What Zaksha records about your devices, and who can see it

What we record

• For each device you enrol: the website names it looks up, whether each was allowed or blocked, and the minute it happened.
• The device details you enter, such as its name and platform.
• The name and email of each person you add to the console.

That line is the whole record. We never see the page itself, what was typed on it or what was read.

Where it is kept

• In India, on Amazon Web Services (AWS) in Mumbai. Device activity is not stored outside India.
• The database is encrypted on disk and cannot be reached from the internet.
• Connections are encrypted: the console uses HTTPS, and devices send their lookups over encrypted DNS (DNS over TLS or HTTPS).

How long we keep it

• Device activity is kept for 30 days by default, then deleted automatically. We clear out expired records every hour.
• Your contract can set a longer period, up to a year.
• When you remove a device from the console, its activity is deleted with it.
• Backups are kept for 7 days, in the same Mumbai region.

Who can see it

• You choose who in your organisation can see activity, and each person's role.
• No other customer. Every request is checked against your organisation's account, so one organisation cannot see another's devices.
• Zaksha's support team, from our admin console. When a support person signs in to your console, we record who it was, when, and for how long. A support sign-in lasts at most 8 hours unless extended, and never beyond 24.

What Zaksha does not do

• No screenshots, and no recording of keystrokes.
• No reading of page content, messages or chats.
• We do not sell your data, or anyone's.
• No advertising or profiling from children's data.

Deleting your data

• On request, or when your contract ends, email support@zaksha.com. We delete your account with its devices, settings, activity records and the console logins that belong only to your organisation.
• Any leftover activity is removed within 24 hours, and the last copies in backups expire within 7 days.

Your organisation's part

• Under India's Digital Personal Data Protection Act, 2023, your organisation is the data fiduciary: it decides how its devices are used and gets any consent that is needed, such as from parents or guardians for a school.
• Zaksha processes the data only on your organisation's behalf, under a data processing agreement.
• Tell the people who use your devices that they are filtered and that site lookups are recorded.