01 Who we are
Zaksha is a managed, DNS-based content-filtering service for families, businesses and schools in India. It is operated by Zaksha ("Zaksha", "we", "us" or "our").
This Privacy Policy applies to the Zaksha website at zaksha.com, the Zaksha dashboard and the filtering service (together, the "Service"). For the personal data we handle to provide the Service, Zaksha acts as a Data Fiduciary under the DPDP Act. Where an organisation (such as a business or school) sets up Zaksha for devices it owns and manages, that organisation determines the purposes of processing for its users and is responsible for obtaining the necessary consents; Zaksha processes that data on the terms of this policy and the customer's agreement.
By creating an account or using the Service, you agree to the practices described here.
02 What we collect
We collect only what we need to run the Service, bill you correctly and show you a useful dashboard. We do not sell your personal data, and we do not build advertising profiles.
DNS query data is generated by the devices enrolled on your account, not by browsing you do elsewhere, and is tied to the device identifiers set up in Zaksha. Dashboard statistics are computed in periodic batches (roughly every 30 minutes), not in real time. The agent app itself does not read or store the DNS queries it makes — those are processed by the Zaksha resolver as described above, in the same way as any other enrolled device.
03 How we use it
- To create and secure your account and authenticate you when you sign in.
- To deliver the core Service — applying the blocking that is on by default (see "The Service" in our Terms) and the filtering rules and schedules you configure to your enrolled devices.
- To show your dashboard, including activity history and, for business and school accounts, per-device and per-employee reports.
- To decide how hostnames should be categorised, using the hostname list described under Data retention, which has no account, device or person attached. An AI model suggests categories for hostnames we do not yet recognise, and our team reviews the suggestions; none is used until the team approves it.
- To process payments, manage subscriptions and send essential account or billing notices.
- To maintain security, prevent abuse, debug issues and improve the reliability of the Service.
- To comply with legal obligations and enforce our terms.
We process personal data on the lawful bases available under the DPDP Act — principally your consent, and the legitimate uses the Act permits (such as performing the Service you have requested and meeting legal obligations).
04 Who can see device activity
We want to be plain about this, because it matters: the account owner can see per-device browsing detail for the devices on their account — the domains requested and whether each was allowed or blocked. For business accounts, the account owner can also see per-employee activity reports for company-owned devices.
This is authorised visibility granted to the account owner over devices they manage — for example, a parent over a child's device, or a business over a company-owned device. It is not anonymised or masked data, and we do not describe it as such. Account owners are responsible for using this visibility lawfully and for informing the people who use those devices, as required.
05 Organisations
When a school, college or company uses Zaksha on devices it owns, that organisation is the data fiduciary under the DPDP Act: it decides which devices are enrolled and what is filtered, it tells the people who use those devices, and it obtains any consent that is needed. Zaksha processes that data only on the organisation's behalf, under a data processing agreement with it.
The organisation chooses who can see activity: only the people it adds to its console, each with the role it gives them. Zaksha's support team can sign in to an organisation's console to help it, and every such sign-in is recorded. Our security page sets out what we record, where it is kept and for how long.
06 Data retention
We keep information only as long as it serves the purpose it was collected for. For DNS query data:
- Home (shared cloud), including the free trial: raw DNS query history is kept for a rolling 7 days by default. Every hour, we delete history older than that.
- Organisations (business plans), including the free trial: DNS query history is kept for 30 days by default. An organisation's contract can set a longer period, up to one year. The organisation's owner or an admin can shorten it, to no less than 7 days. Every hour, we delete history older than the window in effect.
- Changing the window: a longer window extends retention from the date of change and fills in over the following days. It does not recover history that has already been deleted. A shorter window deletes the older history within the hour, and it cannot be recovered.
- Clearing activity: on a paid business plan, the organisation's owner or an admin can clear all of its activity data at once, including the daily totals below.
- Daily totals: for every account, we also keep a count for each day, device and app in our app list of how many lookups were allowed and how many were blocked. Lookups to sites outside that list are counted together, without their names. Daily totals are kept while your account is open and deleted with it. Your dashboard shows them only within your history window.
