Privacy Policy
Effective Date: 14 October 2026
Last Updated: 14 October 2026
Version: 2026-10-14
1. Who we are and what this policy covers
MandateRoom is operated by Aniket Raj, an individual trading as MandateRoom, a sole proprietor registered in India (Udyam Registration No. UDYAM-UP-29-0238002), of Delhi NCR, India. This policy explains how we handle personal data about the people who visit our website, hold accounts, use our virtual data rooms by invitation, or contact us.
We act in two roles:
- As controller (a "data fiduciary" under Indian law) of the personal data described in this policy: account, security, activity, acceptance, invitation, billing and correspondence data. We decide why and how it is used.
- As processor (a "data processor") of the personal data inside the documents and other material that a Customer uploads to a Room, and of the questions, answers and other content that its users create there. The Customer decides what is uploaded and why, and is the controller. Our Data Processing Addendum governs that processing. If you were invited to a Room, the organisation that invited you decides what the Room holds; to exercise a right over Room content, contact that organisation. We help it respond.
You can reach us about anything in this policy at hello@mandateroom.com. We have not appointed a data protection officer; the Grievance Officer named on our website, Aniket Raj, is our privacy contact. We have not yet appointed a representative in the European Union or the United Kingdom. If the law requires us to, we will name the representative here.
2. The personal data we collect
| Data | What it includes | Where it comes from |
|---|---|---|
| Account data | Your name, work email address, organisation and role. Your password and the secrets for your second factor are held by our authentication provider in protected form; we do not see them | You, or the Customer that invited you |
| Passkey and security-key data | For each passkey or security key you register as a second factor: its public key and identifier, the name you give it, a code for the make and model of the authenticator, whether it can be backed up and whether it is, a use counter, a yes or no for whether the device confirmed that it was present and that you unlocked it, the technical statement the authenticator gave when it was registered, and when it was added and last used. It is held by our authentication provider | You, when you register a passkey or security key |
| Security and session records | The time of each sign-in, your IP address, your browser and device type, session identifiers, and failed attempts | Created when you use the Service |
| Activity records (the audit ledger) | Which document or page you opened, downloads, permission changes, questions and answers, with the time and your IP address | Created when you use a Room |
| Search records | The words you search for in a Room, the time, the number of results and your identity. They are stored encrypted, and the Room's administrators can read them, with your name | Created when you search |
| Acceptance records | The version of the Terms or of an NDA you accepted, the time and your IP address, and your name and email | Created when you accept |
| Watermark data | Your email address or name, the time and a document reference, applied to page images and downloads you open | Created when you view or download |
| Invitation data | The address a Customer entered to invite you, the Room, and the status of the invitation | The Customer |
| Billing and payment records | Invoice contact name, email, organisation name and address, tax identifier, payment reference and confirmation of a bank transfer. We do not receive or store card details | The Customer and its bank |
| Waitlist details | Your name, work email address, organisation and any note you choose to add, entered in our waitlist form. The form is run by a provider named on our sub-processors page, which may also log technical data such as your IP address in running it | You |
| Correspondence | What you send us and our replies | You |
| Technical logs | Request and error logs kept by our infrastructure providers for security and reliability | Created when you use the website or the Service |
Passkeys, security keys and biometrics. A passkey or security key is a second factor that you register in your account, so that we can check later that the same key is present. Its private part never leaves your device, your password manager or your security key, and we never receive it. Many passkeys are unlocked on the device with a fingerprint, a face scan or a PIN. That check happens on your device and stays there: what we receive is a signed confirmation that the key is present and that your device reports it was unlocked. We do not receive, store or process fingerprints, face scans or any other biometric data or template, and we do not ask your device for them. Where your passkey is saved or synced (your phone's operating system, your browser or a password manager) is decided by you and your provider, not by us. We email you a security notice when a passkey or security key is added or removed. You can remove one in your account settings at any time, and when an erasure request is carried out the keys are deleted with the rest of your authentication data.
