Privacy

As Amended is published by Devansh Parikh as an individual. It is not published by, on behalf of, or in the name of any firm or employer, and nothing on it is issued in any professional capacity.

For the purposes of the Digital Personal Data Protection Act, 2023, that individual is the data fiduciary for everything described below.

The distinction runs through the whole of this page, so it comes first.

Reading it. Open any Act, search, follow a citation, download a PDF, take the CSV exports or the feed. This needs no account and involves no personal data about you at all. Nothing identifies you, nothing is stored against you, and there is nothing to delete afterwards because nothing was created.

Keeping things. If you want the site to remember which sections you follow, which you have bookmarked, the notes you write against them and the searches you keep, you can enter an email address. That creates an account, and from that point the site holds personal data about you. It is entirely optional, it is never required to read anything, and it can be undone completely in one click.

There are three things, and this is all of them.

Page counts. When a page is opened, a counter is incremented. What is stored is the date, which kind of page it was, and — where the page is an Act or a set of Rules — which one. Nothing else: no address, no device, no browser, no referring site, no identifier of any kind, and never the query string. The counting is aggregated at the moment it is written, so a record of an individual visit never exists in the first place. That is also why these are views and never visitors: telling people apart needs something that distinguishes them, and there is nothing here that could.

Search outcomes. Every search records how many results of each kind it returned, and when. The wording of a search is kept only when the search found nothing, because a list of what this library failed to answer is the only honest measure of what it is missing. A search that succeeded has already said what was needed, and its wording is discarded immediately. Wording that is kept is erased after 90 days by a job that runs nightly; the outcome and the counts remain, and they identify nobody. None of this is linked to an account, even if you have one.

Your theme choice. Light or dark is stored in your own browser under the name as-amended-theme. It never leaves your device and is never sent here. See Cookies.

This is the complete list. There is a button in the account panel that hands you all of it as a spreadsheet, so you never have to take this paragraph on trust.

• The address itself, stored as you typed it, and a display name if you give one. The name is optional and can be anything; nothing checks it.
• When the account was created, and roughly when you were last here. The second is used for one purpose only — to show you what the collection picked up since your previous visit — and it moves at most once every thirty minutes, so it is a coarse marker and not a log of your reading.
• What you follow and what you bookmark, each as a pointer at a provision or an instrument, with the date you saved it.
• Notes you write against a provision, in your own words, up to 2,000 characters each. These are the one thing here that is genuinely yours rather than a pointer at public law. Please read the next section before you write anything in one.
• Searches you deliberately keep, up to fifty; saving the fifty-first drops the oldest. Only searches you press the button on. Searching normally still records nothing about you, exactly as described above.
• Whether you have asked for the digest, and whether the address has been verified. At most one message a day; there is no other cadence to choose. Two tokens sit alongside: the single-use one from the verification link, which expires in 48 hours and is erased the moment it is used, and one that identifies your unsubscribe link for as long as you keep receiving mail.

Two messages are sent, and only if you ask. Ticking the alerts box sends nothing at all. A Verify this email button then appears, and pressing it sends one note with a link in it. Opening that link is what starts the daily digest. Until then the address is unverified and nothing is sent to it — which is the entire reason that step exists, since a tick is made by whoever is holding the browser and is not evidence the address is theirs.

The digest is one message on days a regulator published something, and nothing at all on quiet days. Every copy carries a one-click unsubscribe, both as a link you can see and as the header that makes your mail client offer a button of its own. Unsubscribing stops the mail and touches nothing else: your follows, bookmarks and notes stay exactly as they are, and switching it back on later needs no second verification, because the address was already proved once.

There is one way an address joins the list without any of that. The publisher can add an address directly, and one added that way starts receiving the digest without a verification step — because nobody typed it into this site, so there is nothing to verify. If a digest arrives that you never asked for, that is how, and it is worth saying rather than leaving you to wonder.

Two things are true of those addresses and are the reason this is written down. The unsubscribe works identically — one press, no sign-in, immediate, and it is in every message. And the record keeps the difference: an address added this way is marked as such, and the copy of your data you can export says plainly that the site owner added it rather than claiming you signed up.

The account has no password, no sign-in link and no verification step. Entering an address is how you tell the site which lists are yours; it is not a claim that the address belongs to you, and nothing checks that it does.

The consequence is worth stating plainly rather than burying: anyone who knows or guesses your address can see and change those lists, including reading your notes. This was a deliberate trade. It buys an account with nothing to forget, no password to leak and no session to hijack, and it is an acceptable trade only for as long as what sits behind it is a set of pointers at public law.

So here is the rule the feature is built to, and the limit on what it may ever hold: do not put anything in a note that you would mind a stranger reading. Not a client’s name, not a figure from a live matter, nothing privileged or confidential. Use it for what it is for — a reminder to yourself about a provision. If this site ever needs to hold more than that it will need real sign-in first, and that would be announced here before it happened rather than after.

Under the Digital Personal Data Protection Act, 2023 the basis is your consent, given by typing an address into a form whose only purpose is this, and the purpose is limited to what that form offers: to show you your own follows, bookmarks, notes and saved searches when you come back, and to send the alerts if you ever switch them on.

An address the publisher added directly did not come with that consent, and this notice does not pretend otherwise. It is held and mailed on the publisher’s own decision, the record says so, and the way out is the unsubscribe in every message or a line to the address at the bottom of this page — either of which is honoured immediately and without being asked why.

