DPDP Act Compliance

Under the DPDP Act, personal data may only be processed for lawful purposes with consent or certain legitimate uses. SoundShare processes zero personal data (no names, no emails, no phone numbers, no IP logs tied to identities). Therefore, no explicit consent mechanism for data processing is required.

The DPDP Act guarantees Data Principals the right to access, correct, and erase their data. Because SoundShare stores 0 bytes of user data on our servers, these rights are automatically fulfilled. There is no account to delete, no profile to correct, and no server-side files to export. All data remains exclusively on your physical device.

A Data Fiduciary must implement technical and organizational measures to ensure data accuracy, protect against breaches, and manage data retention.

• Data Accuracy: Not applicable, as no personal data is collected.
• Retention & Purpose: Ephemeral WebRTC metadata (SDP/ICE) is purged from the signaling server immediately after a peer connection is established (typically within 60 seconds).
• Breach Notification: In the highly unlikely event of a signaling server breach, no user payloads or identifiable information would be exposed, as all transfers are encrypted client-side with AES-GCM.

SoundShare relies on Vercel and Ably for static hosting and WebRTC signaling. These sub-processors employ enterprise-grade security and maintain regional data centers to ensure metadata is processed securely without unauthorized cross-border transfers of sensitive payloads.