Privacy Policy

1. Who We Are (Data Fiduciary)

2. Personal Data We Collect

• Flag Exchange request: your name, email address, phone number, full pickup address, city, PIN code, the condition and quantity of flags, any notes you add, and photographs you choose to upload.
• Contact form: your name, email address, phone number, subject and message.
• Volunteer / Join Us form: your name, email address, phone number, city, the role you wish to join as, and your message.
• Event registration: your name, email address, phone number, number of guests and any notes.
• Membership: your name, contact details and delivery address, together with the membership record created on successful payment.
• Donations: your name, contact details, donation amount, and the transaction reference returned by the payment gateway.
• Shop orders: your name, contact details, shipping address, order contents and the transaction reference.
• Story submissions: any content, images and attribution details you choose to send us.
• Technical data: your IP address is processed transiently by our server for security and rate limiting (see section 5). Standard web server logs may record request details.

We do not knowingly collect sensitive personal data such as caste, religion, political affiliation, health or biometric information, and we ask that you do not send such information to us.

3. Payment Information — What We Never See

4. Why We Use Your Data and Our Legal Basis

• To deliver the service you asked for — verifying and fulfilling a flag exchange, arranging collection, processing a donation, dispatching an order, registering you for an event.
• To communicate with you about your request, including confirmation emails, status updates and answers to your queries.
• To maintain accurate records of donations, memberships and orders, as required for our accounting, audit and statutory obligations.
• To keep the website secure — detecting and preventing abuse, spam, fraud and unauthorised access.
• To improve our programmes, understand demand, and report on our charitable work in aggregate, non-identifying form.
• To comply with applicable law and to respond to lawful requests from public authorities.

We do not sell, rent or trade your personal data. We do not use your data for automated decision-making or profiling, and we do not send marketing emails unless you have specifically asked us to.

5. Cookies, Local Storage and Tracking

6. Who We Share Data With

• Payment gateway (Razorpay) — to process your donation, membership or purchase.
• Hosting provider — our website and database are hosted on shared hosting infrastructure; the provider may technically have access to stored data in the course of maintaining the service.
• Delivery and logistics partners — where a physical pickup or dispatch is required, we share the name, address and phone number needed to complete it.
• Email delivery — confirmation and notification emails are transmitted through our hosting provider's mail service.
• Professional advisers and auditors — where required for accounting, audit or legal advice, under a duty of confidentiality.
• Public authorities — where we are required to disclose by law, court order, or a valid request from a law enforcement or regulatory body.

We do not share your personal data with any other organisation for their own marketing or commercial purposes.

7. How Long We Keep Your Data

• Flag exchange requests: retained while the request is active and for up to 3 years afterwards, so we can answer follow-up queries and report on programme delivery.
• Contact messages and volunteer enquiries: up to 2 years from your last contact with us.
• Donation, membership and order records: retained for at least 8 years, as required by Indian accounting, tax and audit rules.
• Security and rate-limiting records: automatically deleted within 24 hours.
• Story submissions published on the website: retained while published, and archived thereafter unless you ask us to remove them.

8. How We Protect Your Data

• All traffic to this website is encrypted in transit using HTTPS, and HTTP requests are redirected to HTTPS.
• All database access uses parameterised queries, which prevents SQL injection.
• Administrative access is protected by password hashing, login rate limiting and account lockout, session timeouts, session binding, and CSRF protection on every form.
• Public forms and lookup endpoints are rate limited to prevent scraping, brute force and abuse.
• The flag exchange tracker returns only a masked name, and tracking codes are generated using a cryptographically secure random source so they cannot be guessed or enumerated.
• Uploaded files are validated by content, renamed, and stored in a location where they cannot be executed.
• Security response headers, including a Content Security Policy, are applied across the site.
• Credentials are stored outside version control and are never exposed to the browser.

No method of transmission or storage is completely secure. While we work hard to protect your data, we cannot guarantee absolute security, and you share information with us at your own risk.

9. Your Rights

• Right to access — obtain a summary of the personal data we hold about you and how we are processing it.
• Right to correction — have inaccurate or misleading data corrected, and incomplete data completed.
• Right to erasure — ask us to delete personal data that is no longer needed for the purpose it was collected for, subject to our legal retention obligations.
• Right to withdraw consent — withdraw your consent at any time, as easily as you gave it. Withdrawal does not affect processing already carried out.
• Right to grievance redressal — raise a complaint with us about how we handle your data (see section 12).
• Right to nominate — nominate another individual to exercise your rights on your behalf in the event of your death or incapacity.

To exercise any of these rights, email us at sammantiranga@gmail.com with enough detail for us to identify your records. We will respond within 24-48 business hours, and in any event within the period required by law. We may need to verify your identity before acting on a request.

10. Children's Data

11. Data Location and Transfers

12. Grievance Officer

13. Data Breach Notification

14. Changes to This Policy