correct inaccurate data, complete incomplete data, update it, or have it erased where we are no longer required to keep it.
• Right to grievance redressal (§13) — a readily available route to complain to us, described in section 12 below.
• Right to nominate (§14) — nominate another person to exercise these rights on your behalf in the event of your death or incapacity.

Use your profile settings for the routine cases (edit profile, delete a review, delete your account), or write to hello@trustindexindia.com · +91 89680 27027 for anything else. We respond within the timelines in section 12.

The DPDP Act also places duties on you: do not impersonate anyone while providing personal data, do not suppress material information, do not register a false or frivolous grievance or complaint, and provide only authentic information when exercising the right to correction or erasure. Breaching these duties is punishable under the Act.

• The public — your display name, profile photo and the content you publish. Your email address is never shown publicly.
• The business you reviewed — so it can post a public reply. It sees only what is already public.
• Data Processors — hosting, email delivery and error monitoring providers acting on our instructions under contract, and only for the purposes above.
• Authorities — where disclosure is required by law, court order, or a lawful request from an agency authorised under the IT Act.

We keep personal data only as long as the purpose it was collected for needs it, or as long as a law requires. When you delete your account we erase your account data and instruct our processors to do the same; published reviews are either deleted or retained without your identity where they are needed for the integrity of a business’s rating. Logs kept for fraud prevention and legal compliance are retained for the period the law prescribes.

We use reasonable security safeguards to prevent a personal data breach: passwords stored as salted hashes, optional two-factor authentication, encrypted transport (HTTPS), role-based access to admin tools, and audit logging of administrative actions. No system is perfect — if a breach occurs we will notify the Data Protection Board of India and every affected Data Principal, as required by §8(6) of the DPDP Act.

The platform is not intended for anyone under 18. We do not knowingly process a child’s personal data without verifiable consent of a parent or lawful guardian, and we do not undertake tracking, behavioural monitoring or targeted advertising directed at children (§9 of the DPDP Act). If you believe a child has created an account, tell us and we will remove it.

Cookies fall into four groups. Only the first is set without asking, because the service cannot run without it; the other three stay off until you switch them on.

• Strictly necessary (always on) — Keeps you signed in, protects forms against cross-site request forgery, and remembers this consent choice. The site cannot work without them. Session, CSRF token, ti_consent.
• Preferences — Remembers the small choices you make — the email you last signed in with, recent searches — so you do not set them again on every visit. Remembered email (ti:last-email).
• Analytics — Counts of which pages and categories get used, plus anonymised recordings of how people move through the site — where they scroll, what they click, where a page confuses them. Used to decide what to improve, never to identify you personally. Google Analytics (_ga, _ga_*), Microsoft Clarity (_clck, _clsk).
• Marketing — Measures whether a campaign brought you here, and lets us show relevant ads elsewhere. Off unless you turn it on. Google Ads (_gcl_*), Meta Pixel (_fbp, _fbc).

Your choice is stored in a cookie named ti_consent, along with the date you made it. If you allow any category it is kept for 6 months; if you refuse everything it is kept for 24 hours, after which the banner asks once more. A refusal is honoured in full for as long as it lasts — no tag loads and nothing is stored — and refusing again is a single click. Change or withdraw your choice at any time — Cookie preferences — and we delete the third-party cookies that the categories you switched off had already set. You can also clear or block cookies in the browser itself, but then you will not be able to stay signed in.

Data is hosted in India. Where a processor stores or handles data outside India, the transfer is made only to countries not restricted by the Central Government under §16 of the DPDP Act, and under contractual safeguards.

Write to our Grievance Officer: hello@trustindexindia.com · +91 89680 27027. We acknowledge within 24 hours and resolve within 15 days, as required by the IT Rules, 2021. Full details are on the Grievance Redressal page.

If we do not respond, or you are not satisfied with the outcome, you may complain to the Data Protection Board of India under §13(3) of the DPDP Act.

We may update this notice. Material changes are announced on the platform, and the “last updated” date above always reflects the version in force. Where a change needs fresh consent, we will ask for it before processing on the new basis.