1. Introduction
FullScan Technologies ("we", "us") operates DigitalScan.ai. This Privacy Policy explains how we collect, use, store, and protect personal data processed through our Platform, in compliance with the Digital Personal Data Protection Act, 2023 (DPDP Act) and applicable Indian laws.
2. Data We Collect
From Organizations (Tenants):
- Company name, admin name, email, phone number
- Billing information and usage data
- Login and access logs
From Candidates (via Organizations):
- PAN number, UAN number, Aadhaar (masked)
- Passport file number, mobile number
- Resume/CV data (employment history, education, skills)
- Verification results from government APIs
3. How We Use Data
- Verification Services: To query government databases and return verification results to the requesting organization.
- Report Generation: To produce PDF reports comparing resume claims against official records.
- Caching: To reduce redundant API calls and improve response times. Cached data is encrypted and expires per defined TTLs (7–30 days).
- Billing: To track API usage and charge organizations accordingly.
- Service Improvement: Aggregated, anonymized usage statistics to improve the Platform.
4. Data Security
- Encryption at Rest: All sensitive PII (PAN, Aadhaar, UAN, phone numbers) is encrypted using AES-256 (Fernet) before storage.
- Encryption in Transit: All communications use TLS 1.3.
- Access Control: Role-based access control (RBAC) ensures users only access data within their tenant.
- Multi-tenancy Isolation: Each organization's data is logically isolated at the database query level.
- Audit Logging: All data access and verification actions are logged for compliance.
5. Data Sharing
We do not sell or share personal data. Data is shared only with:
- Government APIs (via SurePass): To perform authorized verifications
- Cloud Infrastructure (AWS): For hosting (data remains in ap-south-1, Mumbai region)
- Legal Authorities: If required by law or court order
6. Data Retention
- Verification cache: 7–30 days (per API type)
- Generated reports: Retained until the tenant deletes them or account is terminated
- Audit logs: 2 years
- Account data: Until account deletion + 90 days
7. Candidate Rights (DPDP Act)
Candidates whose data is processed through the Platform have the right to:
- Access: Request a copy of their verification data
- Correction: Request correction of inaccurate data
- Erasure: Request deletion of their data
- Grievance Redressal: File a complaint regarding data handling
Candidate requests should be directed to the organization that initiated the verification. Organizations must forward data subject requests to us at privacy@digitalscan.ai.
8. Cookies & Analytics
We use Google Tag Manager for analytics and conversion tracking. No personal candidate data is shared with analytics providers. You can opt out of analytics tracking through your browser settings.
9. Changes to This Policy
We may update this Privacy Policy periodically. Material changes will be communicated via email to registered organization admins. Continued use of the Platform after changes constitutes acceptance.