We do not knowingly collect sensitive categories of personal data about you. A Customer might upload such data inside a Room; our Acceptable Use Policy restricts it and the Data Processing Addendum governs how we handle it.
3. Why we use it, and our legal bases
| Purpose | Data | Legal basis (EU and UK GDPR) |
|---|---|---|
| Creating and running your account and providing the Service | Account, invitation, session, passkey and security-key data | Performance of a contract (Article 6(1)(b)); for an invited user, our legitimate interest and the inviting Customer's in running the Room (Article 6(1)(f)) |
| Securing the Service, preventing fraud and abuse, and keeping evidence of who did what | Security, session, activity, acceptance and watermark data | Legitimate interests (Article 6(1)(f)): security and the integrity of a confidential process |
| Billing, accounting and tax | Billing and payment records | Contract (Article 6(1)(b)) and legal obligation (Article 6(1)(c)) |
| Keeping the waitlist, answering your request for access and telling you when access is available | Waitlist details | Steps at your request before a contract (Article 6(1)(b)) and legitimate interests (Article 6(1)(f)): answering a request you made |
| Responding to you and to enquiries and rights requests | Correspondence, account data | Legitimate interests (Article 6(1)(f)) and legal obligation (Article 6(1)(c)) |
| Complying with law, including sanctions screening and responding to legal process | Any of the above, as needed | Legal obligation (Article 6(1)(c)) or legitimate interests (Article 6(1)(f)) |
| Service emails (invitations, security notices, billing) | Account, invitation, billing data | Contract and legitimate interests |
We do not use your personal data for advertising, we do not sell it, we do not share it with third parties for their own marketing, and we do not make decisions about you by solely automated means that have legal or similarly significant effects. We do not currently send marketing email. If we start, you will be able to opt out in every message. We use your waitlist details to answer your request and to tell you when access is available, and we do not add you to a marketing list.
4. Who sees your data
- The Customer and its Room administrators. The purpose of a data room's audit trail and watermark is that a Room's administrators can see which of their invited users opened which documents and when. If you use a Room, they will see that. They can also read what you search for in the Room, and who searched, and they can see whether and when you read the Room's deal brief.
- Our sub-processors, the infrastructure providers that host, store, send and protect data for us. They are listed on our sub-processors page, with what each receives and where, and may not use it for their own purposes.
- The provider of our waitlist form, which holds what you enter in the form for us. It is named on our sub-processors page and receives nothing from inside a Room.
- Authorities, where the law or a valid legal process requires it, as our policy on legal requests describes.
- A successor to the business, if it moves into a company or is transferred, under the safeguards in our Terms of Service, and our professional advisers, bound by confidentiality.
5. Where your data goes
The provider of our waitlist form stores what you enter in it in Europe, and we read it from India. Our infrastructure is otherwise mainly located in the United States. We operate from India: the person who administers the Service works there and accesses data from India. If you are in the European Economic Area, the United Kingdom or Switzerland, your data is therefore transferred to India and to the United States. For personal data in Customer Content, the Data Processing Addendum provides the transfer mechanism (the EU Standard Contractual Clauses, the UK Addendum and the Swiss amendments). For data we control, we rely on the same safeguards and on our sub-processors' own transfer mechanisms, which include the EU-US Data Privacy Framework where a provider is certified and standard contractual clauses otherwise. A copy of the clauses is available on request.
Authorities in India, the United States and other countries may be able to compel disclosure of data held by us or by our providers. Our legal-requests policy describes how we respond. We will follow any restriction on transfers that Indian law notifies.
