Terms of Service

These Terms of Service (“Terms”) govern your organisation’s use of Sehmat. Sehmat is a consent management platform for the Digital Personal Data Protection Act, 2023 (the “Act”) and the Digital Personal Data Protection Rules, 2025 (the “Rules”). It is provided by Blue Pencil Strategies Private Limited (“Blue Pencil”, “we”, “us”), a company incorporated under the Companies Act, 2013, with its registered office at 5th Floor Vinay Bhavya Complex, 159A, CST Road, Kalina, Santacruz East, Mumbai 400098.

These Terms are an electronic record under the Information Technology Act, 2000. They do not need a physical or digital signature.

1. Who these Terms apply to

1.1 These Terms apply to the organisation that uses Sehmat (“you”, “Customer”) and to every person who signs in to Sehmat on your behalf (“User”).

1.2 The person who accepts these Terms confirms that they are authorised to bind the organisation.

1.3 We may also sign an order form or a written agreement with you (an “Agreement”). If the Agreement conflicts with these Terms, the Agreement prevails for the matters it covers.

1.4 Our Privacy Policy explains how we handle personal data, and our AI Use Policy explains the AI features. The list on our Service providers page is part of these Terms, and we change it only as section 7.1 of these Terms says.

2. Definitions

In these Terms:

• “Service” means the Sehmat platform, including the console, public consent pages, APIs, software development kits and related support.
• “Customer Data” means all data you or your Users put into the Service, or that the Service collects for you, including the personal data of your Data Principals.
• “Evidence” means the records the Service keeps to show what each person was shown and what they chose, such as notice versions, timestamps, channels, paper scans and audit log entries.
• Data Fiduciary, Data Principal, Data Processor and Board have the meanings given in section 2 of the Act.

3. Access by request and approval

3.1 Access to Sehmat is by request. You ask for access through the signup form and give the details it asks for, such as your organisation’s registration and tax details and how you plan to use Sehmat.

3.2 We review each request. We may ask for more information. We may approve or decline a request at our discretion and we need not give reasons.

3.3 You must give accurate information and keep it up to date.

3.4 We may offer a trial or pilot. Any trial is at our discretion, may be limited in time or features, and may be ended by us at any time. Section 15 applies to trial data.

4. Accounts, Users and roles

4.1 When we approve your request, we create an account for your organisation and invite your first administrator. Your administrators add and remove Users and give them roles.

4.2 Each User must be an individual aged 18 or over who is your employee, contractor or other authorised person. Accounts are personal. Users must not share sign-in details.

4.3 You are responsible for:

• choosing who has access and what role they have;
• removing access promptly when someone leaves or no longer needs it;
• keeping sign-in details secure, and turning on multi-factor sign-in where it suits your risk; and
• everything done through your account.

4.4 Tell us at once at contact@bluepencil.com if you suspect any unauthorised use of your account.

5. Your responsibilities as Data Fiduciary

5.1 For the personal data of your Data Principals, you are the Data Fiduciary. You decide what data to collect, for which purposes, on what lawful basis and for how long. Under section 8(1) of the Act, you remain responsible for complying with the Act and the Rules for processing done on your behalf.

5.2 Sehmat is a tool. It helps you collect, record and honour consent. Using it does not by itself make you compliant with the Act, the Rules or any other law. You remain responsible for, among other things:

• the content, accuracy and language of your notices and consent forms, including what the Act requires in sections 5 and 6 and Rule 3;
• choosing the right lawful basis for each purpose;
• setting retention periods and erasing data when the purpose ends or consent is withdrawn;
• answering rights requests and grievances from your Data Principals within the time the law sets;
• publishing the contact details of your Data Protection Officer or other contact person;
• deciding when to verify a parent or lawful guardian, and acting on the result;
• telling the Board and affected people about a personal data breach, as Rule 7 requires;
• any duties you have as a Significant Data Fiduciary, if you are notified as one; and
• any sector rules that apply to you.

5.3 You must have a lawful basis for any personal data you upload to the Service, including lists of people you plan to contact.

