DPDP-compliant
All tenant PII stays in Mumbai. Aadhaar — last four digits only. Erasure within 30 days.
What it does
The DPDP Act 2023 imposes real obligations on anyone holding Indian residents' personal data. PG Saathi was built with those obligations as constraints, not afterthoughts.
All persistent storage is Supabase Mumbai (ap-south-1). LLM intent classification uses Sarvam AI, an Indian provider. Photo OCR uses Claude Vision via Anthropic — but only for ledger import (no PII fields like Aadhaar are sent), and the request transits through code we control.
We store only the last 4 digits of Aadhaar, in keeping with the DPDP minimisation principle. A `delete my data` request from any user starts a 30-day grace period (during which they can cancel), then PII is irreversibly removed; financial audit logs are kept for 7 years to meet tax law, but with personal identifiers stripped.
On WhatsApp
- Tenant or owner: `delete data` — starts the DPDP erasure flow.
- 30 days to change your mind. After that, irreversible.
- Receipts and bot replies never leak Aadhaar in full.
On the dashboard
/account/delete — request erasure with the confirmation phrase. /settings shows your data retention summary.
Why it matters
DPDP penalties run up to ₹250 crore for serious data-protection failures. Building compliance into the schema (column-level constraints, retention windows, region locking) is the only way a small PG SaaS can credibly serve real Indian users without one breach ending the business.
A shared sandbox PG with sample tenants, payments, expenses. Resets hourly.
What it does