Privacy Policy

Antarjyoti(“we,” “us,” or “our”) operates the crowdfunding platform and Antarjyoti Model education programs available at antarjyoti.org. Our registered address is Block-18, Plot-04, Nehru Nagar (East), Near Kosanagar Govt. High School, Bhilai, Dist-Durg, Chhattisgarh — 490020, India.

This Privacy Policy explains what personal data we collect, why we collect it, how we use it, with whom we share it, how long we retain it, and what rights you have over it. It applies to all users of the Platform — visitors, registered users, Campaign Organizers, Donors, and webinar/program participants.

By using the Platform, you consent to the data practices described in this Policy. If you do not agree, please do not use the Platform.

This Policy is governed by the Information Technology (Amendment) Act, 2008 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI Rules”), and we aim to align with the standards of the Digital Personal Data Protection Act, 2023 (“DPDP Act”) as it comes into effect.

We collect the following categories of personal data from users of the Platform:

2.1 Account Information

• Full name
• Email address or mobile phone number (used as login identifier)
• Password (stored as a bcrypt hash — never in plaintext)
• Profile photo (optional)
• Account type (organizer / donor)
• Email verification status

2.2 Campaign Data (Organizers)

• Campaign title, story, category, and target amount
• Campaign media (photos and videos uploaded by the organizer)
• Beneficiary name, relationship to organizer, and cause details
• Campaign location and progress updates

2.3 KYC & Verification Documents (Organizers)

Before a payout is processed, Campaign Organizers must submit:

• Government-issued photo ID — PAN card, Aadhaar card, or passport
• For NGOs and institutions — registration certificate, 12A/80G exemption certificates, or equivalent
• Proof of bank account (cancelled cheque or bank statement)
• Bank account number and IFSC code (stored encrypted at rest using AES-256 encryption)
• Supporting documents verifying the campaign cause (medical records, bills, etc.)

KYC documents are classified as Sensitive Personal Data or Information (SPDI) under Indian law and are handled with heightened protection.

2.4 Donation & Payment Data (Donors)

• Donor name, email address, and mobile phone number
• Donation amount and campaign donated to
• Public message (if included with the donation)
• Payment reference ID (generated by Razorpay)
• Payment status and timestamp

We do not store your card number, CVV, UPI PIN, or net-banking credentials. All payment processing is handled by Razorpay.

2.5 Program Enrollment Data (Webinar & Residential Program Participants)

• Name, email address, and phone number
• Program batch, enrollment date, and payment details
• Attendance and completion records

2.6 Usage & Technical Data

• IP address (logged via server request logs)
• Browser type and version
• Operating system
• Pages visited and time spent on the Platform
• Referring URLs
• Device identifiers

2.7 Communication Data

• Messages submitted through our Contact Form
• Email correspondence with our support team

We use the personal data we collect for the following purposes:

• Account Management:To create and maintain your account, authenticate your identity, and enable you to use the Platform’s features.
• Campaign Operations: To review, publish, and manage fundraising campaigns and to communicate campaign updates to Donors.
• Payment Processing: To process donation payments via Razorpay and to execute payouts to verified Campaign Organizers.
• KYC Verification: To verify the identity of Campaign Organizers and the authenticity of campaigns before funds are disbursed.
• Fraud Prevention: To detect, investigate, and prevent fraudulent transactions, chargebacks, and misuse of the Platform.
• Communications: To send transactional emails (e.g., registration confirmation, donation receipts, campaign updates, password resets) via Resend.
• Program Delivery: To manage enrollment in and delivery of Antarjyoti Model webinars and residential programs.
• Legal Compliance: To comply with applicable laws, court orders, and government requests, including tax and financial reporting obligations.
• Platform Improvement: To analyse usage patterns and improve the functionality, security, and user experience of the Platform.
• Customer Support: To respond to your queries, complaints, and feedback.

We do not use your data for automated decision-making or profiling that produces legal or similarly significant effects without human review.