5.4 You are responsible for the instructions you give us through the Service’s settings and features. We will follow them.

5.5 We do not give legal advice. Templates, starter forms, examples and help text in the Service are general information. Have your own advisers review your notices and processes.

6. Acceptable use

6.1 You and your Users must not use the Service to:

• collect or process personal data without a lawful basis, or in a way that misleads people;
• send messages people have not agreed to receive, or that break telecom rules on commercial communications;
• impersonate any person or organisation;
• upload malware or content that is unlawful, abusive or infringes anyone’s rights;
• process data for tracking, behavioural monitoring or targeted advertising directed at children, which section 9(3) of the Act prohibits;
• probe, scan or test the Service’s security without our written permission;
• interfere with the Service, overload it, or get around its limits or controls;
• copy, reverse engineer or resell the Service, or use it to build a competing product; or
• break any law of India.

6.2 For SMS, you are responsible for any registration that telecom rules require, such as sender IDs and message templates. For WhatsApp, you must follow the provider’s business messaging terms.

6.3 We may remove content or block a message that we reasonably believe breaks this section.

7. How we process your data

7.1 For Customer Data that is personal data, we are your Data Processor. These Terms, together with any Agreement, are the contract that section 8(2) of the Act requires. Under it, we will:

• process Customer Data only on your documented instructions, given through the Service, these Terms or an Agreement, unless a law requires otherwise. If so, we will tell you unless the law forbids it;
• not sell Customer Data, not use it for our own purposes, and not share it with anyone you have not named or approved;
• make sure our staff and contractors who can access Customer Data are bound by confidentiality;
• take reasonable security safeguards, as described in section 8 of our Privacy Policy and in line with Rule 6;
• store Customer Data in India, in the AWS Mumbai region with backups in the AWS Hyderabad region, except as section 7 of our Privacy Policy states for WhatsApp and for providers you connect yourself;
• use only the sub-processors listed on our Service providers page, under contracts or terms that require them to protect the data, and tell you before we add or replace one;
• help you respond to rights requests and grievances. If a Data Principal contacts us directly about your data, we will pass the request to you;
• tell you without undue delay after we become aware of a personal data breach that affects Customer Data, and give you the information we have so that you can meet Rule 7; and
• at the end of the Service, return or erase Customer Data as section 15 sets out.

7.2 You may ask us for reasonable information to show that we meet this section. We will answer within a reasonable time. Any on-site audit needs an Agreement.

7.3 We may use technical data about how the Service runs, such as error rates and response times, to operate, secure and improve it. This data does not include the content of your consent records.

8. Evidence and retention

8.1 The Service keeps Evidence so that you can show what each person was shown and what they chose.

8.2 By default, Evidence is kept in write-once storage for 7 years, as proof of what each person was shown and chose. During that period, no one, including us, can change or delete it, even after an erasure request. Access to it is limited by role. Choose your retention settings with care. Once Evidence is stored, we cannot shorten its lock.

8.3 The audit log is tamper-evident. Each entry is linked to the one before it by a hash, so that any change can be detected.

9. AI features

9.1 Sehmat has two optional AI features for you:

• reading scanned or photographed paper consent sheets; and
• drafting translations of your forms into Indian languages.

We also use AI to brief our own reviewers on access requests, as our AI Use Policy explains.

9.2 The AI runs within India, on the provider listed on our Service providers page. We do not use your data to train AI models, and our provider does not use it to train its models.

9.3 AI can make mistakes. By default, a person on your team reviews each paper sheet the AI reads. If you turn on “Paper without review”, sheets that the AI reads cleanly and that the person signed themselves are recorded without review, and 1 in 20 of them is sampled for review by a person. You choose whether to turn this on, and you are responsible for that choice.

9.4 A person on your team must review and accept each draft translation before it is used. Accepted text is labelled as machine translated. You are responsible for the final text of your notices in every language.

9.5 Our AI Use Policy gives more detail.

10. Third-party services

10.1 Some features rely on third-party services, such as SMS and WhatsApp delivery and DigiLocker checks. These services are run by others and may change or fail. We are not responsible for their availability or their acts.

10.2 Meta’s WhatsApp Cloud API and DigiLocker checks are used only if you turn them on. If you do, you may need to accept the provider’s own terms.

11. Fees

11.1 Fees, billing periods and payment terms are set out in your Agreement. We do not publish prices.

11.2 Fees do not include taxes. You will pay GST and any other applicable taxes.

11.3 If you do not pay an undisputed amount on time, we may suspend the Service after giving you notice, as section 14 sets out.

12. Availability and changes to the Service

12.1 We aim to keep the Service available and working well. These Terms do not include a service level commitment. Any service levels will be set out in your Agreement.

12.2 We may need to take the Service down for maintenance or to deal with security issues. Where we can, we will plan this in advance and give notice.

12.3 We improve the Service over time. We may add, change or remove features. If we remove a feature you rely on in a way that materially reduces the Service, we will give you reasonable notice.

13. Confidentiality

13.1 Each party may receive information from the other that is marked confidential or that a reasonable person would treat as confidential (“Confidential Information”). Customer Data is your Confidential Information.

13.2 The receiving party will use Confidential Information only to perform under these Terms, protect it with at least reasonable care, and share it only with people who need it and are bound by similar duties.

13.3 This does not apply to information that is public through no fault of the receiving party, was already known to it, was lawfully received from someone else, or was developed independently.

13.4 A party may disclose Confidential Information where a law, court or authority requires it. Where allowed, it will first tell the other party.

14. Suspension and termination

14.1 We may suspend access, in whole or in part, if:

• you or your Users break section 6;
• an undisputed amount stays unpaid 15 days after we give notice;
• we reasonably believe there is a security risk to the Service or to others; or
• a law, court or authority requires it.

We will limit any suspension to what is needed, tell you why and restore access once the cause is fixed. While your account is suspended, people may not be able to see your organisation’s records on the My consents and My request pages, so you must handle their withdrawals, requests and grievances directly.

14.2 Either party may end these Terms as set out in the Agreement. If there is no Agreement, either party may end them by giving 30 days’ written notice.

14.3 Either party may end these Terms at once by written notice if the other party materially breaches them and does not fix the breach within 30 days of notice, or becomes insolvent.

15. Your data when the Service ends

15.1 You can export your Customer Data, including Evidence and the audit log, at any time while your account is active. Download this offboarding bundle before you ask us to close your account, because access ends when you ask.

15.2 When you ask us to close your account, or when these Terms end, we stop the Service for your organisation at once. No new consents are collected, your Users lose access, and the My consents and My request pages no longer show your organisation’s records. You remain the Data Fiduciary and must handle withdrawals, requests and grievances from your people directly.

15.3 If we end these Terms, we will give you at least 30 days’ notice to download your data first, unless a law, a court or a serious security risk requires faster action.

15.4 After a cooling-off period of 7 days, during which you may cancel a closure you asked for, we erase your Customer Data. Personal data in consent records is removed, and Evidence is made unreadable by destroying the encryption key that protects it. We keep a record that the erasure happened, with counts and dates but no personal data. Backups are overwritten in their normal cycle.

15.5 Evidence still within its write-once period cannot be deleted early by anyone. Where destroying the key is not possible for older files, they stay locked and unused until the period ends. We will tell you if this applies.

15.6 We may keep records about your account, invoices and our dealings with you as Indian law requires.

16. Intellectual property

16.1 We own the Service, its software, design and documentation, and all rights in them. These Terms do not transfer any of these to you.

16.2 While these Terms are in force, we give you a limited, non-exclusive, non-transferable right to use the Service for your own organisation’s purposes.

16.3 You own your Customer Data and your notice and form content. You give us the right to host, copy, process and display it only as needed to provide the Service.

16.4 If you send us ideas or feedback, we may use them without any duty to you.

17. Warranties and disclaimers

17.1 Each party confirms that it has the power to enter into these Terms.

17.2 We will provide the Service with reasonable skill and care.

17.3 Apart from this section, the Service is provided “as is” and “as available”. To the extent the law allows, we make no other promises, express or implied, including that the Service will be error-free or uninterrupted, or that using it will make you compliant with any law.

