Programs designed with the cost per outcome right, before the budget locks.
Find out what people will actually do, before you build for what you assumed.
Purpose-built systems that work on the ground, not only on the dashboard.
Field operations that turn a plan on paper into work on the ground.
A Consent Management Platform with a DPO dashboard, a data principal portal and a staff portal. Backed by a baseline assessment, expert advice and a compliance programme of three to twelve months.
DPDP Act 2023 · DPDP Rules 2025 · Data in India
What we offer
The Consent Management Platform is three portals: one for your DPO, one for the people whose data you hold, and one for your staff. Around it sits the work that makes it real.
A DPO dashboard, a data principal portal and a staff portal, white-label and hosted in India.
Every question tied to the Act, answered by the team that owns it, with “I do not know” counted as a gap.
Purposes and lawful basis, notices and policies, vendor contracts, children's data, board briefings and breach drills.
Fix the gaps, roll out the platform, train your people, and be audit ready.
3 to 12 months
The platform your DPO opens every morning.
The DPO's record, and the same choices in the hands of the person they belong to.
What the law asks, and where it lives in the product.
Plain, itemised and multilingual, with audio for people who do not read.
Free, specific and informed: a separate choice for each purpose.
Verifiable parental consent, checked by OTP, ID or family record.
Access, correction, erasure and grievance, with a timer on each.
Keep only as long as needed, and erase on schedule.
Tell the Board, and tell the people affected, in their language.
A portal in the person's own name: what data you hold, which purposes they have agreed to, and a way to change their mind that actually takes effect.
Discover the systems that hold personal data, classify what is in them, set retention before collection, and manage the vendors who touch it.
A breach is a clock, not a conversation. Log it in a minute, contain and assess it, notify on time, and record what changed afterwards.
A baseline assessment with every question tied to the Act, answered by the team that owns that part of the work, and a plan that comes out of it on day one.
Four promises that hold on every screen, for every user, from the first sign-up to the last report.
Your platform, your name.
In the language people speak.
Built for patchy networks.
Consent first, on every screen.
Most personal data enters your organisation on the first day.
Children's data needs a parent's yes, checked properly.
Supporters expect the same respect as the people you serve.
Research data is often the most sensitive you hold.
People reach you where they are, not on a web form.
A complaint is a chance to fix things.
Saying no should be as easy as saying yes.
Some people need someone to act for them.
Leaders are accountable for data, so they need to see it.
Your vendors handle your data too.
Minutes matter when data leaks.
Privacy is easier when it is designed in from the start.
Four things every organisation needs first.
Plain, itemised and multilingual, with audio for people who do not read.
Free, specific and informed, and as easy to take back as to give.
Access, correction, erasure and grievance, with a timer on each.
Every notice version, consent and change, in one download.
Every person whose name sits in your systems deserves the same respect.
01The people your programmes serve, who gave their data on day one.
02Whose data needs a parent's verified yes, and no tracking at all.
03Who chose email, WhatsApp or SMS, separately, and can change it.
04Whose records are kept only as long as the programme needs them.
05Who consented to one study, and whose names come off after analysis.
Gender Equality
Industry, Innovation and Infrastructure
Reduced Inequalities
Peace, Justice and Strong Institutions
Partnerships for the GoalsEvery feature
Consent
Rights and records
Governance
Pieces of the product teams open every day.
1,312
Active in 18 states
1,18,240
Open any one to see it in the product.
Plain, itemised, multilingual notices with audio, versioned every time they change.
Purpose-wise consent across every programme, with the ledger behind it.
One queue for the portal, WhatsApp and the helpline, with a timer on each.
Every system that holds personal data, what is in it, and when it should go.
1,18,240
Log, assess, notify and learn, against the clock the law sets.
318
will sync on Wi-Fi
Their own view of what you hold, and a withdrawal that takes effect everywhere.
1,18,240
318
will sync on Wi-Fi
Before the baseline we could not have told you which systems held a child's name. Now the map names all fourteen, and three of them have gone.
The notice is read aloud in Assamese and the person ticks the purposes themselves. Nobody signs something they have not heard.
The board pack used to be a scramble. The audit pack is a download now, and I can see the gaps before anyone else does.
Check consent through an API before any system uses data. Connects to your beneficiary apps, CRM, surveys, WhatsApp and SMS, and to every Commons product.
Priced by the number of people whose data you hold. Every plan is white-label and hosted in India: your name on every notice, consent screen and request portal.
For small organisations getting started
Custom
For programmes with lakhs of beneficiaries
Custom
For networks, foundations and significant data fiduciaries
Custom
“Tell us how your programme runs today. We will show you the product on your own workflow, and be honest about whether it fits.”
Yes. Any organisation that processes digital personal data in India is a data fiduciary, whether it sells products or serves communities.
Yes. Notices can be read aloud by a field worker, consent captured offline in the app, and a copy sent by SMS. Paper forms can be scanned and logged.
The system asks for verifiable consent from a parent or guardian, checked by OTP, ID or family record, and blocks tracking or targeting of children.
No. It is a system that makes compliance practical. We work with your legal advisers to set purposes, retention and notices for your organisation.
Yes; we stay through launch until your team runs it.
Beneficiary, donor and volunteer data handled with care.
Grantee and beneficiary data across partners.
Consent captured offline, in every language.
One consent layer across many systems.
“Consent is not a checkbox. It is a promise to every person whose story sits in your database.*”
“commons stayed through the messy months after launch, training our team and fixing what the field broke, until the system genuinely ran without them.*”
Project management for nonprofits: organise teams, volunteers and partners into projects and tasks, with lists, boards, timelines, portfolios, goals and a field app that works offline.
Conversational analytics: ask any question about your programmes in plain English and get live reports on learning, livelihoods and more.
Surveys for the social sector: build in minutes, collect on web, WhatsApp and an Android app that works offline, check quality as answers arrive.
Grant management for grant makers and grant seekers: calls for proposals, AI review, due diligence, milestone tranches and reports, plus an AI proposal writer for nonprofits.
A short demo, on your programme’s real workflow.
