Jurisdictions

Rang & Mall is an Indian company with Indian servers and a global user base. Three legal systems matter every day (India, United States, United Kingdom), a fourth (the EU) matters whenever an EU user shows up, and a few others are handled by a geo rule rather than a bespoke programme.

The one rule that drives the rest#

Obligations follow the user, not the server. The country a user selects at signup (and, for sensitive features, the country their IP and payment method say they are in) decides the notice they see, the consent they give, the rights they get, the tax they pay, the cancellation rights they hold, and the breach clock that runs if we lose their data.

Every app must therefore carry a user region attribute (IN, US-<state>, UK, EU-<country>, OTHER) on the account, set at signup from the chosen country and corrected by evidence (IP, billing address). Features read that attribute. Do not hard-code one country's law for everyone. Do not silently apply the weakest regime.

India (home jurisdiction, always applies)#

Applies to the company as such, to Indian users, and to anything running on the servers.

Data protection#

• Digital Personal Data Protection Act 2023 (DPDP) + DPDP Rules 2025. Rules were notified 13 November 2025 with a phased start. The Data Protection Board stands up first, consent-manager registration follows, and the substantive obligations (notice, consent, rights, children, breach reporting, retention erasure) become enforceable around 13 May 2027 with MeitY able to bring that forward. Internal decision already taken for Tulip: build as if it is in force from November 2026. Apply the same to every app. (verify the final commencement dates)
• Core obligations: itemised notice in plain language with the option to read it in any Eighth Schedule language; free, specific, informed, unconditional, unambiguous consent by clear affirmative action; withdrawal as easy as giving; purpose limitation; data minimisation; accuracy; erasure when purpose is served or consent withdrawn; a published grievance contact and a Data Protection Officer or contact person; breach notification to the Board and to every affected Data Principal (the Rules require an immediate first notice and a fuller report within 72 hours); verifiable parental consent for anyone under 18; no tracking, behavioural monitoring, or targeted advertising directed at children; Significant Data Fiduciary duties (India-resident DPO, annual DPIA and audit, algorithmic due diligence) once notified as one.
• Penalties reach Rs 250 crore per breach class. Consent obtained before commencement must still be accompanied by a notice "as soon as reasonably practicable".
• Cross-border: transfers are allowed except to countries on a negative list the Government may notify (none notified as of the review). Sectoral rules (RBI payments data, for example) still require Indian storage.
• IT Act 2000 and the SPDI Rules 2011 stay in force until DPDP fully replaces them. They treat passwords, financial data, health data, sexual orientation, and biometrics as sensitive, demand a published privacy policy and "reasonable security practices" (ISO 27001 is the named benchmark), and ground liability under sections 43A and 72A.
• CERT-In Directions of 28 April 2022: report listed cyber incidents within 6 hours of noticing; keep ICT system logs for 180 days inside India; sync clocks to NIC or NPL NTP; cloud, VPS, and data-centre providers (that is RM Cloud) must keep validated customer KYC and usage records for 5 years. These apply to every service provider and intermediary in India, including us.

Intermediary duties (anything that hosts or transmits user content)#

• IT (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021, as amended: publish rules, privacy policy, and user agreement; appoint a Grievance Officer and acknowledge complaints within 24 hours and resolve within 15 days; remove court- or government-ordered content within 36 hours; remove non-consensual intimate imagery within 24 hours of a complaint; keep user registration data for 180 days after withdrawal; keep removed content and records for 180 days for investigation. The 2025 amendment work on labelling synthetically generated (AI) content applies to anything that publishes or hosts AI media. (verify the final text of the synthetic-media amendment)
• Safe harbour (section 79) is lost if we initiate, select, or modify the content. AI triage that rewrites user content is a risk to safe harbour. Keep a clear line between "we host it" and "we wrote it".