We process your personal data under the following legal bases:

• Consent: You have given clear consent for us to process your data for a specific purpose (e.g., creating an account, making a donation, enrolling in a program).
• Contractual Necessity: Processing is necessary to fulfil our obligations to you under our Terms of Service (e.g., processing a donation, executing a payout).
• Legal Obligation: Processing is required to comply with Indian law, including financial regulations, anti-money laundering obligations, and tax law.
• Legitimate Interests: Processing is necessary for our legitimate interests in preventing fraud, maintaining platform security, and improving our services, provided these interests are not overridden by your rights.

We share personal data with the following categories of trusted third-party service providers, only to the extent necessary to provide the Platform’s services:

We do not sell, rent, or trade your personal data to third parties for marketing purposes. We do not share your personal data with advertisers.

We may also disclose your data to law enforcement agencies, government bodies, or courts when required by law or to protect our legal rights.

We take the security of your personal data seriously and implement appropriate technical and organisational measures:

• Passwords are hashed using bcrypt and are never stored in plaintext.
• Bank account numbers are encrypted at rest using AES-256 encryption before storage.
• KYC documents and tax receipts are stored in a private, non-publicly accessible storage location and are served only via short-lived, cryptographically signed URLs. They are never publicly accessible.
• Data in transit is protected using TLS (HTTPS) encryption on all connections.
• Access controls limit access to personal data to authorised Antarjyoti personnel only, on a need-to-know basis.
• JWT tokens are used for session management with defined expiry periods (access tokens: 15 minutes; refresh tokens: 30 days).

No security system is impenetrable. In the event of a data breach that affects your rights and freedoms, we will notify you and relevant authorities as required by applicable law.

We retain your personal data for as long as your account is active or as long as needed to provide our services, comply with legal obligations, resolve disputes, and enforce our agreements:

• Account data — retained for the lifetime of your active account, plus an additional 7 years after account deletion or deactivation, to comply with Indian financial record-keeping regulations.
• Donation records & payout records — retained for a minimum of 7 years from the date of transaction for tax and audit purposes.
• KYC documents — retained for 7 years from the date of submission, or as required by applicable law.
• Server/request logs — retained for a maximum of 90 days, after which they are deleted.
• Contact form submissions — retained for 2 years.

Where we no longer have a legitimate purpose to retain your data, we will securely delete or anonymise it.

Subject to applicable Indian law, you have the following rights with respect to your personal data:

• Right of Access: You may request a copy of the personal data we hold about you.
• Right to Correction: You may request that we correct inaccurate or incomplete data. You can update most account information directly through your account settings.
• Right to Deletion: You may request deletion of your account and associated personal data. Note that we may be required to retain certain data for legal or regulatory reasons even after deletion.
• Right to Withdraw Consent: Where we process data based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.
• Right to Object: You may object to our use of your data for direct marketing or other processing based on legitimate interests.
• Right to Data Portability: Where technically feasible, you may request your data in a structured, commonly used format.

To exercise any of these rights, please contact us at info@antarjyoti.org with the subject line “Data Rights Request.” We will respond within 30 days.

We use cookies and similar technologies to operate and improve the Platform:

• Strictly Necessary Cookies: Required for the Platform to function (e.g., session management, CSRF protection). These cannot be disabled.
• Functional Cookies: Remember your preferences and login state between sessions.
• Analytics Cookies: We may use aggregated, anonymised analytics to understand how users interact with the Platform.

You can control or delete cookies through your browser settings. Disabling certain cookies may affect the functionality of the Platform.

The Platform is not directed at children under the age of 18 years. We do not knowingly collect personal data from minors. If we become aware that we have collected personal data from a child without verifiable parental consent, we will take steps to delete that data promptly. If you believe we may have data about a child, please contact us at info@antarjyoti.org.

Your data is primarily stored and processed in India. Some of our third-party service providers (such as Razorpay and Resend) may process data in other countries. When data is transferred outside India, we ensure that appropriate safeguards are in place in accordance with applicable Indian data protection law. By using the Platform, you consent to such transfers.

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will notify you of material changes by posting the updated Policy on this page with a new effective date, and where appropriate, by sending you an email notification. Your continued use of the Platform after any update constitutes acceptance of the revised Policy.

For any privacy-related questions, requests, or concerns, please contact our data protection point of contact: