Privacy Policy

1. Introduction

Sangathan ("Platform," "We," "Us") is a governance infrastructure provider for collectives, NGOs, and community organisations. We respect your privacy and are committed to protecting the personal data you entrust to our infrastructure. This Privacy Policy explains how we collect, use, store, and share your information in compliance with the Information Technology Act, 2000, and other applicable laws in India.

2. Scope & Role

Our Role: Sangathan acts primarily as a Data Processor (Infrastructure Provider). The Organisation (your NGO, union, or collective) acts as the Data Controller.

Your Role: If you are an Organisation Admin, you control the data entered into your workspace. If you are a Member, your data is controlled by the Organisation you belong to.

3. Information We Collect

A. Information You Provide

• Account Information: Name, Email Address, and Password for all users.
• Phone Verification (Admins): We collect and verify mobile numbers for Organisation Admins to ensure accountability and prevent platform abuse.
• Organisation Data: Name, Slug, Description, and structural details of the collective.
• Member Records: Names, contact details, designations, and status of members added by the Organisation.
• Form Submissions: Data collected via public or private forms created by an Organisation.
• Donation Logs: Records of financial contributions (Amount, Donor Name, Date) logged by the Organisation. Note: We do not process the actual funds.

B. Information Automatically Collected

• Audit Logs: We record critical actions (creation, deletion, updates) performed within the Platform for security and accountability.
• System Logs: IP addresses, browser type, and timestamps are logged for security monitoring, rate limiting, and abuse prevention.

4. How We Use Information

We use your information strictly for the following purposes:

• To provide, maintain, and improve the Platform's infrastructure.
• To verify the identity of Organisation Admins.
• To enforce our Terms of Service and prevent abuse (spam, fraud, illegal activities).
• To comply with legal obligations and law enforcement requests under Indian law.
• To communicate with you regarding security updates, technical issues, or policy changes.

No Political Profiling: We do not use your data to build political profiles, target advertising, or influence your Organisation's objectives.

5. Data Storage & Security

Infrastructure: Your data is hosted on encrypted cloud PostgreSQL database clusters, utilizing industry-standard TLS 1.3 encryption in transit and AES-256 encryption at rest.

Isolation: We employ strict Row-Level Security (RLS) policies at the database layer to ensure that data belonging to one Organisation is completely isolated from all other workspaces.

Access Controls: Access to the underlying database is restricted to authorized System Administrators for maintenance, security investigation, or legal compliance purposes only.

6. Google API Services User Data Policy & Limited Use Disclosure

Sangathan integrates optional Google Workspace tools (such as Google Contacts, Google Sheets, Google Forms, and Google Calendar) to help grassroots organizers and administrators efficiently onboard members, migrate past survey data, and coordinate community assemblies.

A. Google Data Accessed & Purpose of Use

When you explicitly authorize Sangathan to access your Google account, our application accesses only the specific scopes you have granted for the following explicit functionalities:

• Google Contacts (https://www.googleapis.com/auth/contacts.readonly): Accessed strictly when an administrator chooses to import contacts to invite members to their collective workspace or populate their member directory. Sangathan reads only the contact names, email addresses, phone numbers, and organization tags selected by the user.
• Google Sheets (https://www.googleapis.com/auth/spreadsheets.readonly): Accessed when an administrator connects a Google Sheet to import existing member spreadsheets or response rows directly into Sangathan with automated column matching and deduplication.
• Google Forms (https://www.googleapis.com/auth/forms.body.readonly and https://www.googleapis.com/auth/forms.responses.readonly): Accessed when an administrator imports a Google Form to migrate the form questions, field types, and historical survey submissions into Sangathan's Form & Survey Studio.
• Google Calendar (https://www.googleapis.com/auth/calendar.events and https://www.googleapis.com/auth/calendar): Accessed when an organizer opts to synchronize collective meetings, townhalls, or field survey rosters to their personal or organization calendar.

B. Google API Limited Use Compliance

C. Privacy Commitments Regarding Google User Data

• No Data Selling: We do not sell, rent, or monetize Google user data to any third party under any circumstances.
• No Advertising or Profiling: We do not use Google user data for serving advertisements, retargeting, personalized advertising, or building consumer profiles.
• No AI Model Training: Google user data is not used to train generalized artificial intelligence or machine learning models.
• Strict Human Access Restrictions: No human at Sangathan is allowed to read your Google user data unless: (1) we have obtained your prior explicit consent for specific troubleshooting; (2) it is necessary for security purposes, such as investigating security abuse or incidents; or (3) as required by law.

D. User Control & Revocation

You can revoke Sangathan's access to your Google account at any time through your Google Security Settings at https://myaccount.google.com/permissions or from your Sangathan Workspace Settings. Once revoked, Sangathan will immediately lose all access to your Google API tokens.

7. Data Sharing & Third Parties

We do not sell your data. We share data only with the following infrastructure sub-processors required to operate the Platform:

• Enterprise Database & Authentication Providers: Managed database hosting, session authentication, and SMS delivery for administrator verification.
• Global Edge Networks: Encrypted web hosting and edge content delivery networks.

We may disclose data if required by law, such as in response to a court order or valid subpoena from Indian law enforcement agencies.

8. Data Retention & Deletion

Retention: We retain your data only for as long as your account and collective workspace remain active.

Soft Deletion: When you delete an account or Organisation, data enters a "soft-delete" state for a grace period (e.g., 7-14 days) to allow for recovery from accidental deletion. After this period, data is permanently removed from our active database.

Legal Hold: We may retain specific data (including Audit Logs and Admin contact info) beyond deletion if required for ongoing legal investigations or compliance with Indian data retention laws.

9. Your Rights

• Access & Export: Organisation Admins can export their Organisation's data (members, logs, submissions) at any time via the dashboard.
• Correction: You may update your account information directly through the settings.
• Deletion: You may request the deletion of your account or Organisation via the platform settings.

10. Contact Us

If you have questions regarding this Privacy Policy, Google user data practices, or our data security architecture, please contact our Data Protection Officer at: privacy@sangathan.space