It is not used for anything else. It is not profiled, not scored, not used to decide anything about you, not combined with the page counts or the search outcomes — which could not be linked to it anyway, since they hold nothing that identifies anyone — and not disclosed to anybody. Withdrawing consent is the delete button described below, and it takes effect at once.

No cookie of any kind, which is still true and is not a technicality: the account is remembered in your browser’s own local storage rather than in a cookie, specifically so that nothing about you is attached to every request you make. No response from this site carries a Set-Cookie header, the account routes included. See Cookies for what is stored on your device instead.

No advertising, no advertising identifier, and no analytics belonging to anyone else — the counting described above is this site’s own and the numbers stay here. No profiling and no automated decision-making. No password, so none to lose. Nothing is sold, rented or shared for anyone else’s purposes, and there is no arrangement under which it could be.

No part of this site loads a script, a stylesheet, a font or an image from a third party. The typefaces are served from this domain, compiled in when the site is built, specifically so that reading an Act here does not hand a record of it to anyone.

Serving a page requires receiving a request, and a request carries the address it came from. The host processes that in order to deliver the page and to defend against abuse, and may hold it briefly in operational logs. This is ordinary and unavoidable for any website. What is avoidable is keeping it afterwards, joining it to anything, or using it to build a picture of a reader — none of which is done here. No such log is read, exported or retained by the publisher.

One deliberate detail: the request that hands you your own data carries your address in the body rather than in the address bar, so that it never appears in a server log, in a Referer header or in your browser history.

Running a site means using someone’s infrastructure. Four services are involved and no others.

• Netlify · Hosting and content delivery

  Serves every page. Receives the IP address and request headers of each visit, as any web server must, and may retain them briefly in operational logs.

  Located: United States and its global edge network

• Neon · Database

  Holds the statutory text, the amendment records, the search outcomes and the page counts described above. Also holds the accounts: the email addresses, names, follows, bookmarks, notes and saved searches of readers who have entered an address.

  Located: Singapore (ap-southeast-1)

• Cloudflare R2 · File storage

  Holds the regulators' own PDFs. Serves them when a reader opens an official document.

  Located: Global

• Google (Gmail) · Sending email

  Carries the two messages this site sends: the note that verifies an address, and the daily digest to readers who have confirmed one. Handling those means handling the address they are sent to. It is not used for anything else, and a reader who never asks for email never has an address pass through it.

  Located: Global

Every one of those is outside India, so using this site involves transferring data abroad. If you only read, what crosses a border is statutory text and counts that identify nobody. If you have an account, it is held in Singapore — so your address, your notes and your saved searches are stored outside India — and if you have asked for the digest, your address also passes through Google in order to be mailed. That follows from running on free infrastructure, and it is a real consequence, so it is said here rather than left to be inferred from a list of service names.

Page counts are kept indefinitely. They are daily totals per kind of page and contain nothing about anyone, so there is no privacy reason to delete them and a real research reason to keep them — knowing which Acts get read is what decides what gets collected next.

The wording of a search that found nothing is kept for 90 days and then erased automatically. The outcome of every search — the counts and the timestamp — is kept indefinitely, for the same reason.

An account is kept until you delete it. There is no automatic expiry, which is worth being honest about in both directions: it means a list of followed sections is still there when you come back after a year, and it means an account you have forgotten about does not quietly clean itself up. The delete button is always one click away in the account panel.

The Digital Personal Data Protection Act, 2023 gives you the right to ask what personal data about you is held, to have it corrected or erased, to nominate someone to act for you, and to complain. Two of those are built into the site and need no request and no reply from anyone.

A copy of everything. The account panel has an export button. It hands you a spreadsheet containing the whole account row, every follow, every bookmark, the full text of every note and every saved search — not a summary. It is deliberately everything, because a partial export would satisfy the feature and not the right.

Erasure. The same panel has a delete button. It removes the account row, and every follow, bookmark, note and saved search goes with it in the same operation, immediately and permanently. Nothing is archived, nothing is kept in a copy of its own, and nothing is retained for a notice period. Afterwards the site knows nothing about you and you are back to being a reader.

Correction. The display name can be changed in the same panel. To change the address itself, delete the account and enter the new one.

If you have never entered an email address, the honest answer to the first right is “none”, and not as a matter of policy: there is no field anywhere in this site’s database that would hold anything about you. The one exception is the text of a search that found nothing, if you typed something identifying into it within the last 90 days — say roughly what and when, and it will be erased.

For anything the buttons do not cover, including nominating someone to act on your behalf, write to the address below.

This site is a research aid for tax and corporate law and is not directed at children. Nothing on it requires an age, and reading it collects no personal data from anyone, so none is collected from a child either. The Act requires verifiable parental consent before a child’s personal data is processed, and this site has no way to establish an age: accounts are therefore not offered to anyone under eighteen. Please do not enter an email address if you are under eighteen, and if an account turns out to belong to a child it will be deleted on being told.

If personal data held here is exposed, the Act requires the Data Protection Board and the affected people to be told. The second half of that is worth a sentence, because this site has no mailing list and would have to use the only addresses it holds — the accounts themselves. They would be used for that, and a notice would also go on the About page, which needs no address to read.

If this changes, the date at the top changes with it and the previous wording is replaced. Material changes are listed on the About page, which is where to look to see what changed and when.

Questions about this notice, a request the buttons do not cover, or a grievance about how data is handled, go to Devansh Parikh at as.amended321@gmail.com. A reply should be expected within thirty days.

If a grievance is not resolved, the Data Protection Board of India may be approached. These matters are governed by the laws of India, with jurisdiction in Gujarat, India — see Terms.