DRAFT — Not yet legally reviewed
This document is a working draft and has not been reviewed by qualified legal counsel. It does not constitute a valid, binding Privacy Policy until formally reviewed and published. Do not rely on this document for legal compliance purposes.
Privacy Policy
Version 1.0 — Effective date: To be confirmed upon legal review
1. Introduction
This Privacy Policy describes how Mithila Jodi (“Platform”, “we”, “us”) collects, uses, stores, and protects your personal data in accordance with the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and other applicable Indian laws.
Data Fiduciary: [Organisation name and contact details — to be confirmed upon legal registration and review]
2. Personal Data We Collect
We collect the following categories of personal data:
Account and Verification Data
- Mobile phone number (verified by OTP)
- OTP challenge metadata (time, attempt count)
- Account status and role
Profile Data
- Name, date of birth, gender
- Religion, caste (for matrimonial matching within community)
- Education and profession details
- State, district, and hometown (India only)
- Height, complexion, dietary preference, mother tongue
- About me / family description
- Profile photographs (stored securely; not publicly accessible by URL)
Contact Data (Private)
- Contact mobile number (if provided, shared only upon mutual interest acceptance)
- Email address (optional)
- Address (optional)
Usage and Activity Data
- Interests sent, received, accepted, declined
- Shortlisted profiles
- Messages exchanged (stored encrypted in transit; see messaging policy)
- Biodata generation preferences and download history
- Login sessions (IP address, device/browser metadata)
Consent Records
- Record of each consent given: type, version, timestamp, IP address, user agent
- Record of consent withdrawals
Payment Data
- Membership plan, payment status, transaction reference
- Full payment card or bank details are NOT stored — handled exclusively by our authorised payment gateway
3. How We Use Your Data
- To verify your identity and maintain account security
- To display your profile to other members for matrimonial matching
- To enable messaging between mutually interested members
- To generate biodata documents for your personal use
- To process membership payments and manage subscription status
- To moderate profile content and maintain platform safety
- To detect and prevent fraud, abuse, and violations of our Terms of Service
- To respond to your queries and grievances
- With your explicit consent: to send promotional communications
4. Sharing of Personal Data
We do not sell your personal data. We share your data only in the following circumstances:
- Other members: Your profile is visible to registered, active members subject to your privacy settings. Your contact details are shared only upon mutual interest acceptance.
- Service providers: We use third-party providers for OTP delivery, payment processing, and cloud infrastructure. These providers are bound by data processing agreements and may not use your data for any purpose other than providing services to us.
- Legal obligations: We may disclose data where required by law, court order, or lawful government request.
- With your consent: Any other sharing requires your explicit prior consent.
5. Data Retention
We retain your personal data for as long as your account is active and for a period thereafter as required by law or legitimate business need. Key retention principles:
- Account and profile data is retained for the lifetime of the account and for a legally defined period after account deactivation.
- Payment records are retained for the period required under applicable financial and tax regulations.
- Consent records are retained indefinitely for compliance audit purposes.
- Session logs and OTP metadata are retained for a limited period for security purposes.
- Account and profile data is never deleted solely because a membership expires.
Specific retention periods will be defined in the final, legally reviewed version of this policy.
6. Your Rights Under the DPDP Act, 2023
As a Data Principal under the Digital Personal Data Protection Act, 2023, you have the following rights:
Right of Access
You may request a summary of the personal data we hold about you and the purposes for which it is processed. You can download your data from your account settings.
Right of Correction and Erasure
You may update your profile information at any time. You may request erasure of data that is no longer necessary or where you withdraw consent. Erasure requests that conflict with our legal retention obligations may be partially fulfilled.
Right to Withdraw Consent
You may withdraw optional consents (marketing communications, third-party sharing) at any time from your account settings. Withdrawal does not affect the lawfulness of processing based on consent before withdrawal.
Right of Nomination
You may nominate a person to exercise your data rights in the event of your death or incapacity. Nomination functionality will be available in a future update.
Right to Grievance Redressal
You have the right to have your grievances addressed. Contact our Grievance Officer — details to be published in the final version of this policy.
To exercise your rights, please use the account settings page or contact us through the Platform.
7. Data Security
We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, disclosure, alteration, or destruction. Profile photographs are stored in a private storage bucket and accessed only via time-limited signed URLs. Sessions use HttpOnly cookies with hashed tokens. No full Aadhaar numbers are stored on the Platform.
8. Cookies and Tracking
We use a single session cookie (“mj-session”) that is strictly necessary for authentication. We do not use advertising cookies, cross-site tracking cookies, or third-party analytics cookies. The session cookie is HttpOnly and is not accessible from JavaScript.
9. Changes to This Policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify you through the Platform. Where required by law, we will seek fresh consent for any new processing activities.
10. Grievance Officer
In accordance with the IT Act, 2000 and the DPDP Act, 2023, the name and contact details of the Grievance Officer will be published in the final, legally reviewed version of this Policy. Until then, please raise grievances through the Platform.