Introduction
This policy explains what personal data Midan Digital collects, why we collect it, and what we do with it. It applies to everyone who uses our Services — our platforms, applications, tools, and anything else available under the Midān brand.
Midan Digital is a sole proprietorship based in Hyderabad, Telangana, India. Under the Digital Personal Data Protection Act, 2023 (DPDPA), we are the Data Fiduciary — the entity that decides why and how personal data is processed. You, as the person whose data we hold, are the Data Principal.
Your data is yours. We're just looking after it. We collect only what we need to run and improve the Services. We don't sell data. We're not an advertising business. That's not a policy position — it's just how we operate.
What Data We Collect
We collect data in three ways: information you give us directly, information generated by your use of the Services, and — in limited cases — information from third-party tools we use to keep things running.
- Account information — Name, email address, and any profile details you provide when creating an account or contacting us.
- Usage data — How you interact with our platforms: pages visited, features used, session duration, and similar behavioural signals. This helps us understand what's working and what isn't.
- Device & technical data — Browser type, operating system, IP address, and device identifiers collected automatically when you access our Services.
- Content you upload — Any files, data, or materials you submit through our platforms to use the Services ("Client Data"). This belongs to you — see Section 05.
- Communications — If you email us or submit a support request, we retain that correspondence to resolve your query and improve our support.
We don't collect sensitive personal data (such as financial details, health records, or government ID numbers) unless a specific Service explicitly requires it and you've been informed in advance.
How We Use Your Data
We use the data we collect to run the Services, keep them secure, and make them better over time. Specifically:
- Providing, maintaining, and improving our platforms and tools;
- Managing your account and responding to your requests or queries;
- Sending transactional communications — account notices, billing updates, security alerts;
- Analysing usage patterns to inform product decisions (using aggregated or de-identified data wherever possible);
- Complying with legal obligations applicable to us as a business operating in India.
We don't use your data to build advertising profiles, sell to third parties, or train AI models without your explicit consent.
Legal Basis for Processing
Under the DPDPA, we process your personal data on the following grounds:
- Consent — Where you've actively agreed to a particular use, such as receiving product updates or marketing communications. You can withdraw this consent at any time.
- Contractual necessity — Processing required to deliver the Services you've signed up for — account management, billing, and core functionality.
- Legitimate interests — Security monitoring, fraud prevention, and product analytics, where these don't override your rights.
- Legal obligation — Where applicable law requires us to retain or disclose certain information.
Where we rely on consent, you always have the right to withdraw it. Withdrawing consent won't affect processing that took place before withdrawal.
Data Sharing
We don't sell, rent, or trade your personal data. We share it only in the following circumstances:
- Service providers — We work with third-party vendors (hosting, analytics, payment processing, email delivery) who access data only to perform services on our behalf, under contractual obligations to protect it.
- Legal requirements — We may disclose data if required by law, court order, or a competent authority, or to protect the safety and rights of our users.
- Business transfers — If Midan Digital is involved in a merger, acquisition, or transfer of assets, your data may be part of that transaction. We'll notify you before your data is transferred and becomes subject to a different privacy policy.
When data is shared with service providers, we take appropriate steps to ensure they handle it responsibly. We don't authorise them to use your data for their own purposes.
Data Retention
We keep your data for as long as your account is active and for a reasonable period afterwards — long enough to meet legal obligations, resolve disputes, and maintain business records.
- Account data — Retained for the duration of your relationship with us, plus a reasonable period to comply with legal requirements after closure.
- Client Data — Available for export for 30 days after account termination, then permanently deleted within a further 60 days.
- Usage and analytics data — Retained in aggregated or anonymised form for product research; identifiable data is deleted or anonymised within 12 months of collection.
- Communications — Support and email correspondence retained for up to 3 years to maintain context and service quality.
Once data is no longer needed and no legal obligation requires us to keep it, we delete or irreversibly anonymise it.
Your Rights
Under the DPDPA, you have the following rights as a Data Principal. These aren't bureaucratic formalities — you can exercise any of them by emailing us at hellomidan@gmail.com.
- Access — Request a summary of the personal data we hold about you and how it's being used.
- Correction — Ask us to correct inaccurate or incomplete data.
- Erasure — Request deletion of your personal data, subject to legal obligations that may require us to retain certain records.
- Withdraw consent — Opt out of any processing based on consent, at any time, without affecting prior processing.
- Nominate a representative — Under the DPDPA, you may nominate another individual to exercise your data rights on your behalf in specified circumstances, such as incapacity.
- Grievance redressal — Raise a complaint with us first. If we don't resolve it to your satisfaction, you may escalate to the Data Protection Board of India, once operational.
We'll respond to rights requests within a reasonable timeframe — typically within 30 days. We won't charge a fee for standard requests. If a request is unusually complex or frequent, we'll let you know before taking any action.
Cookies & Tracking
We use a minimal set of cookies to keep the Services working and to understand how they're being used. We don't use advertising cookies or build tracking profiles for third-party ad networks.
- Essential cookies — Required for login, session management, and core functionality. These can't be switched off without breaking the Services.
- Analytics cookies — Used to measure traffic patterns and feature usage in aggregate. This helps us make product decisions. No personally identifiable data is shared with analytics providers for their own use.
We don't currently operate a cookie preference dashboard. If you'd like to limit cookie use, your browser settings give you control — though disabling essential cookies will affect how the Services function. We'll update this section if our cookie practices change meaningfully.
Changes to This Policy
We may update this policy as our Services evolve or as legal requirements change. When we make material changes, we'll let you know — by email or via an in-product notice — before the changes take effect. The "Effective" date at the top of the page will always reflect the latest version.
If something changes in how we handle your data, we'll tell you before it happens. Continued use of our Services after that date means you accept the updated policy.
Contact
Questions about this policy, your data, or how to exercise your rights? Reach out, and we'll read every message ourselves.
This policy was last reviewed and updated on 5 June 2026. It does not constitute legal advice — if you need guidance specific to your situation, we recommend speaking with a qualified legal professional.