Privacy policy

1. Who we are

Sevastack is a software platform for Indian NGOs, trusts and foundations, run by Navibyte Innovations Private Limited. Under the DPDP Act:

• Data fiduciary: each NGO using Sevastack decides why and how its donors', volunteers', employees' and beneficiaries' data is processed.
• Data processor: Sevastack (Navibyte Innovations Private Limited) processes that data on the NGO's behalf and on its instructions.
• Our own data: for the accounts of people who sign in to Sevastack, we are the data fiduciary.

2. Personal data we collect

3. Lawful basis for processing (DPDP sections 6 and 7)

• Consent (S.6): donor and volunteer data collected through public forms with an explicit consent checkbox.
• Data you give us for a stated purpose (S.7(a)): the name and email you give when you create a Sevastack account, used to run that account.
• Compliance with law (S.7(d)): donor PAN for 80G receipts and Form 10BD, which the Income Tax Act requires to be reported.
• Employment (S.7(i)): employee data for payroll and PF/ESI/TDS filing.
• Security safeguards (S.8(5)): audit logs with IP addresses, kept to protect the data against misuse and breach.

4. Your rights (DPDP sections 11 to 14)

As a data principal, you can:

• Access (S.11): get a summary of the personal data held about you and how it is processed.
• Correction and erasure (S.12): have inaccurate or incomplete data corrected or updated, and data no longer needed erased (subject to legal retention requirements).
• Grievance redressal (S.13): file a complaint about how your data is handled.
• Nominate (S.14): name another person to exercise these rights for you if you die or become unable to.
• Withdraw consent (S.6(4)): withdraw consent at any time for processing that relies on it.

We also let you export your data in a machine-readable format. This is a feature we offer, not a right under the DPDP Act.

To use these rights, submit a data request or file a grievance. We aim to respond within 30 days.

5. Consent management

We collect explicit consent through a checkbox on public forms (donation, volunteer registration). Each consent is recorded with its time, method and purpose. You can withdraw consent for non-mandatory processing at any time by contacting the NGO, using the consent withdrawal page, or writing to .

Consent cannot be withdrawn for processing the law requires, such as issuing an 80G receipt with your PAN under the Income Tax Act.

6. Data retention (DPDP S.8(7))

Automated cleanup runs daily. NGOs can set their own retention periods within legal minimums.

7. Security safeguards (DPDP S.8(5))

• Encryption: AES-256 field-level encryption at rest for sensitive identifiers (PAN, bank account numbers, and the full Aadhaar number, which is shown masked on screen). TLS for all data in transit.
• Access control: role-based access with per-member permission overrides. Sensitive data is masked on screen.
• Authentication: passwords hashed with bcrypt. Google sign-in supported.
• Audit trail: data changes are logged with user, IP address and time.
• Rate limiting: protection against brute-force and spam on public endpoints.
• Separation between NGOs: each organization's data is logically isolated; no NGO can see another's.

8. Third-party processors (DPDP S.8(2))

Under DPDP S.16, personal data may be transferred outside India unless the Central Government restricts the destination. We track these notifications and will update this list if one applies.

9. Children's data (DPDP S.9)

Sevastack is not built for children to use, and volunteers must be 18 or older (checked by date of birth). NGOs may keep records of child beneficiaries in Sevastack. When they do, the NGO must have verifiable consent from the child's parent or lawful guardian, and Sevastack does not track, profile, or target advertising at children, or use their data for analytics or AI training.

10. Breach notification (DPDP S.8(6))

If a personal data breach affects data we hold for an NGO, we tell that NGO without delay, with what happened, what data and how many people were affected, and what we are doing about it. The NGO, as data fiduciary, then informs the Data Protection Board of India and the affected people in the form and time the DPDP Rules set, and we help it do so.

If a breach affects the account data we hold as data fiduciary, we inform the Data Protection Board and the affected users ourselves, as the DPDP Rules require.

11. Facebook, Instagram and WhatsApp connections

An NGO can connect its Facebook Page, the Instagram business account linked to it, and its WhatsApp Business number to Sevastack. Connecting is optional and done by the NGO's own staff through Meta's login screen.

• What we receive: the Page and Instagram account names, IDs and profile pictures, an access token for the Page, the WhatsApp Business account and phone number IDs, and follower counts. We do not read private messages, friends lists or personal profile data.
• How we use it: only to publish the posts the NGO schedules in Sevastack, show its follower growth, send the WhatsApp messages and templates the NGO creates, and show their delivery status.
• Storage: access tokens are encrypted at rest and never shown in the browser. We do not sell or share this data, or use it for advertising.
• Deleting it: disconnect the account in Sevastack and we delete the stored token at once. For Facebook and Instagram, removing the Sevastack app in your Facebook settings (Settings → Business integrations) does the same. You can also request deletion of everything we hold.

12. Connected AI assistants

A member of an NGO can connect an AI assistant such as Claude or ChatGPT to Sevastack. Connecting is optional and done by the member, who signs in to Sevastack to allow it.

• What it can reach: the assistant can read and, if the member allows it, change the organization's records on that member's behalf, limited to what their role in Sevastack permits and to the areas the organization's administrators have left switched on.
• What we send: only what the assistant asks for in that conversation. Full PAN numbers are never shared (only the last characters), and Aadhaar and bank account numbers are never shared.
• The AI provider: what the assistant does with that information is governed by the AI provider's own terms and privacy policy, chosen by the member.
• What we log: which tools a connection used, when, and whether it succeeded. Every change it makes is recorded in the organization's audit log under the member's name.
• Stopping it: administrators can see and revoke every connection under Settings → Integrations, and members can disconnect at any time from their AI app.

13. Grievance officer

For privacy questions, data requests or complaints:

14. Changes to this policy

We may update this policy from time to time. We will email registered users about material changes. Continued use of Sevastack after a change means you accept it. Earlier versions are available on request.