Privacy Policy

1. Who we are

VoiceOfVillage ("we", "us", "the platform") operates the website at https://www.voiceofvillage.com, a directory and community platform for every revenue village of India. This Privacy Policy explains what personal data we collect about you, why we collect it, who we share it with, and how you can exercise your rights over it.

We are a Data Fiduciary under the Digital Personal Data Protection Act 2023 ("DPDP Act") of India. We are also subject to the privacy terms of the third-party identity providers we integrate with (Google, Meta/Facebook, LinkedIn, X/Twitter, Apple, DigiLocker).

2. What data we collect

2.1 You give us directly

• Account identifiers. Phone number (when you sign in via OTP), email address and name (when you sign in via Google / Meta / Apple / LinkedIn / X), or DigiLocker e-KYC hash (never the 12-digit Aadhaar number itself).
• Profile content. Display name, profile photo, village(s) you claim, biographical text, language preference.
• Posts and contributions. Text, photos, audio, and other content you submit to village pages, the Grama Sabha, jobs board, marketplace, or comments.
• Payment details. When you donate or pay for a premium listing, Razorpay processes the transaction. We see only an order ID, amount, and success/failure status — never your card number or banking credentials.

2.2 We collect automatically when you use the site

• Device and connection. IP address (truncated to /24 within seven days), user-agent string, viewport dimensions, browser language.
• Usage analytics. Pages visited, time spent, clicked links, referrer URL. Stored as aggregates after 30 days.
• Cookies. A session cookie for authenticated visitors, a locale preference cookie, and a CSRF token. We do not run third-party advertising trackers.

2.3 We receive from third-party identity providers

When you sign in via Google, Facebook, LinkedIn, X, or Apple, the provider sends us: your name, email address, and a stable user ID. We do not request access to your contacts, friends list, posts, or any non-essential scope. We retain this data only while your VoiceOfVillage account is active.

3. Why we use your data (purpose & legal basis)

4. Who we share data with

We share personal data only with the following categories of recipients:

• Cloud and infrastructure providers. Amazon Web Services (ap-south-1 / Mumbai) hosts our servers, database, and storage. Cloudflare/Amazon CloudFront accelerate content delivery. All providers process data within India.
• Identity providers (Google, Meta, LinkedIn, X, Apple, DigiLocker) only for the OAuth handshake. We never re-share data back to them.
• Payment processor. Razorpay (PCI-DSS Level 1 certified, India- regulated) handles money movement. We pass them only the order amount and your name.
• SMS gateway. MSG91 (India) delivers OTP and notification SMS. They see only the phone number and the OTP/text content.
• Law enforcement when compelled by valid Indian legal process. We publish an annual transparency report listing the number of requests we received.

We do not sell, rent, or lease personal data to advertisers, data brokers, or any other third party.

5. International transfers

Personal data of users in India is stored and processed in AWS Mumbai (ap-south-1). We do not transfer Indian user data outside India except where the user explicitly initiates an interaction with a third-party platform (e.g. clicking an outbound link, signing in via a foreign identity provider). Such interactions are governed by that platform's privacy policy.

6. Data retention

• Active account data: kept while your account is active.
• Posts and contributions: kept until you delete them.
• Server access logs: 90 days, then aggregated.
• OTP records: 24 hours.
• Payment records: 7 years (as required by Indian tax law).
• Audit logs of admin actions: 7 years (DPDP compliance audit retention).

When you delete your account (Dashboard → Settings → Privacy → Delete Account), we hard-delete your profile, contributions, and identifiers within 30 days. Anonymised aggregates may remain.

7. Your rights

Under DPDP Act 2023, you have the right to:

1. Access the personal data we hold about you.
2. Correct or update inaccurate data.
3. Erase your data (subject to legal-retention exceptions above).
4. Nominate another person to exercise these rights if you become incapacitated or pass away.
5. Withdraw a previously-given consent.
6. Lodge a grievance with us, and escalate to the Data Protection Board of India if unresolved.

Exercise any of these by emailing privacy@voiceofvillage.com or through Dashboard → Settings → Privacy. We respond within 30 days as required by the DPDP Act.

8. Children

The platform is not directed at children under 18. We do not knowingly collect data from minors. If we learn that a user is under 18 and has not received verifiable parental consent, we delete the account.

9. Security

All traffic to and from the platform is encrypted in transit (TLS 1.2+). Data at rest is encrypted with AWS KMS. Database access is restricted to a single private subnet; no public Postgres endpoint is exposed. Passwords (when used) are hashed with Argon2id. Card data is never seen by our servers (Razorpay redirect / inline checkout). We carry out internal security reviews of every code change.

10. Grievance officer

In compliance with the DPDP Act and India's Information Technology Rules:

• Grievance Officer: VoiceOfVillage Grievance Team
• Email: grievance@voiceofvillage.com
• Response time: We acknowledge within 24 hours and resolve within 30 days.

11. Changes to this policy

When we make a material change to this policy, we email registered users at least 30 days before the new terms take effect. A change log is maintained at /legal/changelog.

12. Contact

Questions, requests, complaints? Reach the privacy team at privacy@voiceofvillage.com.