Privacy Policy

This Privacy Policy describes how nangaldewat.com (the "Platform"), a privately owned and independently operated information platform, handles personal data. It is prepared as a template with reference to applicable Indian data-protection law, including the Digital Personal Data Protection Act, 2023 (the "DPDP Act"), and must be reviewed by qualified Indian legal counsel before being treated as final.

1. Who operates the Platform

The Platform is operated by its private owner. It is not operated by any Resident Welfare Association, residents' body, village committee, government authority, or municipal body. The platform owner determines the purposes and means of processing personal data on the Platform.

2. Privacy by design and minimal collection

The Platform is built on a privacy-by-design approach:

• Only the minimum personal data needed for a stated purpose is collected.
• Sensitive directory fields (such as phone numbers, email addresses, and household references) are private by default and are subject to field-level visibility controls.
• Private areas of the Platform are excluded from search-engine indexing.
• Access to personal data is restricted by role-based access control, and access to directory data is logged.

3. What we collect

Depending on how you interact with the Platform, we may collect:

• Account data: email address, display name, and a password (stored only as a cryptographic hash).
• Register data: the name, house, and block or plot recorded in the resident register, and — where it has been provided — a mobile number and an email address used to contact you and to sign in.
• WhatsApp agreement record: whether you have agreed to receive WhatsApp messages, the date, the exact wording you were shown, and how the agreement was obtained.
• Directory data (private to signed-in residents): the name, house and block or plot held in the register, plus only those optional fields a participant chooses to provide and share, such as a profession, interests, phone, or email.
• Form submissions: the name, email address, and message you provide when contacting the Platform or submitting content, together with a reference number.
• Technical data: limited technical logs (such as IP address and browser type) for security, rate limiting, and audit purposes.

4. What we do not collect

• The Platform does not collect Aadhaar numbers.
• The Platform does not request government identity numbers, financial account details, or biometric data.
• The Platform does not use third-party advertising or tracking cookies. See the Cookie Policy.

5. Purposes of processing

Personal data is processed only for the following purposes:

1. Operating and securing the Platform, including authentication, session management, rate limiting, and the tamper-evident audit log.
2. Maintaining the private, consent-based directory for the participants who have joined it.
3. Receiving, tracking, and resolving contact requests, corrections, privacy requests, and legal notices.
4. Sending you notices on WhatsApp, where you have agreed to receive them (see section 7).
5. Publishing content that a submitter has provided for publication, subject to editorial review.
6. Complying with legal obligations.

6. Consent and voluntary participation

Directory participation is voluntary and invitation-based. Consent is recorded, including its purpose and scope, and may be withdrawn at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Agreement to receive WhatsApp messages is separate from directory participation, is optional, and is never a condition of holding an account or of access to your own records. It is dealt with in section 7.

7. Messaging you on WhatsApp

Where you have agreed to it, the Platform sends you notices on WhatsApp — such as water and power notices, meeting dates, and reminders about your own dues.

**It is optional and separate.** You can hold an account, use every part of the Platform, and receive everything else without agreeing to WhatsApp messages. Agreement is never required to register, to sign in, or to see your own records.

**Who delivers the messages.** They are sent through the WhatsApp Business Platform operated by Meta Platforms, Inc. and its affiliates ("Meta"). The Platform contracts with Meta directly; no reseller or intermediary is involved.

**What Meta receives.** To deliver a message, Meta receives your mobile number, the content of that message, and delivery information such as whether it was delivered and read. Meta also receives any message you send to the Platform's WhatsApp number. Meta does not receive your register entry, your directory fields, your dues records, or your sign-in credentials.

**Where that data goes.** Meta processes it on servers outside India. Section 16 of the DPDP Act permits the transfer of personal data outside India except to territories the Central Government has restricted, and the territories in which Meta processes this data are not currently restricted.

**Replies are not read.** The Platform's WhatsApp number sends notices only; nobody monitors it. Anyone who replies receives an automatic response naming a person and a telephone number to contact instead. Do not use it to report an emergency, a fault, or anything else needing an answer.

**How your agreement is recorded.** Each time agreement is given or withdrawn, the Platform records the date, the exact wording shown to you, and how it was obtained — by you on your profile page, by a tick during registration or invitation, or by an administrator recording what you said in person. That record is kept as evidence of the basis for messaging you, and a copy is available to you on request.

**How to stop.** You may stop WhatsApp messages at any time: switch them off on your profile page, reply STOP to any message, or ask an administrator. Stopping takes effect immediately and changes nothing else about your account, your records, or your access.

**Agreement belongs to the phone number, not to you personally.** If your mobile number changes, agreement given for the previous number does not carry across and you will be asked again. Where a household shares one handset, an agreement or a STOP applies to that number.

8. Role-based access

Personal data is accessible only to the platform owner and to specifically authorised roles, each limited to the data needed for their function. Administrative access does not constitute ownership of any data or of the Platform. Directory data is never exposed on public pages.

9. Retention

Personal data is retained only as long as needed for the purpose for which it was collected, for the resolution of any open request, or as required by law. Records that must be preserved for audit integrity are retained in the append-only audit log with minimal personal data.

10. Your requests

Subject to applicable law, you may ask the Platform to act on your personal data. Supported workflows are:

• Correction of inaccurate or outdated personal data.
• Withdrawal of consent to continued processing.
• Restriction of how your data is used or displayed.
• Export of the personal data you have provided, in a portable format.
• Anonymisation of records where full deletion is not possible or lawful.
• Deletion of your personal data, subject to legal retention requirements.

Requests may be submitted through the contact page (choose "Privacy request" or "Directory removal"). Every request receives a reference number and is tracked to resolution. We may need to verify your identity before acting on a request.

11. Children and minors

The Platform is not directed at children. The directory does not knowingly list minors without the verifiable consent of a parent or lawful guardian, and personal data of minors is never published on public pages. Processing of children's data, where it occurs at all, is intended to comply with the protections of the DPDP Act.

12. Security and breach response

The Platform uses hashed credentials, hashed session tokens, encrypted secrets, role-based access controls, rate limiting, and an append-only audit log. In the event of a personal data breach, the platform owner will assess the breach, mitigate it, and notify affected individuals and the relevant authority where and as required by applicable law.

13. Disclosure

Personal data is not sold, and it is not disclosed for advertising. It is disclosed only to:

• Service providers strictly needed to host and operate the Platform: the hosting provider on whose servers the Platform runs, the object-storage provider holding uploaded files, the provider delivering email sent by the Platform, and — where you have agreed to WhatsApp messages — Meta, as described in section 7.
• Persons acting within the Platform's role-based access controls, limited to the data each role needs.
• Any person or authority, where disclosure is required by law or by a lawful order.

Some of these providers process personal data on servers outside India. Such transfers are made in reliance on section 16 of the DPDP Act, which permits transfer except to territories restricted by the Central Government.

14. Grievances and contact

Privacy questions, grievances, and requests may be raised through the contact page. Where the DPDP Act or other applicable law requires a designated grievance or contact mechanism, the details will be published on the Platform once confirmed with counsel.

15. Changes to this policy

This policy may be updated from time to time. The current version, with its date of last update, will always be published on this page.