In simple words
We collect as little about you as we can, we never sell it, and you can ask us to show, correct or delete it.
- No cookies and no advertising trackers.
- We never ask for Aadhaar, PAN or any other ID.
- Payments go through Razorpay. We never see your card or UPI details.
- Ask to see, correct or delete your data by writing to support@forthepeople.in.
Jump to a part
- 1About this policy
- 2What data we process
- 3What we do not collect
- 4Data retention
- 5Your rights under DPDP Act, 2023
- 6Grievance officer
- 7Children's data
- 8Cross-border data transfers
- 9Automated decision-making and AI processing
- 10Data security
- 11Data breach notification
- 12Third-party services
- 13Updates to this policy
- 14Contact
1. About this policy
ForThePeople.in is an independent citizen transparency platform built by Jayanth M B in Bengaluru, Karnataka, India. It is not an official government website. This Privacy Policy explains how we collect, process, and protect your personal data, in compliance with the Digital Personal Data Protection (DPDP) Act, 2023.
By using this platform, you agree to the practices described below.
Operator: Jayanth M B, Bengaluru, Karnataka, India
Contact: support@forthepeople.in
2. What data we process
| Data | What exactly | Purpose | Legal basis under DPDP Act |
|---|---|---|---|
| Vote fingerprint | SHA-256 hash of IP + browser user-agent (not reversible) | Prevent duplicate votes on the features page | Legitimate interest (platform integrity) |
| Feedback email | Email you voluntarily enter in the feedback form | Respond to your feedback | Your consent |
| Supporter info | Name, email, contribution amount, optional social handle; for monthly plans, a 10-digit phone number (UPI AutoPay or a bank mandate needs it, so it is also shared with Razorpay) | Process contributions, set up monthly payments, display on contributor page if opted in | Contractual necessity + consent |
| Payment details | Card, UPI, bank details — processed entirely by Razorpay. We never see or store these. | Complete your contribution | Contractual necessity |
| Server logs | IP address, browser type, request URL, timestamp | Security, abuse prevention, debugging | Legitimate interest |
| Error logs (Sentry) | Stack traces, browser type, URL. No personal identifiers captured. | Fix bugs | Legitimate interest |
| Analytics (Plausible) | Aggregated page views, referrer country. No cookies, no personal identifiers. | Understand which districts and modules are useful | Legitimate interest |
What data we process, why, and the legal basis
Vote fingerprint
- What exactly
- SHA-256 hash of IP + browser user-agent (not reversible)
- Purpose
- Prevent duplicate votes on the features page
- Legal basis under DPDP Act
- Legitimate interest (platform integrity)
Feedback email
- What exactly
- Email you voluntarily enter in the feedback form
- Purpose
- Respond to your feedback
- Legal basis under DPDP Act
- Your consent
Supporter info
- What exactly
- Name, email, contribution amount, optional social handle; for monthly plans, a 10-digit phone number (UPI AutoPay or a bank mandate needs it, so it is also shared with Razorpay)
- Purpose
- Process contributions, set up monthly payments, display on contributor page if opted in
- Legal basis under DPDP Act
- Contractual necessity + consent
Payment details
- What exactly
- Card, UPI, bank details — processed entirely by Razorpay. We never see or store these.
- Purpose
- Complete your contribution
- Legal basis under DPDP Act
- Contractual necessity
Server logs
- What exactly
- IP address, browser type, request URL, timestamp
- Purpose
- Security, abuse prevention, debugging
- Legal basis under DPDP Act
- Legitimate interest
Error logs (Sentry)
- What exactly
- Stack traces, browser type, URL. No personal identifiers captured.
- Purpose
- Fix bugs
- Legal basis under DPDP Act
- Legitimate interest
Analytics (Plausible)
- What exactly
- Aggregated page views, referrer country. No cookies, no personal identifiers.
- Purpose
- Understand which districts and modules are useful
- Legal basis under DPDP Act
- Legitimate interest
3. What we do not collect
Aadhaar, PAN, voter ID, driving licence, or any government-issued ID
Personal data of citizens from government portals (we only collect aggregated/statistical data)
Cookies — zero cookies of any kind on this platform
Tracking pixels or third-party advertising trackers
Location data (GPS or precise geolocation)
Biometric data
Financial account numbers or credit card details
Your contacts, photos, or device storage
We do NOT sell, rent, license, or share your data with advertisers or data brokers.
4. Data retention
| Data | How long | Why |
|---|---|---|
| Feedback | 12 months from submission | Support and follow-up, then deleted |
| Vote fingerprints | Until the feature is built, shipped, or removed — max 24 months | Prevent duplicate voting |
| Supporter data | 7 years minimum | Indian Income Tax Act record-keeping requirement |
| Server logs | 30 days | Vercel platform default; security investigations |
| Error logs (Sentry) | 90 days | Debugging |
| Analytics (Plausible) | Aggregated indefinitely; individual visit data not retained | Analysis is stateless |
How long we keep each kind of data, and why
Feedback
- How long
- 12 months from submission
- Why
- Support and follow-up, then deleted
Vote fingerprints
- How long
- Until the feature is built, shipped, or removed — max 24 months
- Why
- Prevent duplicate voting
Supporter data
- How long
- 7 years minimum
- Why
- Indian Income Tax Act record-keeping requirement
Server logs
- How long
- 30 days
- Why
- Vercel platform default; security investigations
Error logs (Sentry)
- How long
- 90 days
- Why
- Debugging
Analytics (Plausible)
- How long
- Aggregated indefinitely; individual visit data not retained
- Why
- Analysis is stateless
5. Your rights under DPDP Act, 2023
You have the following rights over your personal data:
- Right to Access: Request a copy of what we hold about you
- Right to Correction: Request correction of inaccurate data
- Right to Erasure: Request deletion of your data (subject to legal retention requirements)
- Right to Withdraw Consent: Withdraw previously given consent at any time (this does not affect processing that occurred before withdrawal)
- Right to Grievance Redressal: Raise concerns about our data practices and receive a response
- Right to Nominate: Nominate another individual to exercise these rights in case of your death or incapacity
How to exercise: Email support@forthepeople.in with the subject line "DPDP Data Request". We will respond within 30 days. If you are unsatisfied with our response, you have the right to file a complaint with the Data Protection Board of India.