18. Limitation of liability

18.1 Neither party is liable for indirect, incidental, special, consequential or punitive loss, or for loss of profit, revenue, goodwill or business opportunity, even if it was told such loss was possible.

18.2 Each party’s total liability for all claims under or in connection with these Terms is limited to the fees you paid or owe us for the Service in the 12 months before the event that gave rise to the claim. If you paid no fees, the limit is ₹10,000.

18.3 Sections 18.1 and 18.2 do not limit:

• your duty to pay fees;
• your obligations under section 19;
• liability for fraud, gross negligence or wilful misconduct;
• liability for death or personal injury caused by negligence; or
• any liability that Indian law, including the Act, does not allow to be limited.

18.4 Penalties imposed by the Board on a Data Fiduciary for its own obligations remain with that Data Fiduciary.

19. Indemnity

19.1 You will defend and indemnify Blue Pencil, its directors, staff and contractors against third-party claims, penalties and reasonable costs arising from:

• Customer Data, notices or forms that you provide or that are collected on your instructions;
• your processing of personal data without a lawful basis; or
• your or your Users’ breach of section 6.

19.2 We will tell you promptly of any claim, let you control its defence, and give you reasonable help at your cost. You will not settle a claim in a way that admits fault on our part without our written consent.

20. Governing law and disputes

20.1 These Terms are governed by the laws of India.

20.2 If a dispute arises, the parties will first try to settle it in good faith. If it is not settled within 30 days of one party notifying the other, it will be referred to arbitration by a sole arbitrator under the Arbitration and Conciliation Act, 1996. The arbitrator will be appointed by agreement or, failing agreement within 30 days, under that Act. The seat and venue will be Mumbai and the language English. The award will be final and binding.

20.3 Subject to section 20.2, the courts at Mumbai have exclusive jurisdiction.

20.4 Nothing in this section stops a Data Principal from using their rights under the Act, including complaining to the Board.

21. Notices

21.1 We will send notices to the email address of your account administrator or the contact named in your Agreement.

21.2 Send notices to us at contact@bluepencil.com and, for legal notices, also in writing to Blue Pencil Strategies Private Limited, 5th Floor Vinay Bhavya Complex, 159A, CST Road, Kalina, Santacruz East, Mumbai 400098.

21.3 An email notice is received when sent, unless the sender receives a delivery failure.

22. Changes to these Terms

22.1 We may update these Terms. We will post the new version here with a new date.

22.2 For changes that materially affect your rights or obligations, we will give you at least 15 days’ notice by email or in the console. If you do not agree, you may end these Terms before the change takes effect.

22.3 We may make changes at once where a law requires it or to protect the security of the Service. We will tell you as soon as we can.

22.4 Changes apply from the date they take effect. They do not affect disputes that arose before that date.

23. General

23.1 Force majeure. Neither party is liable for delay or failure caused by events beyond its reasonable control, such as natural disasters, war, civil unrest, epidemics, failures of public utilities or networks, or acts of government. Payment duties are not excused. If the event lasts more than 30 days, either party may end the affected Service by notice.

23.2 Assignment. You may not transfer these Terms without our written consent, which we will not unreasonably withhold. We may transfer them to a group company or to a buyer of our business, and will tell you if we do.

23.3 Independent parties. Nothing in these Terms creates a partnership, agency, joint venture or employment relationship.

23.4 Severability. If any part of these Terms is held invalid, the rest stays in force. The invalid part will be replaced by a valid term that comes closest to its intent.

23.5 Waiver. A failure or delay in enforcing a right is not a waiver of it.

23.6 Entire agreement. These Terms, the documents named in section 1.4 and any Agreement are the whole agreement between the parties about the Service.

23.7 Survival. Sections that by their nature should continue after these Terms end will do so, including sections 7, 8, 13, 15, 16, 18, 19 and 20.

24. Contact

For questions about these Terms, email contact@bluepencil.com. For complaints about how we handle personal data, see our Grievance Redressal page.