01Two kinds of data
Account data is information about the people who use the platform: names, work emails, roles and organisation details. We are responsible for this data.
Program data is what your organisation records in its workspace: donors, grants, beneficiaries, households, consent records, field submissions, volunteers, reports and compliance documents. Your organisation owns and controls this data. We process it only to provide the service to you.
02What we collect on this website
We do not use advertising trackers or sell visitor data.
- Details you submit in the sign-up form: name, work email, role, organisation, organisation type, focus area, expected number of beneficiaries, first program and region.
- Details you submit to the Impact Desk: name, email, organisation, role, regions, number of programs and beneficiaries, focus areas and your message.
- Basic technical data needed to run the site securely, such as a session cookie used for the form check and server logs kept for security.
03How program data is used
- To run the modules your organisation uses: Donor Desk, Grant Tracker, Field Collect, Beneficiary Register, Volunteer Hub, AI Impact Writer and Compliance Vault.
- To draft reports for your organisation in AI Impact Writer, using only records in your workspace.
- Program data is never sold, never used for advertising and never used to train AI models.
04Beneficiary data and consent
Beneficiary data must be collected only with informed consent, explained in a language the person understands. The platform records consent for data use, photos, stories and sharing separately, and other modules check it before using anything.
Consent for children is given by a parent or guardian. When consent is withdrawn, the withdrawal is applied across modules, and the person's data is removed from stories, photos and shared reports.
Your organisation is responsible for obtaining valid consent and for the lawful basis of the data it collects.
05Where data is stored and how it is protected
- Workspaces are hosted in India by default.
- Data is encrypted in transit and at rest.
- Access is limited by role. Field workers see only their assigned locations; funders see only what you share.
- Every view of a personal beneficiary record and every compliance document download is logged.
- Staff access to customer workspaces is limited to support requests you approve.
06Sharing
We share data only with service providers needed to run the platform, such as hosting and email delivery, under contracts that require them to protect it. We disclose data to authorities only where Indian law requires it, and we tell the affected organisation unless the law prevents us.
Funders, auditors and partners see your program data only when your organisation chooses to share it.
07Retention and export
Program data is kept while your workspace is active. If a subscription ends, the workspace becomes read-only for 90 days so you can export everything, and is then deleted. Backups are removed within a further 30 days.
Account data from sign-up and contact forms is kept for as long as needed to respond and manage the account.
08Your rights
You can ask to see, correct or delete your account data, and to withdraw consent for communication, by writing to us through the Impact Desk page. Requests about a beneficiary's data are handled with the organisation that collected it.
We follow the Digital Personal Data Protection Act, 2023 and the rules made under it.
09Changes to this policy
If we make material changes, we will tell workspace administrators by email before they take effect.