| What we collect | Identity and contact details, professional background, booking and payment records, and basic device and usage data. |
|---|---|
| Why | To verify people, connect members with experts, run sessions, take payments, keep Shrut safe and meet legal duties. |
| Who sees it | The person you book with sees what the session needs. Service providers process data on our instructions. Nobody else. |
| Do we sell it? | No. We do not sell personal data or share it with advertisers. |
| Do we record sessions? | No. Nobody else may record either, without everyone’s consent. |
| Your controls | See it, correct it, erase it, withdraw consent, name a nominee, and complain. |
01Who we are
Summary
Shrut Private Limited runs the platform and decides why and how your data is used. In law, that makes us the “Data Fiduciary”.
Shrut Private Limited (“Shrut”, “we”, “us”), a company incorporated under the Companies Act, 2013 with CIN U63122HR2026PTC149761 and its registered office at WeWork Forum, DLF Cyber City, DLF Phase 3, Sector 24, Gurugram, Haryana 122002, is the Data Fiduciary for personal data processed through shrut.io, the member and expert dashboards, Field Notes by Shrut and Matiman by Shrut events (together, the “Platform”).
You can reach our privacy team at privacy@shrut.io. Our Grievance Officer’s details are in Grievances and complaints.
02Personal data we collect
Summary
What you give us, what we create when you use Shrut, and a small amount collected automatically. We do not ask for anything we do not need.
| Category | Examples | Where it comes from |
|---|---|---|
| Identity and contact | Name, email, mobile number, city, photo (optional) | You |
| Account and security | OTP verification records, sign-in times, device identifiers | You, and automatically |
| Professional profile | Employer, title, career history, expertise, LinkedIn link, education | You, and public sources for expert vetting |
| Verification | Identity and employment confirmation for experts | You, and verification checks we run |
| Bookings and sessions | Slot, topic, the brief you write, session status, ratings and feedback | You |
| Payments and tax | Transaction ID, amount, billing details, GSTIN, and for experts PAN and bank account for payouts | You, and our payment partner |
| Communications | Support messages, email and SMS delivery status | You, and our messaging providers |
| Device and usage | IP address, browser, pages visited, cookie choices | Automatically |
| Events | Matiman registration and attendance | You |
We do not ask for passwords, card or UPI details (our payment partner handles those), or information about your health, and we ask you not to include such details, or anyone else’s personal data, in session briefs.
03Why we use your data
Summary
Each use has a stated purpose. Optional ones, like newsletters and analytics, are separate choices you can say no to.
| Purpose | Data used | Basis |
|---|---|---|
| Create and secure your account | Identity, contact, account and security | Your consent |
| Vet and verify experts | Professional profile, verification | Your consent |
| Match you with an expert and run the booking | Identity, professional profile, bookings and sessions | Your consent |
| Take payments, issue invoices, pay experts | Payments and tax, identity | Your consent, and legal obligations |
| Send service messages: confirmations, reminders, receipts | Contact, bookings | Your consent, given when you use the service |
| Support, disputes and complaints | Communications, booking and payment records | Your consent, and legal obligations |
| Keep the Platform safe and prevent misuse | Account, device and usage, bookings | Your consent |
| Send Field Notes, Matiman updates and offers | Contact | A separate, optional consent |
| Understand and improve the Platform | Device and usage | Your cookie choice |
| Meet legal and regulatory duties | As the law requires | Legal obligation |
We use your data only for the purposes above. If we need it for a new purpose, we will ask you first.
04Consent, and how to withdraw it
Summary
You choose, clearly. Saying no to optional things never blocks the core service. Withdrawing is as easy as agreeing.
We ask for consent through a clear, affirmative action and keep optional purposes, such as marketing and analytics, separate from what the service needs to work.
You can withdraw consent at any time from your account privacy settings or by writing to privacy@shrut.io. Withdrawal does not affect processing already done. If you withdraw consent that a feature needs, for example your contact details for booking, we may not be able to provide that feature.
When you withdraw consent, we stop the related processing and erase the data unless the law requires us to keep it.