- Hostname list: separately from your history, we keep a list of every hostname any device on Zaksha looks up (such as www.example.com), with the first and last day it was seen, how many times it was looked up and blocked, and, for each app in our app list, a count of the minutes in which that app was in use on a device that looked up the hostname. The list holds only these counts; it has no account, device or person attached. We use it to decide how hostnames should be categorised, with the help of an AI model whose suggestions our team reviews and approves. It is kept indefinitely: it is not deleted when history expires, when activity is cleared or when an account is closed. A hostname on its own can sometimes name a person or household, such as a home server's address.
- Backups: deleted history can remain in our database backups for up to 7 days, until those backups expire.
- Enquiries from the business enquiry form are kept for as long as we are discussing or providing the service to your organisation, and deleted on request.
- Account, device and billing data is retained while your account is active and for a limited period afterward to meet legal, tax and accounting obligations.
When you close your account, we delete or irreversibly anonymise your personal data except where we are required to retain it by law. The hostname list above has no link to your account, so closing your account does not remove hostnames from it.
07 Where your data is processed
Your data is processed on Zaksha's managed cloud, for Home and business plans alike. Where an organisation's contract provides for it, its data can instead be held on a dedicated instance used only by that organisation. In both cases, DNS activity data linked to your account (your history and daily totals) is processed and stored entirely within India — in our production environment in the AWS Mumbai region — and is not transferred outside it. The account-free hostnames sent for AI categorisation (see Sharing below) are processed outside India. On the shared cloud, per-device isolation is logical — each device has its own DNS address and client identifier. On a dedicated instance, isolation is physical — the customer's data lives on a separate server. We do not claim that we never store data; we store what is described in this policy, for the periods stated, on the infrastructure described here.
10 Children's data
Family and school use of Zaksha necessarily involves processing the browsing activity of minors on the devices being protected. Under the DPDP Act, processing children's personal data carries heightened obligations, including obtaining verifiable consent of a parent or lawful guardian and a prohibition on tracking, behavioural monitoring or targeted advertising directed at children.
- Family accounts. The account is created and operated by a parent or guardian, who provides consent for the processing of their child's device activity for the purpose of filtering and the safety controls they configure.
- School accounts. The school is responsible, as the entity in the relationship with parents and guardians, for obtaining the consent required to process students' data, and for the lawful basis on which it manages student devices. Zaksha processes that data on the school's behalf under its agreement.
- We do not use children's data for advertising, profiling or any tracking beyond delivering the filtering and reporting features the account owner has configured. The only exception is the hostname list described under Data retention, which our team uses, with the help of an AI model, to decide which app or category a hostname belongs to: it keeps the hostname and counts, with nothing that links a hostname back to an account or device. The list records nothing about who looked a hostname up.
11 Your rights under the DPDP Act
Subject to the DPDP Act and its conditions, you have the right to:
- Access — obtain a summary of the personal data we process about you and how we process it.
- Correction & updating — have inaccurate or incomplete data corrected or completed.
- Erasure — have your personal data erased where it is no longer needed for the purpose it was collected, subject to legal retention.
- Withdraw consent — withdraw consent at any time, as easily as it was given (this may limit or end the Service).
- Grievance redressal — raise a grievance with us and, if unresolved, with the Data Protection Board of India.
- Nominate — nominate another person to exercise your rights in the event of death or incapacity.
You can manage much of your account and device data directly from the dashboard. To make a rights request, contact us at support@zaksha.com. We will respond within the timelines required by applicable law.
12 Security & breach notification
We protect your information with encryption in transit, access controls that limit who can reach data, per-device isolation so accounts and histories don't mix, and routine monitoring for abuse. An organisation can ask for a dedicated instance under its contract. No method of transmission or storage is completely secure, but we work to protect your data and to respond quickly if something goes wrong. In the event of a personal data breach, we intend to notify the Data Protection Board of India and affected users as required by the DPDP Act and its Rules.
13 Grievance redressal
If you have a concern about how we handle your personal data, you can contact our Grievance Officer, who is responsible for addressing complaints under the DPDP Act:
If your grievance is not resolved to your satisfaction, you may escalate it to the Data Protection Board of India in accordance with the DPDP Act.
14 Changes to this policy
We may update this policy as the Service evolves or as the law changes. When we make material changes, we will revise the effective date above and, where appropriate, notify you by email or in the dashboard. Your continued use of the Service after an update means you accept the revised policy.
15 Contact us
For any question about this policy or how we handle your data, get in touch: