Versioned notices, unbundled per-purpose consent, and a hash-chained consent ledger with notice-content evidence. Under 5 KB. No database access. Free to start.
We process your personal data for the purposes below. Choose each one separately — you can change or withdraw any of them later, in the same number of steps.
No consent platform can make you “DPDP compliant”, ours included, and anyone selling you that is selling you a problem. This handles the obligations that live at the point of collection and the point of request. The rest stays with you, and your dashboard says so in plain terms.
Wired up the moment the script loads.
We can evidence these. We cannot do them for you.
None of this is conceptually hard. It is just a lot of fiddly, legally-load-bearing detail that has nothing to do with your product.
Publish a reviewed notice with a captured policy snapshot or PDF. Every affirmative decision is bound to that exact version and content hash.
Reviewed translations are not available yet, so the product does not claim them.
Per-purpose toggles, nothing pre-ticked, and “Reject all” given exactly the same prominence as “Save choices”. The widget will not let you ship a bundled consent flow even if you try.
s.6(1) and s.6(4), enforced in the component.
Every grant and withdrawal becomes a hash-chained record carrying the notice version, locale, timestamp, and the affirmative action captured. Evidence is retained immutably and viewable by the tenant owner.
This is the artifact you produce when asked to prove consent.
Requester verification, SLA clocks, and signed webhooks are the next Indie release. They are deliberately not presented as available today.
Until then, fulfil rights requests through your own product support flow.
Under 5 KB gzipped, async, no dependencies, served from the edge. Consent decisions evaluate locally against a cached ledger — no network call in your hot path.
If our edge is down the widget renders from cache and queues.
No VPC peering, no database credentials, no collector to deploy, no security review. We never see your data — only pseudonymous references and the consent decisions themselves.
Which is also why signup is instant.
The production script tag gets you a reviewed notice and consent. React helpers and rights webhooks are planned releases, not current dependencies.
<script src="https://cdn.scalepulse.in/sp.js" data-key="pk_live_7f3a…" data-purposes="analytics,marketing.email,personalisation" data-lang="auto" // Eighth Schedule detection, manual switcher defer ></script> // Read a decision anywhere. Local, no network call. <script> if (window.ScalePulse.allows('analytics')) { initAnalytics(); } </script>
| ScalePulse Indie | Enterprise CMP | Build it yourself | |
|---|---|---|---|
| Time to live | Minutes | Weeks — scoping, onboarding, review | Weeks of your own time |
| Cost | Free, then ₹999/mo | Annual contract, sales-led | Your time, plus translation |
| Reviewed translations | In build | Usually available | You commission and maintain them |
| Integration | One script tag | Tag manager, config, often a CSM | You own every edge case |
| Database access | None | Often a collector or VPC peering | N/A |
| Consent proof | Hash-chained, exportable | Yes | Whatever you remembered to log |
| Rights portal | In build | Yes, usually a paid module | Another project |
The middle column is a generic characterisation of enterprise consent platforms, not a claim about any named vendor — their pricing is contract-specific and we are not going to invent numbers for it. Compare against your own quotes.
The free tier is generous because it costs us close to nothing to run at the edge — not as a trap with a cliff at the end.
For a side project, a launch, or your first hundred users.
When it is a real product with real users and a brand.
Several products, a team, and someone asking about SLAs.
The script is under 5 KB gzipped, has no dependencies, loads defer, and is served from the edge. It does not block render and it does not touch your critical path.
After the first load, consent decisions are read from a local cache, so allows() is synchronous and sub-millisecond. The size budget is enforced by a CI check that fails our build if it regresses.
No — and you cannot, on this tier. There is no collector, no VPC peering, and no credentials to hand over. We only ever see pseudonymous references and the consent decisions themselves.
That is also the limitation: because we cannot see your data, we cannot scan it for retention overruns or find personal data you forgot about. That is the platform product, and it is a different kind of install.
Not yet. We support the locale you publish today. Reviewed translations are a separate programme because machine-translating legal notices is not a defensible substitute.
The dashboard will show locale coverage once translated notice versions and reviewer sign-off are available. Until then, do not represent the widget as meeting the multi-language requirement.
Today, they use your own support or account flow. ScalePulse currently records consent decisions; its verified rights portal and webhook routing are the next Indie release.
Your app does the deleting. We cannot reach your data. Until the portal launches, you must track verification, fulfilment, and response timing yourself.
No, and we are careful about this. “Consent Manager” is a defined role under the Act — a registered intermediary through which a Data Principal can give, manage, review, and withdraw consent, subject to registration and eligibility criteria set by the Board.
ScalePulse is a consent management platform: software you, the Data Fiduciary, use to discharge your own obligations. You remain the Data Fiduciary and we act as your Data Processor. If you need a registered Consent Manager, you need a registered entity, and we will say so rather than blur it.
No. Today it covers versioned notice and consent capture. Rights-request handling, security safeguards, retention, processor contracts, and breach notification remain your obligations.
Security safeguards, retention limits, contracts with your processors, and breach notification remain your obligations. The coverage panel above is the same one in your dashboard, and it is deliberately blunt about the gap.
One script tag, a purpose list, and you have defensible consent records from your very next visitor. Everything else can come later.