Consiva.ai is a product and technology platform operated by Swaran Soft Support Solutions Private Limited.
Consiva is software. It provides technology and workflows designed to help organisations operationalise and manage privacy, consent and data protection requirements — capturing consent, handling data principal rights requests, maintaining records, mapping data, and documenting incidents.
Used properly, it does real work: it makes obligations operational, applies your decisions consistently, and produces retrievable evidence that the controls ran. We think that is most of the practical difficulty of privacy compliance, and we don't want this page to suggest otherwise.
2.1 Not a law firm, and not legal advice. Swaran Soft is not a law firm. Nothing in the Consiva platform, our documentation, our website, our regulatory reference pages, our templates, our white papers or our communications constitutes legal advice or creates a lawyer-client relationship. Our team includes privacy practitioners; they are not your legal counsel.
2.2 Not a guarantee of compliance. No software can make an organisation compliant. Compliance depends on your processing purposes, your legal determinations, your internal governance, how you configure the platform, and what your people actually do. We provide the tooling. We do not, and cannot, warrant that your use of Consiva results in compliance with the DPDP Act, the DPDP Rules, or any other law.
2.3 Not protection from penalties. We make no representation that using Consiva will prevent, reduce or mitigate any penalty, fine, order, direction or other consequence imposed by the Data Protection Board of India or any other authority.
2.4 Not regulator-approved. Consiva is not endorsed, approved, certified or accredited by the Data Protection Board of India, MeitY, CERT-In or any other regulator. Any suggestion of official approval would be false.
2.5 Not a Consent Manager. Swaran Soft is not a Consent Manager registered under the DPDP Act, and does not represent itself as one. Consiva is a consent management platform licensed to data fiduciaries. → /dpdp/dpdp-rules-2025
2.6 We do not file on your behalf. We do not submit notifications, reports or filings to the Data Protection Board, CERT-In or any other authority on your behalf, unless expressly agreed in a separate signed written agreement. Our incident workflows detect the deadlines, track them independently, and pre-draft the reports. Submitting them is yours.
This matters more than it may appear, because Consiva tracks three separate deadlines arising from one detection event:
| Clock | Deadline | Recipient | In force |
|---|---|---|---|
| CERT-In Directions, April 2022 | 6 hours from detection | CERT-In | Now |
| DPDP Rule 7(2)(a) | Without delay | Data Protection Board | 13 May 2027 |
| DPDP Rule 7(2)(b) | 72 hours | Data Protection Board | 13 May 2027 |
Our timers, escalations and draft reports are a decision-support tool. They do not discharge your obligation, they do not constitute a legal assessment of whether an incident is reportable, and a countdown reaching zero is not a filing. Whether an incident is notifiable at all is a determination for you and your advisers.
2.7 Our SLA figures are service commitments, not statutory limits. Where the Service displays a response target — for example a 30-day Data Principal rights countdown — that is Consiva's configured target, not the statutory period. Rule 14(3) sets a ceiling of a reasonable period not exceeding ninety days for grievance response. Configuring a target does not alter your legal deadline, and you remain responsible for knowing it.
You remain the data fiduciary for the personal data you process. In particular, you determine:
We hold these decisions faithfully, apply them consistently and evidence them. We do not make them.
4.1 Our regulatory reference material is prepared carefully, cited to primary sources, and dated. It is general information about the law, not advice on your situation.
4.2 The law is moving. The DPDP Act and Rules commence in stages, with substantive obligations taking effect on 13 May 2027. Guidance from the Data Protection Board, MeitY notifications, sectoral regulator directions and judicial decisions may change the position after we publish. We re-verify our regulatory pages and show a last-verified date, but there may be a gap between a development and our updating of it.
4.3 Where a question is genuinely unsettled, we say so rather than presenting one reading as certain. Those are exactly the questions on which you should take qualified advice.
4.4 Our templates and generated documents — notices, policies, assessments — are starting points requiring review and adaptation. Publishing one unreviewed is not compliance.
5.1 Where automation is used. Certain Consiva features use automated, rule-based processing — deterministic keyword and pattern matching, not machine learning or generative AI — to assist with tasks such as classifying discovered data, categorising cookies and trackers, and suggesting notice or policy text. If we introduce machine-learning or generative-AI features in future, we will update this notice before they ship, not after.
5.2 Outputs require human review. Automated outputs are suggestions, not determinations. Classification can be wrong. A tracker can be miscategorised, a data field misclassified, a suggested notice incomplete for your circumstances. Review before you rely.
5.3 Not legal advice. Automated output does not become legal advice by being generated automatically. Clause 2.1 applies fully.
5.4 You remain the decision-maker. Accepting, rejecting or amending an automated suggestion is your decision and your responsibility, including where you accept it unchanged.
5.5 Not a substitute for professionals. These features are designed to reduce the manual effort of privacy work. They do not replace a privacy professional or qualified legal counsel, and we would be doing you a disservice to imply they do.
5.6 Limits of automated discovery. Automated data discovery finds personal data in the systems it is connected to and can access. It cannot find data in systems it has not been given access to, and detection is not exhaustive. A discovery report is evidence of what was found, not proof of what exists.
6.1 Consiva integrates with third-party systems you choose to connect. We are not responsible for their availability, accuracy, security or compliance posture.
6.2 How you configure an integration can affect your compliance. For example, if your tag manager fires trackers before reading the consent signal, a correctly configured Consiva banner will not prevent that. We will show you where it is happening; fixing it may require changes in your own systems.
6.3 Our website may link to third-party sites. Links are not endorsements.
This page is explanatory. Warranties, disclaimers and limitations of liability that apply to your use of the Service are set out in the Terms of Service, and where applicable your Master Services Agreement and Data Processing Agreement. Nothing here extends or reduces them.
If you need advice on how DPDP applies to your organisation, take it from a qualified lawyer or a privacy professional engaged for that purpose. We would rather you did that and used our software well than treated our software as a substitute for it.
If you're not sure where to start, write to us and we can suggest where to look.
legal@consiva.ai
Swaran Soft Support Solutions Private Limited, Tower A, Unit No. 2, 2nd Floor, The Cityscape, Sector-66, Golf Course Extension Road, Gurugram, Haryana – 122102, India