Privacy Policy

1. Who we are

Sevastack is a multi-tenant SaaS platform operated by NaviByte Innovations for Indian NGOs, Trusts, and Foundations. Under the DPDP Act 2023:

• Data Fiduciary: Each NGO organization using Sevastack determines the purpose of data processing for their donors, volunteers, and employees.
• Data Processor: Sevastack (NaviByte Innovations) processes data on behalf of NGO organizations as per their instructions.

2. Personal data we collect

3. Lawful basis for processing (DPDP Sections 6-7)

• Consent (S.6): Donor and volunteer data collected via public forms with explicit consent checkbox.
• Legal obligation (S.7(b)): Donor PAN for 80G receipts and Form 10BD (Income Tax Act requirement).
• Employment contract (S.7(a)): Employee data for payroll, PF/ESI/TDS filing.
• Performance of contract (S.7(c)): User account data for platform access per Terms of Service.
• Legitimate interest (S.7(d)): Audit logs with IP addresses for security monitoring.

4. Your rights (DPDP Sections 11-14)

As a data principal, you have the following rights:

• Right to access (S.11): Request a copy of all personal data held about you.
• Right to correction (S.11): Request correction of inaccurate or incomplete data.
• Right to erasure (S.12): Request deletion of your personal data (subject to legal retention requirements).
• Right to data portability: Export your data in machine-readable format.
• Right to grievance redressal (S.13): File a complaint about data handling practices.
• Right to withdraw consent (S.6(6)): Withdraw consent at any time for non-mandatory processing.

To exercise these rights: Submit a data request or file a grievance. Organizations must respond within 30 days.

5. Consent management

We collect explicit consent via checkbox on all public-facing forms (donation, volunteer registration). Consent is recorded with timestamp, method, and purpose. You can withdraw consent for non-mandatory processing at any time by contacting the NGO or our DPO at .

Note: Consent cannot be withdrawn for legally mandated processing (e.g., 80G receipt generation with PAN — required by Income Tax Act).

6. Data retention (DPDP S.8(7))

Automated cleanup runs daily. NGO organizations can configure retention periods within legal minimums.

7. Security safeguards (DPDP S.8)

• Encryption: AES-256 encryption for sensitive fields (PAN, Aadhaar, bank details). HTTPS/TLS for all data in transit.
• Access control: Role-based access (RBAC) with 5 permission levels. Sensitive data masked in UI.
• Authentication: Passwords bcrypt-hashed. Google OAuth supported.
• Audit trail: All data operations logged with user ID, IP address, and timestamp.
• Rate limiting: Protection against brute-force and spam on all public endpoints.
• Multi-tenancy: Data logically isolated per organization — no cross-tenant access.

8. Third-party processors (DPDP S.8(2))

Under DPDP S.16, personal data may be transferred outside India unless restricted by Central Government notification. We monitor government notifications and will update accordingly.

9. Children's data (DPDP S.9)

Sevastack does not target children as users. Volunteer registration requires users to be 18 years or older (verified via date of birth). We do not knowingly collect personal data from individuals under 18 without guardian consent.

10. Breach notification (DPDP S.8(6))

In the event of a personal data breach, we will notify the Data Protection Board of India and affected data principals without unreasonable delay. Notification will include the nature of the breach, data affected, and remedial measures taken.

11. Facebook, Instagram and WhatsApp connections

An NGO can connect its Facebook Page, the Instagram business account linked to it, and its WhatsApp Business number to Sevastack. Connecting is optional and done by the NGO's own staff through Meta's login screen.

• What we receive: the Page and Instagram account names, ids and profile pictures, an access token for the Page, the WhatsApp Business account and phone number ids, and follower counts. We do not read private messages, friends lists or personal profile data.
• How we use it: only to publish the posts the NGO schedules in Sevastack, show its follower growth, send the WhatsApp messages and templates the NGO creates, and show their delivery status.
• Storage: access tokens are encrypted at rest and never shown in the browser. We do not sell or share this data, or use it for advertising.
• Deleting it: disconnect the account in Sevastack and we delete the stored token at once. For Facebook and Instagram, removing the Sevastack app in your Facebook settings (Settings → Business integrations) does the same. You can also request deletion of everything we hold.