Consumers, advertising, subscriptions#

• Consumer Protection Act 2019 and the E-Commerce Rules 2020: grievance officer, country-of-origin and seller details for marketplace listings, no manipulation of prices or reviews, 48-hour acknowledgement and one-month resolution of complaints.
• Guidelines for Prevention and Regulation of Dark Patterns 2023 (CCPA): thirteen named patterns are illegal. The ones we are most likely to trip: false urgency, confirm-shaming, subscription trap (easy to join, hard to leave), drip pricing, interface interference, nagging, and SaaS billing tricks. Cancellation must be as easy as signup, in the same number of steps.
• Guidelines for Prevention of Misleading Advertisements 2022 and the ASCI Code: substantiate every claim, no fake customers, ratings, or testimonials, disclose influencer and paid content, disclose AI-generated endorsers. Disclaimers cannot contradict the headline claim and must be in the same language and a readable size.
• Drugs and Magic Remedies (Objectionable Advertisements) Act 1954 and the Drugs and Cosmetics Rules: no advertisement claiming to diagnose, cure, or prevent the listed diseases and conditions, and no "magic remedy" promotion. This binds RM Health, RM Pharma, DuoFlow and Nimitra (remedies).

Money and tax#

• GST at 18% on SaaS and digital services to Indian customers. Intra-state (Andhra Pradesh, state code 37) is CGST + SGST, inter-state is IGST. Always quote "+ GST". E-invoicing applies above the turnover threshold (verify the current threshold).
• Export of services (US and UK customers) is zero-rated when supplied under a Letter of Undertaking, payment is received in convertible foreign exchange, and supplier and recipient are not merely establishments of the same person. Keep the FIRC or FIRA for every foreign receipt. Softex filings for software exports and EDPMS realisation within the RBI window (nine months) are CA items. (counsel: confirm Softex applicability for SaaS subscriptions)
• FEMA: foreign receipts through an AD bank, purpose codes correct, no netting off.
• RBI Payment Aggregator and Gateway Directions (2020, consolidated 2025): we never act as a payment aggregator. Money that belongs to a third party (school fees to a school, parent-to-parent reimbursements, vendor payouts) must settle directly through a licensed PA or a PA's split-settlement product, never through a Rang & Mall bank account. This is the open P0 in Tulip.
• Card data: tokenisation only; never store PAN, CVV, or expiry. Payment system data must be stored in India (RBI 2018 circular). Use Razorpay or Stripe hosted fields and their India data-residency options.
• Recurring payments in India need an e-mandate with additional factor authentication at setup, pre-debit notification 24 hours before each charge, and limits above which AFA is required on every charge. Let Razorpay or Stripe run the mandate; do not build our own recurring debit.
• TDS, professional tax, Shops and Establishments registration (AP), annual ROC filings, statutory audit, board meetings are company-level items tracked in 08 Open questions.

Telecom and messaging#

• TRAI TCCCPR 2018: any commercial SMS to Indian numbers needs DLT registration of the sender, headers, and templates, and consent records. OTPs are transactional but still need a registered template. This binds Tulip (MSG91), MyJanata, and any phone-OTP login.
• WhatsApp Business messages follow Meta's Business Messaging Policy: opt-in, approved templates, 24-hour session rules.

Evidence and signatures#

• Bharatiya Sakshya Adhiniyam 2023 (BSA) replaced the Evidence Act 1872 on 1 July 2024. Electronic records are admitted under BSA section 63 with the prescribed certificate (the old "65B certificate"). Any product that produces court-facing records (CoParent, RM Sign, isdwell job cards, RM Bills) must cite BSA 2023, not the repealed Act.
• IT Act sections 3, 3A, 5, 10A: a contract formed electronically is valid. Only Aadhaar eSign and Controller-licensed digital signature certificates are "electronic signatures" with the statutory presumption. A drawn or typed signature is still evidence of assent under contract law but enjoys no presumption. The First Schedule excludes wills, trusts, powers of attorney, negotiable instruments other than cheques, and sale deeds of immovable property from electronic execution.

Sector regulators we touch#

• SEBI: research and investment advice to the public requires Research Analyst or Investment Adviser registration. Lakshmi stays internal until then.
• CDSCO (Medical Devices Rules 2017): software that analyses data to diagnose, screen, or inform treatment is a medical device. Lateral-flow cartridges are IVDs. Both need licensing before any clinical claim or sale.
• NMC Telemedicine Practice Guidelines 2020: only a Registered Medical Practitioner may consult or prescribe; AI may assist a doctor, never replace one, and may not prescribe.
• Bar Council of India / Advocates Act 1961: only enrolled advocates may practise law; advocates may not advertise. Legal-tech products must be tools, not practitioners.
• RBI, NPCI: payment rails as above.
• Ministry of Defence, NIC, STQC, GIGW 3.0, CERT-In empanelled auditors: any government or defence deployment needs a CERT-In empanelled security audit before go-live, accessibility to GIGW 3.0, and bilingual (Hindi and English) interfaces for central government under the Official Languages Act.

United States (largest paying market for Scribe, AIBookly, Digitailor, Dwell)#

There is no single federal privacy law. What applies regardless of our size:

• FTC Act section 5 (unfair or deceptive practices). This is the law behind every US enforcement we should fear: false "end-to-end encrypted" claims (Zoom, 2020), sharing health data with ad SDKs (GoodRx, BetterHelp, Premom, Flo), undisclosed AI, fake reviews, dark patterns, broken promises in a privacy policy. Say only what the code does.
• FTC Health Breach Notification Rule (amended 2024): applies to consumer health apps that are not HIPAA-covered. Breach of identifiable health data: notify affected users without unreasonable delay and within 60 days, notify the FTC (within 60 days if 500+ people, annually otherwise), and the media if 500+ in a state.
• COPPA (Children's Online Privacy Protection Act, 2025 amendments in force, compliance deadline April 2026): verifiable parental consent before collecting personal information from children under 13, separate consent for third-party disclosure, data retention policy, written security programme. Our apps are 18+ unless a specific child-directed design exists.
• CAN-SPAM: honest headers and subject lines, physical postal address in every commercial email, working unsubscribe honoured within 10 business days, no harvested lists. Transactional mail is exempt from opt-out but not from honesty.
• TCPA: prior express written consent for marketing texts and autodialled calls; consent for informational texts; honour STOP immediately. Statutory damages per message make this a lawsuit magnet.
• FTC Endorsement Guides (2023) and the Rule on Fake Reviews and Testimonials (effective October 2024): disclose material connections, no AI-generated or fabricated reviews, no buying or selling fake social-media indicators (followers, likes). Scribe and Planet outreach must never manufacture social proof.
• ROSCA (subscriptions): clear disclosure of all material terms before billing, express informed consent, simple cancellation. The FTC "click-to-cancel" rule was vacated in July 2025 (verify), but ROSCA and state auto-renewal laws remain. California's Automatic Renewal Law (amended 2025) is the template: online cancel for online signup, renewal reminders, price-change notice.
• ESIGN Act 2000 and UETA: electronic signatures are valid when the signer consents to do business electronically, intends to sign, and the record is retained and reproducible. Consumer disclosures under ESIGN 101(c) need a specific consent flow with hardware and software requirements disclosed.
• ADA Title III: websites of "public accommodations" are regularly sued for inaccessibility. WCAG 2.1 AA is the de facto standard, 2.2 AA is the target.
• DMCA section 512: hosting user uploads needs a registered DMCA agent with the Copyright Office, a notice-and-takedown process, and a repeat-infringer policy to keep safe harbour. Section 1201 anti-circumvention is the live risk for RM Music.
• 18 U.S.C. 2258A: providers who become aware of apparent child sexual abuse material must report to NCMEC. Drive, Nest, Meet recordings, MyJanata uploads: have a path.
• Sanctions (OFAC): do not serve comprehensively sanctioned countries or regions (Cuba, Iran, North Korea, Syria, Crimea, Donetsk, Luhansk). Stripe enforces this on payments; our country selector must mirror it.
• Export controls (EAR): mass-market encryption software is exempt under 5D002 treatment; local-AI models are open source. No action beyond not serving sanctioned users.
• CFAA and platform terms: automated access to third-party sites against their terms is a civil and sometimes criminal risk. Digitailor, Scribe, Planet, and RM Music all touch this.

State law that applies to small companies:

• California CalOPPA: any commercial site collecting PII from Californians must post a conforming privacy policy (categories, third parties, Do Not Track response, effective date). This applies at zero revenue.
• California CMIA section 56.06: any business offering software or hardware to consumers to maintain medical information is treated as a provider of health care for confidentiality purposes. RM Health is in scope.
• CCPA/CPRA: thresholds are $25 million revenue, 100,000 consumers, or 50% revenue from selling data. Plan for it: "Do Not Sell or Share" link, Global Privacy Control honoured, sensitive PI (health, precise location, racial origin, citizenship or immigration status, sex life, biometrics) limited-use option. The CPPA's automated decision-making and risk-assessment regulations phase in from 2026 to 2027 (verify).
• Texas TDPSA, Nebraska, and others without volume thresholds: Texas applies to any business not an SBA small business that processes Texans' data; we are currently small. Re-check yearly.
• Washington My Health My Data Act (effective March 2024): consumer health data of Washington residents needs a separate Consumer Health Data Privacy Policy, opt-in consent for collection and sharing, authorization for sale, no geofencing around health facilities, and carries a private right of action. Nevada and Connecticut have similar laws. RM Health and RM Pharma are squarely in scope.
• Illinois BIPA, Texas CUBI, Washington biometric law: written consent, retention schedule, no sale for biometric identifiers (face geometry, voiceprints). Meet captions and any face or voice recognition are in scope; plain transcription is not.
• State breach notification laws (all 50 states): timelines range from "most expedient" to 30, 45, or 60 days; some require AG notice above thresholds. Apply regardless of company size.
• Colorado AI Act (SB 24-205): obligations for developers and deployers of high-risk AI systems used in consequential decisions (employment, housing, health care, legal services, education, financial services, insurance). Effective date moved to 30 June 2026 (verify any further delay). Dwell screening, LegalOS, Merit, and RM Health coaching touch its categories.
• Utah AI Policy Act, Texas TRAIGA (January 2026), California SB 243 companion chatbots (January 2026), New York companion-bot law, Illinois HB 3773 (AI in employment, January 2026): the common thread is disclosure that the user is talking to AI, proactive disclosure in regulated occupations (health, legal), suicide and self-harm protocols for companion-style bots, and no manipulation. The universal AI rules in 02 satisfy these by default.
• NYC Local Law 144: bias audits for automated employment decision tools used by employers on NYC candidates. Applies if Digitailor ever serves the employer side.
• Sales tax on SaaS: roughly twenty states tax SaaS. Economic nexus thresholds are typically $100,000 of sales into the state. Track sales by state from day one so registration happens on time. Stripe Tax can calculate and file.

United Kingdom (largest paying market after the US for Scribe and AIBookly)#

• UK GDPR and Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025: lawful basis for every purpose, Article 13/14 notices, data subject rights within one month, DPIAs for high-risk processing (health data, children, large-scale monitoring, innovative AI), records of processing, processor contracts with Article 28 terms, breach notification to the ICO within 72 hours and to individuals without undue delay when high risk, a mandatory complaints procedure for data subjects, special-category data (health, sex life, sexual orientation, religion, ethnicity, biometrics for identification) only with an Article 9 condition (explicit consent in practice).
• Article 27 UK representative: a controller outside the UK offering services to UK residents must appoint a UK representative unless processing is occasional and low risk. With paying UK customers this is not occasional. (counsel: appoint one; the EU equivalent applies for EU users)
• ICO data protection fee: controllers processing UK personal data pay the annual fee unless exempt. (verify applicability to a non-UK-established controller; budget for it)
• International transfers: UK to India needs the UK International Data Transfer Agreement or the UK Addendum to the EU SCCs, plus a transfer risk assessment. Every UK customer contract and every processor we use must carry this.
• PECR 2003: consent for non-essential cookies and similar tracking (the 2025 Act added a narrow exemption for low-risk analytics, verify scope); marketing email to individuals needs opt-in or the soft opt-in (existing customer, similar products, opt-out offered at collection and in every message); corporate subscribers are outside consent but still get an opt-out; every marketing message identifies the sender and offers an unsubscribe. PECR fines now match UK GDPR levels.
• Online Safety Act 2023: user-to-user services and search services with links to the UK must complete an illegal-content risk assessment, remove illegal content, run a children's access assessment and, if children can access, a children's risk assessment with protections, provide reporting and complaints, and name a point of contact for Ofcom. Illegal-harms duties began in March 2025, child-safety duties in July 2025. Nest, Meet, Drive sharing, Music shared pool, MyJanata, Folio public profiles, Rollout creator CRM messaging are in scope if UK users can reach them. (counsel: confirm which RM services have "UK links")
• Age-Appropriate Design Code (Children's Code): if a service is likely to be accessed by under-18s, high privacy by default, no nudges, geolocation off, profiling off. Our default is 18+ with enforcement; Tulip is India-only.
• Consumer Rights Act 2015 and Consumer Contracts Regulations 2013: 14-day cancellation right for digital services bought online unless the consumer expressly waives it for immediate access; digital content must be of satisfactory quality; pre-contract information must be given. Digital Markets, Competition and Consumers Act 2024: CMA can fine directly up to 10% of turnover; fake reviews banned; drip pricing banned; subscription contract rules (pre-contract information, reminders, easy exit) phase in from 2026 (verify dates).
• CAP Code and ASA: substantiate claims, mark ads, influencer disclosure (#ad), no weight-loss ads targeted at under-18s, medical claims only for authorised products.
• Equality Act 2010: reasonable adjustments include accessible digital services. WCAG 2.2 AA.
• UK VAT on digital services to UK consumers: a non-UK business supplying digital services to UK consumers must register for UK VAT from the first sale; there is no threshold. B2B supplies are reverse-charged (collect and validate the customer's VAT number). (counsel: register or use a marketplace that handles it; Stripe Tax calculates but does not register for you)
• UK eIDAS: simple, advanced, and qualified electronic signatures; simple e-signatures are admissible and generally valid for ordinary contracts.
• Investigatory Powers Act 2016 and RIPA: recording or intercepting communications needs consent of participants or a lawful purpose; Meet and Mail must prompt and disclose.

European Union (secondary, handled by geo rule)#

We do not market to the EU but EU residents can sign up. Minimum programme:

• GDPR: same core as UK GDPR; EU SCCs (2021) for transfers to India; Article 27 EU representative once processing is not occasional; lead supervisory authority question if we ever establish in the EU.
• ePrivacy Directive: cookie consent before non-essential cookies, with the CJEU "Planet49" standard (no pre-ticked boxes).
• EU AI Act: prohibited practices since February 2025; general-purpose AI obligations since August 2025; transparency duties under Article 50 (tell users they are talking to AI, label deepfakes and AI-generated text published on matters of public interest) from August 2026; high-risk obligations (employment, education, essential services, law enforcement, migration) scheduled August 2026 for Annex III with a proposal to delay to 2027 (verify). None of our systems are sold to EU public authorities or employers today; Article 50 transparency is already our default.
• European Accessibility Act (June 2025): e-commerce and consumer digital services sold in the EU must meet EN 301 549; microenterprises (under 10 staff and under EUR 2 million turnover) are exempt from the service obligations. We currently qualify for the exemption; WCAG 2.2 AA keeps us ready.
• VAT OSS (non-Union scheme): digital services to EU consumers are taxed where the consumer is, from the first euro. Register via OSS or block EU consumer purchases until registered.
• Digital Services Act: hosting services must have a notice-and-action mechanism, statement of reasons for removals, a point of contact, and terms that describe moderation. Applies to Drive, Nest, Meet, MyJanata with EU users.

Everyone else#

• Canada (PIPEDA, CASL): CASL is the strictest anti-spam law in the world (express consent with full identification; no implied consent for cold email beyond narrow cases). Do not send marketing to Canadian addresses without express consent records.
• Australia (Privacy Act, Spam Act): notifiable data breaches within 30 days of assessment; Spam Act consent for commercial messages.
• Brazil (LGPD), Singapore (PDPA), Japan (APPI), South Korea (PIPA): treat as GDPR-like for notices and rights.
• Sanctioned and embargoed territories: not served, see OFAC above plus UK and EU sanctions lists.
• China, Russia: data-localisation regimes we cannot satisfy from India; do not market there and do not accept business customers established there without counsel.

The regime matrix#

What the country selector must do in code#

1. Store region and country on the account. Default unknown users to the strictest applicable behaviour for the feature, not the weakest.
2. Notices and consent: render the region-specific privacy notice version; show a cookie and tracking consent layer for UK and EU; honour Global Privacy Control for US users; show the DPDP notice in the user's chosen language where we have it.
3. Age: ask for date of birth or a self-declaration where the service is 18+; block under-13 everywhere; block under-18 in India for consumer products unless a parental-consent flow exists.
4. Rights portal: access, export, correction, deletion, and complaint for every user regardless of region; the law sets the minimum, we give everyone the same tools.
5. Tax: GST for India, VAT for UK and EU (with VAT-number validation for B2B), US sales tax by state once nexus is reached. Display prices with the tax treatment stated.
6. Cancellation: UK and EU users get the 14-day cancellation right and a waiver checkbox for instant access; everyone gets online cancellation in no more steps than signup.
7. Sanctions: refuse signups and payments from embargoed countries; log the refusal.
8. Breach routing: region tags decide which clocks run and which regulators get notified. Keep the tag queryable.
9. Copy: disclaimers and disclosures are region-aware (entertainment-only wording for US astrology users, BSA section 63 wording for Indian evidence, ESIGN consent for US signers).