Data Rights & DPDP

As an Indian business, PAIDGUY DIGITAL SERVICES processes personal data as a Data Fiduciary under the Digital Personal Data Protection Act, 2023 (“DPDP Act”). This page explains your rights as a Data Principal — the Act’s term for the individual the data is about — in plain language, and exactly how to exercise them. It applies to you whether you’re a TRIGMAZE account holder or someone who commented on, DM’d, or replied to the story of a TRIGMAZE-connected Instagram account without ever signing up yourself.

Your rights under the DPDP Act

• Right to access. Request a summary of what personal data we hold about you, where it came from, and who we’ve shared it with (see “Who else touches this data” in the Privacy Policy).
• Right to correction and completion. Ask us to fix inaccurate data — a wrong tag or custom field on a contact record, an outdated email, or an incomplete entry — or update it yourself where TRIGMAZE already gives you a direct control for it (Settings, or the Contacts page).
• Right to erasure. Request full deletion of your personal data once it’s no longer needed for the purpose it was collected for. For an account holder, this is real, self-service, and immediate once confirmed — see “Self-service, in the app” below.
• Right to withdraw consent as easily as it was given. A contact who no longer wants automated messages can opt out directly in the conversation, at any time, with no account required — see below.
• Right to nominate. You may nominate another individual to exercise these rights on your behalf in the event of your death or incapacity — email [email protected] to register a nomination; there is currently no self-service control for this, so it’s handled by request.
• Right to grievance redressal. Raise a complaint about how we’ve handled your data with our Grievance Officer, and escalate to the Data Protection Board of India if you’re not satisfied with our response — see below.

Self-service, in the app (fastest, no waiting on email)

If you have a TRIGMAZE account, most of these rights don’t require contacting us at all:

• Access your full data. Settings → Account → “Download my data” generates a complete JSON export — your account details, connected accounts, contacts, automations, and message history — as an immediate download, right there in your browser.
• Export just your contacts. The Contacts page has its own Export CSV button for a spreadsheet-friendly copy of everyone you’ve interacted with, their tags, and their consent status.
• Correct your own data. Contact tags, custom fields, and notes are editable directly in Contacts; account email/name/password in Settings.
• Erase everything. Settings → Account → “Delete account”. You’ll get a confirmation email first — nothing is deleted until you click the link in it — and once confirmed, your workspace, connected Instagram accounts, contacts, automations, and messages are permanently and immediately deleted. This can’t be undone, and there’s no recovery window after confirmation.
• Disconnect one Instagram account without deleting your whole workspace. From Accounts, disconnecting removes that account’s token and every contact/ message tied specifically to it.

If you don’t have an account (a contact)

• Opt out instantly. Reply STOP or “unsubscribe” to any automated DM. You’ll get an immediate confirmation, and it’s honored permanently by every automation on that account — this is checked before every single automated send, with no exceptions.
• Ask the account owner. They can tag you opted-out, remove your record, or export/delete your data from their side directly.
• Email us. [email protected] with the Instagram @username involved and what you’re requesting — see “How to reach us by email” below.

How to reach us by email

For anything the in-app controls above don’t cover — or if you’re a contact without a TRIGMAZE account — email [email protected] with:

• Your TRIGMAZE account email, or the Instagram @username the interaction happened on.
• Which right you’re exercising (access, correction, erasure, consent withdrawal, or nomination).
• Any detail that helps us find the right record faster — a rough date, or which connected account was involved.

We acknowledge every request within 7 business days and aim to complete verified access, correction, and erasure requests within 30 calendar days — our own committed timeline, in the spirit of the DPDP Act’s response expectations. We may ask you to verify your identity or your connection to the Instagram account in question before acting on a request, specifically to stop someone else from deleting or exporting your data by impersonating you.

Where your data is processed

Our production database is located in Singapore, not India — see the Privacy Policy’s “Who else touches this data” section for the full list of infrastructure providers and why. The same protections in this policy apply to your data regardless of which region it’s stored in.

Grievance Officer

If you believe we’ve mishandled a request, or have a complaint about how your data was processed, contact our Grievance Officer directly:

Mohammad Kazim, PAIDGUY DIGITAL SERVICES
Moradabad, Uttar Pradesh, India
[email protected]

We aim to resolve grievances within 30 calendar days. If you’re not satisfied with our response, you have the right to file a complaint with the Data Protection Board of India, the body established under the DPDP Act to hear exactly this kind of complaint.

Automated data-deletion requests (via Meta)

If you disconnect TRIGMAZE from your Instagram account’s connected-apps settings, Meta sends us a signed deletion request automatically, and we process it immediately — no email needed on your end. This deletes the stored access token and connected-account record, which cascades to remove every contact and message tied to that specific Instagram account too. You can check the status at the confirmation URL Meta shows you, which points back to this site’s deletion-status page.