You may ask for this notice in English or in any language listed in the Eighth Schedule to the Constitution of India.
06Sessions and recordings
Summary
We do not record your conversations. Please do not record them either unless everyone agrees.
Shrut does not record the audio or video of sessions.
Notes and messages you write on the Platform, such as session briefs and follow-up notes, are stored in your account and are visible to the participants of that booking.
Our video provider carries the session media to deliver it and may keep connection data such as timestamps and duration. Recording by participants is governed by our Terms of Service.
07Transfers outside India
Summary
Some providers may handle data outside India. That is allowed unless the Government of India restricts the country, and we protect it by contract.
We store personal data primarily in [AWS region, e.g. Mumbai]. Some providers, for example those delivering SMS to numbers outside India, may process data in other countries.
We transfer personal data outside India only to countries that the Central Government has not restricted under the Digital Personal Data Protection Act, 2023, and we require providers to protect it.
08How long we keep your data
Summary
Only as long as we need it. Tax and company law make us keep some records for years. Everything else is erased.
| Data | Kept for |
|---|---|
| Account and profile | While your account is active, and [30 days] after you close it |
| Booking, invoice and payment records | Up to eight years, as tax and company law require |
| Expert verification records | While the expert is on Shrut and [3 years] after |
| Support conversations | [3 years] after the matter closes |
| Security and access logs | At least one year, as the DPDP Rules require |
| Marketing preferences | Until you withdraw consent, then a suppression record so we do not contact you again |
When a retention period ends, we erase the data or anonymise it so it can no longer identify you.
09Security
Summary
We use sensible, modern safeguards. No system is perfectly secure, so we also plan for things going wrong.
We use reasonable security safeguards, including encryption in transit and at rest, role-based access with the least privilege needed, multi-factor authentication on staff and cloud accounts, activity logging, vendor checks and an incident response process.
No method of transmission or storage is completely secure. Please keep your sign-in details private and tell us immediately if you suspect misuse of your account.
10Your rights
Summary
You can see your data, fix it, erase it, take back your consent, name someone to act for you, and complain. Write to privacy@shrut.io.
| Right | What it means |
|---|---|
| Access | A summary of the personal data we process about you, what we do with it, and who we have shared it with. |
| Correction and completion | We correct inaccurate data and complete what is missing. |
| Erasure | We erase your data when you ask, unless the law requires us to keep it. |
| Withdraw consent | At any time, as easily as you gave it. |
| Grievance redressal | A route to raise a concern with us and get a response. |
| Nominate | Name someone to exercise your rights if you die or become unable to. |
Write to privacy@shrut.io from the email address on your account. We may ask you to verify your identity. We acknowledge requests within 48 hours and respond within 30 days.
The Act also asks you to give only authentic information, not to impersonate anyone, and not to file false or frivolous complaints.
11Children
Summary
Shrut is for adults only. If we find an account belonging to someone under 18, we close it and erase the data.
The Platform is meant for people who are 18 or older. We do not knowingly collect personal data of children. If we learn that we have, we will erase it and close the account.
12Data breaches
Summary
If your data is exposed, we tell you and the regulator, and we say what happened and what to do.
If a personal data breach affects you, we will inform you and the Data Protection Board of India as the law requires, describing what happened, the likely impact, what we are doing about it, and what you can do.
14Grievances and complaints
Summary
Tell our Grievance Officer first. If we do not sort it out, you can complain to the Data Protection Board of India.
Email: grievance@shrut.io.
We acknowledge complaints within 48 hours and resolve them within 30 days. If you are not satisfied, you may complain to the Data Protection Board of India in the manner it prescribes. The Act asks you to use our grievance process first.
15Changes to this policy
Summary
If we change how we use your data in a way that matters, we tell you before it applies.
We will update this policy when our practices or the law change. For material changes we will notify you by email or in your dashboard before they take effect, and ask for fresh consent where the law requires it.
| Version | Date | What changed |
|---|---|---|
| 1.0 | 15 October 2026 | First publication |