Privacy policy

This policy is published under rule 4 of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and serves as the notice the Digital Personal Data Protection Act, 2023 requires. It covers this website and the ChorusOne platform operated by AurigaNet Digital Technologies Pvt Ltd.

Two roles

When you sign up an ISP, we collect your name, email, mobile number, a password and your company’s legal name, GSTIN and address. We are the data fiduciary for that information. We use it to create and operate your account, to invoice you, to tell you about the service and to meet our legal duties.

For your subscribers’ data (customer records, KYC, sessions, IPDR and NAT records, invoices, messages), your ISP is the data fiduciary and we are its data processor. We process that data only on your ISP’s instructions and under the terms of service. Your ISP publishes its own privacy notice to its subscribers; the platform links it beside every sign-in.

What the platform collects on an ISP’s behalf

• Subscriber identity and contact details, and the installation address.
• KYC: the fields of an Aadhaar secure QR (name, date of birth, gender, address, photograph and the last four digits of the number, never the whole number), or copies of other identity and address documents, with the subscriber’s recorded consent.
• Service records: sessions, IP addresses and the IPDR, NAT and flow records that the Department of Telecommunications requires an ISP to keep for two years.
• Billing: invoices, payments, credit notes and tax facts. Card and bank details are handled by the payment gateway and are never stored on the platform.
• Messages sent in the ISP’s name, and the subscriber’s replies on WhatsApp.

How long

• IPDR, NAT, flow and session records: at least two years, as the Unified Licence requires; archived before deletion.
• Invoices, credit notes and payments: eight years, as the Companies Act requires of books of account.
• System and audit logs: at least 180 days, as CERT-In’s directions of 28 April 2022 require, and inside India.
• An ISP’s own account: for as long as the account exists and for the period the law then requires.

Where

The platform is installed on infrastructure the ISP operates in India. The in-product assistant sends the text of a request and the ordinary business records it needs to answer to a model hosted by Anthropic; the records the Department of Telecommunications can demand (IPDR, NAT and flow records, lawful-interception requests and regulatory reports) are kept away from it by design. An ISP that does not want the assistant switches it off.

Security

Passwords are hashed and never stored in clear. Router credentials, provider keys and other secrets the platform must present are encrypted. Access is by role and permission, every administrative act is logged, and backups are taken nightly. A security incident is reported to CERT-In within six hours of our noticing it, and affected people are told as the law requires.

Your rights

You may ask what we hold about you, ask for it to be corrected or erased where the law permits, withdraw a consent you gave, and nominate a person to act for you. Write to the contact on the company details page. A subscriber of an ISP should write to that ISP, which holds the record; we help the ISP answer.

Grievance officer

The grievance officer’s name and address are published on the company details page.

Changes

We change this policy by publishing a new version here with a new date. A change that affects how we use your data is also sent to the email on your account.