India’s Digital Personal Data Protection Act changes what “consent” is supposed to mean. It’s not a box a person ticks once at signup and never sees again — it’s meant to be specific to a purpose, understandable in plain language, and something a person can take back later. We built Fleek’s consent system to work that way from the start, while the Act’s rules were still being finalized, rather than adding it later to pass a review.
Consent, split by purpose
A household’s data on Fleek isn’t covered by one blanket agreement. It’s split into named purposes — document processing, AI-assisted planning, communications, bank-statement reading, and a few others — and each one can be allowed or declined on its own. A client can say yes to document processing and no to WhatsApp updates, and that’s a perfectly normal, supported state, not an edge case the product fights against.
The wording is deliberately plain. Here’s an actual purpose description shown in the app: “We use AI (Anthropic, with your identifying details removed) to model scenarios, draft plans, and summarize meetings — always reviewed by your advisor before anything is shared with you.” That’s the whole point — a client should be able to read it and know exactly what it means, without needing to interpret a legal document.
Turning something off tells you what it’s connected to
If a purpose is tied to a feature — turning off document processing, for instance, affects automatic CAS reading — the app says so before the toggle takes effect. The choice stays informed rather than something that quietly breaks a feature later with no explanation.
What happens to the data itself
A few specifics, since “your data is protected” on its own doesn’t mean much:
- PAN, phone number, email, and bank account details are each encrypted individually, with keys managed through a self-hosted vault — not just “the database is encrypted” as a blanket claim
- A client can request an export of their own data, which happens automatically, or request deletion of their account, which is reviewed by a person before it’s actioned
- Every household can see a named grievance officer to contact about their data specifically, as the Act requires, rather than a generic support inbox
Where we are, honestly
This is a young part of the product, built deliberately ahead of the Act’s rules coming into full force, not something we’re claiming years of track record on. It’s also still growing — the current version covers the purposes and rights above, and we’re extending coverage further as the product does. We’d rather describe exactly what’s built today than round up.
Leave a Reply