Privacy Policy

The Clean Sheet™ ("we", "us", "our") operates the website thecleansheet.in and related services. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website or use our services, including the Ask Clean AI analyser. Please read this carefully.

This policy is compliant with India's Digital Personal Data Protection Act, 2023 (DPDPA), the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and is aligned with the EU General Data Protection Regulation (GDPR) where applicable.

1. Information We Collect

We may collect the following categories of personal data:

• Usage Data: IP address, browser type, pages visited, time spent, referring URLs, and device identifiers, collected automatically via server logs and analytics.
• Query Data: Product names, ingredient lists, or questions you submit to the Ask Clean analyser. These are processed to generate responses and are not stored long-term.
• Communication Data: Name, email address, and message content when you contact us via email or forms.
• Brand/Business Data: Company name, contact details, and product information submitted by brands applying for certification.

We do not knowingly collect data from children under the age of 18.

2. How We Use Your Information

• To operate, maintain, and improve the website and Ask Clean analyser
• To respond to enquiries, support requests, and certification applications
• To analyse usage patterns and improve user experience
• To send transactional communications (e.g. application confirmations)
• To comply with legal obligations under Indian law
• To detect and prevent fraud, abuse, or security incidents

We process your data on the legal bases of legitimate interests, contract performance, and legal compliance. Where required by law, we will seek your consent.

3. Data Sharing and Disclosure

We do not sell, rent, or trade your personal data. We may share data with:

• Service Providers: Hosting, analytics, email, and AI infrastructure providers who process data on our behalf under data processing agreements.
• Legal Authorities: When required by Indian law, court order, or to protect our legal rights.
• Business Transfers: In the event of a merger, acquisition, or sale of assets, with appropriate notice.

Any third-party processors are contractually bound to process data only on our instructions.

4. Cookies and Tracking

We use essential cookies necessary for the website to function. We may use analytics cookies (e.g. Google Analytics) to understand traffic patterns. You may disable cookies through your browser settings, though this may affect functionality.

5. Data Retention

We retain personal data only for as long as necessary for the purpose it was collected, or as required by applicable law. Query data submitted to the Ask Clean analyser is not retained beyond the session. Contact and application data is retained for up to 3 years or as required for certification records.

6. Data Security

We implement reasonable technical and organisational measures to protect your data against unauthorised access, loss, or disclosure, in accordance with the IT (SPDI) Rules 2011. However, no transmission over the internet is 100% secure.

7. Your Rights

Depending on applicable law, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Request erasure of your data (right to be forgotten)
• Withdraw consent at any time (where processing is consent-based)
• Lodge a complaint with the Data Protection Board of India (under DPDPA 2023)

To exercise your rights, contact us at hello@thecleansheet.in.

8. International Data Transfers

Our AI infrastructure may involve processing on servers outside India. Where data is transferred internationally, we ensure appropriate safeguards are in place consistent with DPDPA 2023 and applicable cross-border data transfer requirements.

9. Third-Party Links

Our website may link to external sites (e.g. Nykaa, Amazon). We are not responsible for the privacy practices of those sites. Please review their privacy policies independently.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified via a notice on our website. Continued use of the website after changes constitutes acceptance.

11. Contact: Data Grievance Officer

For any privacy-related queries or grievances (as required under DPDPA 2023 and IT Rules 2011):