6. Grievance officer
Under DPDP Act 2023, we have designated the following as our Grievance Officer:
- Name: Jayanth M B
- Role: Founder & Data Fiduciary Contact
- Email: support@forthepeople.in
- Response time: Within 30 days of receipt
7. Children's data
ForThePeople.in is not directed at children under 18. We do not knowingly collect personal data from minors. Feature voting uses anonymous fingerprints that cannot identify individuals, including minors. If you are a parent or guardian and believe a child has submitted personal data (for example, via the feedback form), please contact us immediately at support@forthepeople.in and we will delete it within 72 hours.
Under DPDP Act 2023, we do not engage in targeted advertising or behavioural monitoring of children.
8. Cross-border data transfers
Some of our processors store or process data on servers outside India. We disclose these clearly:
| Processor | Purpose | Data location |
|---|---|---|
| Vercel | Hosting | Global edge + US origin |
| Razorpay | Payments | India |
| Neon | Database | Can be configured per region; currently hosted in an Asia region |
| Upstash | Cache | Global (AWS regions) |
| Plausible | Analytics | EU (Germany) |
| Resend | Admin email | US |
| Sentry | Error logs | US |
Where each processor stores or processes data
Vercel
- Purpose
- Hosting
- Data location
- Global edge + US origin
Razorpay
- Purpose
- Payments
- Data location
- India
Neon
- Purpose
- Database
- Data location
- Can be configured per region; currently hosted in an Asia region
Upstash
- Purpose
- Cache
- Data location
- Global (AWS regions)
Plausible
- Purpose
- Analytics
- Data location
- EU (Germany)
Resend
- Purpose
- Admin email
- Data location
- US
Sentry
- Purpose
- Error logs
- Data location
- US
These transfers are made under contractual safeguards with each processor. The Government of India may from time to time restrict certain countries for cross-border transfers under DPDP Act 2023; we will update this list if that happens.
9. Automated decision-making and AI processing
We use automated systems and AI models for:
- News classification (assigning news articles to relevant modules such as Infrastructure, Elections, Health)
- AI insights and summaries on each module page
- Data fact-checking and confidence scoring
These systems do not make decisions that produce legal or significant effects on you as an individual — they only classify and summarise public information. If you believe an AI-generated summary is incorrect or unfair to you, please report it via feedback and we will review within 24 hours.
10. Data security
- AES-256 encryption for sensitive data at rest
- TLS 1.2+ (HTTPS) for all data in transit
- Two-factor authentication (Google Authenticator TOTP) on the admin panel
- HMAC-SHA256 payment signature verification for all Razorpay webhooks
- No plaintext passwords anywhere in our systems
- IP-based admin panel access restriction
11. Data breach notification
In the event of a personal data breach that is likely to result in risk to you, we will notify affected users within 72 hours of becoming aware of the breach, as required under DPDP Act 2023. Notifications will include the nature of the breach, data affected, actions being taken, and steps you can take to protect yourself. We will also notify the Data Protection Board of India within the required timeframe.
12. Third-party services
| Service | Purpose | Privacy policy |
|---|---|---|
| Vercel | Hosting & deployment | vercel.com/legal/privacy-policy |
| Razorpay | Payment processing | razorpay.com/privacy |
| Neon | Managed PostgreSQL database | neon.tech/privacy-policy |
| Upstash | Redis cache | upstash.com/trust/privacy.pdf |
| Plausible | Analytics (no personal data) | plausible.io/data-policy |
| Resend | Admin emails only | resend.com/legal/privacy-policy |
| Sentry | Error logs (no personal data) | sentry.io/privacy |
Third-party services we use and their privacy policies
Vercel
- Purpose
- Hosting & deployment
- Privacy policy
- vercel.com/legal/privacy-policy
Razorpay
- Purpose
- Payment processing
- Privacy policy
- razorpay.com/privacy
Neon
- Purpose
- Managed PostgreSQL database
- Privacy policy
- neon.tech/privacy-policy
Upstash
- Purpose
- Redis cache
- Privacy policy
- upstash.com/trust/privacy.pdf
Plausible
- Purpose
- Analytics (no personal data)
- Privacy policy
- plausible.io/data-policy
Resend
- Purpose
- Admin emails only
- Privacy policy
- resend.com/legal/privacy-policy
Sentry
- Purpose
- Error logs (no personal data)
- Privacy policy
- sentry.io/privacy
13. Updates to this policy
We may update this Privacy Policy from time to time as our data practices or applicable laws change. Material changes will be highlighted at the top of this page with an updated "Last updated" date. Your continued use of the platform after changes take effect constitutes acceptance of the updated policy.
14. Contact
Email: support@forthepeople.in
Platform: forthepeople.in
GitHub: github.com/jayanthmb14/forthepeople
Operator: Jayanth M B, Bengaluru, Karnataka, India