Legal

Data Protection

Last updated: June 9, 2026 · Compliant with India's Digital Personal Data Protection Act, 2023

Rockshaft Media takes the protection of your data seriously. This page details the technical and organisational measures we apply to keep your data secure.

Technical Safeguards

Encryption at Rest

All third-party access tokens (Meta, WhatsApp) are encrypted using AES-256-CBC with a 32-byte key before being stored in our database.

Encryption in Transit

All data transmitted between your browser and ConvoSurge servers uses TLS 1.2 or higher (HTTPS). HTTP requests are automatically redirected to HTTPS.

Authentication

Short-lived JWT access tokens (15 minutes) with refresh token rotation. Optional two-factor authentication (TOTP) available for all accounts.

Rate Limiting & Anomaly Detection

All API endpoints are rate-limited. Our anomaly detection system monitors for unusual access patterns and blocks suspicious requests automatically.

Infrastructure

Hosted on Hostinger Cloud with CloudLinux CageFS isolation. Database managed by Supabase with row-level access controls.

Organisational Measures

Access to production data is restricted to authorised personnel only.
No raw access tokens or passwords are ever logged.
Third-party subprocessors are vetted for security compliance.
Security incidents are investigated and affected users notified within 72 hours.

Your Rights Under DPDP Act 2023

Right to Access: Request a copy of your personal data.
Right to Correction: Request correction of inaccurate data.
Right to Erasure: Request deletion of your data.
Right to Grievance Redressal: Contact our Data Protection contact below.

Data Protection Contact

For data protection queries or to exercise your rights, contact: business@rockshaft.org

We will acknowledge your request within 48 hours and respond within 30 days.