6. How long we keep it
| Data | How long |
|---|---|
| Account data | While your account exists. We delete or anonymise it within 30 days after the account is closed and a verified deletion request is received, except for the records below |
| Passkey and security-key data | Until you remove the key. When an erasure request is carried out it is deleted with the rest of your authentication data |
| Audit and activity records, question-and-answer records, request records | These are evidence. We keep them for at least seven years and do not delete them while a legal hold or a legal minimum applies. When an erasure request is granted, the personal identifiers in them are made permanently unreadable by destroying the encryption key that protects them; the record of the event remains |
| Acceptance records (Terms, NDAs) | Kept as evidence for at least as long as the related audit records |
| Session and security records | For the life of the account and, where they form part of the audit records, as above |
| Documents and other Customer Content | As the Data Return, Retention, Deletion and Legal Hold Policy sets out: normally deleted within 60 days after a Room's subscription ends, or earlier on the Customer's instruction, unless a legal hold or a legal requirement applies |
| Billing and tax records | As tax, accounting and company law require, up to eight years after the end of the financial year |
| Waitlist details | Until we invite you to open an account (they then become account data), or you ask us to delete them, or we close the waitlist, whichever comes first. We use them for nothing else |
| Correspondence | Two years after the last contact, unless it forms part of a legal matter |
| Backups held by our providers | Not used to restore individual deleted items. They expire on the providers' cycles, and we aim for deleted data to leave backups within 90 days |
A legal hold, a legal requirement or the need to establish or defend a legal claim can require us to keep data longer. If an erasure cannot be carried out yet for one of those reasons, we record the request and carry it out automatically when the reason ends.
7. Your rights
Subject to the law that applies to you, you can ask us to: confirm whether we process personal data about you and give you a copy; correct it; delete it; restrict its use; give you your data in a structured, commonly used, machine-readable format; stop using it where we rely on legitimate interests; and, where we rely on your consent, withdraw it. You can complain to us and to a regulator. We do not make solely automated decisions with legal or similar effects.
To exercise a right, email hello@mandateroom.com with "Privacy request" in the subject line. We may need to verify your identity. We answer within 30 days; where the law allows an extension for a complex request, we will tell you why. We do not charge a fee unless a request is manifestly unfounded or excessive. If your request concerns Room content, we will tell you who the controller is and help them respond.
European Economic Area, United Kingdom and Switzerland. You have the rights above under the GDPR and the UK GDPR. You may complain to the supervisory authority in your country; the European Data Protection Board lists them at edpb.europa.eu; in the United Kingdom it is the Information Commissioner's Office.
India. Our India Privacy Notice explains how the Digital Personal Data Protection Act, 2023 applies, including your right to complain to the Data Protection Board of India once its complaint provisions apply.
California and other US states. In the last twelve months we have collected identifiers, internet and network activity, professional and commercial information, and the audit and acceptance records described above, for the purposes in section 3. We do not sell or share personal information as those laws define them, we do not use it for targeted advertising, and we do not knowingly collect sensitive personal information. Residents of California and of other states with privacy laws may ask us to tell them what we hold, to delete it or to correct it, and may use an authorised agent. We will not treat you differently for exercising a right. If a Customer is the controller of your data, we act as its service provider and direct you to it.
8. Cookies
We use only the cookies and browser storage the Service needs in order to work, and no analytics, advertising or cross-site tracking. Our Cookie Notice lists them. The waitlist form is on another provider's site: when you open it you leave ours, and that provider's own notice applies to the form.
9. Security and breaches
We protect personal data with the measures described in our Terms of Service and on our security page. Those pages also state plainly what we do not have: we are not SOC 2 or ISO 27001 certified, and we have no dedicated security team. If a personal-data breach affects you, we will notify the affected Customer without undue delay and within 72 hours after we confirm it, where we act as its processor, and we will notify affected individuals and the competent authorities where the law requires us to as controller.
10. Children
The Service is for business use by adults. It is not directed at anyone under 18, and we do not knowingly collect personal data from a person under 18. If you believe a minor has given us personal data, tell us and we will delete it.
11. Changes to this policy
We may update this policy. For a material change we will give at least 30 days' notice by email or in the Service. The date at the top shows the current version.
12. Contact and complaints
- Email: hello@mandateroom.com, with "Privacy request" or "Privacy complaint" in the subject line
- Controller: Aniket Raj, trading as MandateRoom
- Address: Delhi NCR, India
- Grievance Officer: Aniket Raj
If you are not satisfied with our answer, you can complain to the authority named in section 7.