Privacy Policy & Data Protection Charter
Last Updated & Effective: September 12, 2026 • Published by COSQ Network Private Limited
Data Fiduciary Notice & Identification (Section 4 & 5 DPDP Act)
Under the Digital Personal Data Protection (DPDP) Act, 2023, COSQ Network Private Limited serves as the Data Fiduciary determining the purpose and means of personal data processing for the Codque platform. You, the registered user or enterprise account holder, represent the Data Principal.
1Lawful Grounds for Processing (Section 4, 6 & 7 DPDP Act)
Codque processes your digital personal data strictly in accordance with lawful provisions:
- Explicit Consent (Section 6): Through affirmative action during registration and API key generation, you provide free, specific, informed, unconditional, and unambiguous consent to processing your personal and account data for specified platform functionalities.
- Right to Withdraw Consent (Section 6(4)): You may withdraw your consent at any time through your workspace console settings or by contacting our Data Protection Officer. Withdrawal takes effect prospectively and does not impact prior lawful processing.
- Legitimate Uses (Section 7): Processing strictly required for billing, statutory compliance under Indian tax laws (GST, Income Tax Act), CERT-In security reporting, or responding to orders from courts of competent jurisdiction.
2Categories of Data Collected & Processing Scope
Identity & Account
Full name, corporate email address, contact telephone number, organization affiliation, and multi-factor authentication credentials required to provision role-based platform access.
Billing & Tax Compliance
Billing entity name, registered GSTIN, state/tax jurisdiction code, and masked transaction tokens. All payment instrument processing is handled via RBI-tokenized Cashfree infrastructure (no raw card data stored).
System Logs & Telemetry
HTTP request metadata, API call latencies, client IP addresses, user-agent strings, and token usage counts preserved in compliance with CERT-In Directions under Section 70B(6) of the IT Act.
3Enterprise AI Inference & Zero Model Training Guarantee
Absolute Codebase Privacy & Non-Retention Standard:
Codque is engineered specifically for software development teams and organizations requiring absolute confidentiality over their proprietary source code, protected under Section 14 of the Copyright Act, 1957.
- No Retail API Sharing: We do not route payloads to consumer retail accounts of foundation model providers.
- No Foundation Model Training: Your code repositories, AST tokens, prompts, and completion diffs are strictly prohibited from being used to train, fine-tune, distill, or evaluate any artificial intelligence or machine learning models.
- Ephemeral In-Memory Proxy: Gateway proxies stream tokens directly between your authenticated client and isolated enterprise inference nodes without persisting prompt bodies to disk.
4Statutory Rights of the Data Principal (DPDP Act Chapter III)
As a Data Principal under the DPDP Act, 2023, you are endowed with enforceable statutory rights:
5Duties of Data Principals (Section 15 DPDP Act)
The DPDP Act, 2023 prescribes reciprocal duties for Data Principals:
- You must comply with all applicable provisions of the DPDP Act and relevant Indian statutes;
- You must not impersonate another person while providing your personal data;
- You must not suppress any material information while providing your personal data for any document or service;
- You must not register a false, vexatious, or frivolous grievance or complaint with Codque or the Data Protection Board of India.
6Reasonable Security Practices & Data Breach Reporting
In compliance with Section 43A of the Information Technology Act, 2000 and Section 8(5) of the DPDP Act, 2023, Codque implements comprehensive administrative, physical, and technical safeguards:
- Transport Layer Security (TLS 1.3) with HSTS for all network transmissions;
- AES-256 encryption at rest for database records and encrypted environment configurations;
- Strict Role-Based Access Control (RBAC) and least-privilege administrative access;
- Zero storage of raw cardholder payment data on platform servers (PCI-DSS compliant partner integration).
7Cross-Border Data Transfers & Children's Privacy
Cross-Border Transfers (Section 16 DPDP Act): Personal data may be processed across distributed cloud data centers, provided the destination country is not explicitly restricted by notification of the Central Government of India under Section 16 of the DPDP Act.
Protection of Children (Section 9 DPDP Act): Codque is designed exclusively for enterprise developers and professional teams aged 18 and above. We do not knowingly collect, process, or engage in tracking, behavioral monitoring, or targeted advertising directed at individuals below the age of 18.
8Data Retention & Erasure Policy
We retain personal data only for as long as necessary to fulfill the purpose for which it was processed, or as mandated by Indian law:
| Data Category | Retention Period | Statutory Purpose |
|---|---|---|
| Account Credentials & Profile | Duration of active subscription + 30 days upon deletion | Service provisioning & account recovery |
| Tax Invoices & Transaction Ledgers | 8 Years following financial year | Companies Act 2013 & GST Statutory Mandate |
| Firewall & Access Security Logs | 180 Days minimum | CERT-In Cyber Security Directions (Section 70B) |
| Prompt & Code AST Payloads | Ephemeral (0 days persistent storage) | Real-time inference proxy only |
9Data Protection Officer (DPO) & Grievance Redressal
In accordance with the DPDP Act, 2023 and the Information Technology Rules, 2021, any inquiries, requests to exercise Data Principal rights, or data grievances may be submitted directly to our Data Protection Officer: