PavatiPustak Logo

Privacy Policy

Your trust matters to us. This Privacy Policy explains how PavatiPustak collects, uses and protects your information.

Last Updated: [02/08/2026]
Effective Date: [02/08/2026]
This Privacy Policy describes how [Your Company / Trust Legal Name] ("we", "us", "our", "Data Fiduciary"), the operator of the PavatiPustak mobile application ("App"), collects, uses, stores, discloses, and protects personal data of its users ("you", "your", "Data Principal") in accordance with the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the rules made thereunder. PavatiPustak is a donation collection and trust management application that allows individuals to register trusts, join existing trusts, record donations, and manage expenses. By downloading, installing, registering on, or using PavatiPustak, you agree to the collection and processing of your personal data as described in this Policy. If you do not agree, please do not use the App.

1. Data Fiduciary Details

Entity Name: Suyash Enterprises (PavatiPustak)
Registered Address: Shri Gajanand Maharaj,FIRST FLOOR,PROPERTY NO 454FLAT NO 1,Vrundawan Apartment,JANATA COLONY,Daund Patas Road,JANATA COLONY,Pune,Maharashtra,413801
Contact Email: pavatipustak@gmail.com
Grievance Officer: Megha Mahesh Jadhav
Grievance Officer Email: grievance@pavatipustak.com
Grievance Officer Phone: 7745837614

2. Personal Data We Collect

We collect only the personal data necessary to provide the App's features. This includes:

2.1 Account & Authentication Data

  • Mobile number (used for OTP-based login/signup)
  • OTP verification records (not stored beyond verification validity)
  • Full name
  • Referral code (if entered)

2.2 Trust Registration Data

  • Trust name
  • Trust type
  • Trust registered address
  • Trust registration number
  • Trust join requests (for users joining an existing trust)

2.3 Donation Records

  • Donor name
  • Donation amount
  • Name/ID of the person who collected the donation ("Collected By")
  • Donor's mobile number
  • Description/purpose of donation
  • Payment mode (Cash / Online / Cheque)
  • Associated transaction or receipt details, where generated through online payment

2.4 Expense Management Data

  • Expense entries and descriptions
  • Amounts, dates, and category of expenses
  • Expense reports generated within the App

2.5 Technical & Device Data

  • App usage logs, session data (via WebView)
  • Device identifiers, IP address, app version, OS version (collected for security, debugging, and fraud prevention)

We do not knowingly collect any personal data beyond what is necessary for account creation, trust management, donation recording, and expense tracking.

3. Purpose of Processing (Section 4 & 6, DPDP Act)

We process your personal data only for the following specified purposes, and only with your consent or as otherwise permitted by law:

  • To authenticate and verify your identity via OTP-based login/signup.
  • To create and manage your user profile.
  • To enable registration of a new trust or joining an existing trust.
  • To record, track, and generate reports of donations collected on behalf of a trust.
  • To record and manage expenses incurred by a trust.
  • To generate donation receipts ("Pavati") and expense reports.
  • To communicate service-related updates, OTPs, and alerts.
  • To detect, prevent, and investigate fraud, misuse, or security incidents.
  • To comply with applicable legal, tax, and regulatory obligations applicable to trusts and donation records.

We do not use your personal data for any purpose beyond what you have consented to, and we do not sell your personal data to third parties.

4. Consent (Section 6, DPDP Act)

  • We collect and process your personal data only after obtaining your free, specific, informed, unconditional, and unambiguous consent through clear affirmative action (e.g., proceeding past the OTP screen, submitting a registration form).
  • Consent requests are presented in clear and plain language, independent of other unrelated matters.
  • You have the right to withdraw consent at any time. Withdrawal will be as easy as giving consent. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal, and we may retain certain data where required to comply with legal obligations (e.g., financial/audit records of trusts).
  • Where you provide personal data on behalf of a donor (e.g., entering a donor's name, mobile number, and amount), you confirm that you are authorized to share such data with us for the purpose of generating donation records, and that the donor has been informed accordingly.

5. Data of Children

The DPDP Act defines a "child" as an individual under 18 years of age. PavatiPustak is intended for use by adults managing trust and donation activities. We do not knowingly collect personal data of children without verifiable parental/guardian consent. If we become aware that a child's data has been collected without such consent, we will delete it promptly.

6. How We Store and Secure Your Data

We implement reasonable security safeguards to prevent unauthorized access, disclosure, alteration, or destruction of your personal data, including:

  • Encryption in transit: All communication between the App (WebView) and our servers occurs over HTTPS/TLS.
  • Backend infrastructure: Application logic is served via Next.js (frontend rendering) and Node.js (backend APIs), hosted on a Linux-based server.
  • Database security: Data is stored in MongoDB, with access-controlled credentials, role-based access, and restricted network access.
  • Access controls: Only authorized personnel with a legitimate operational need can access personal data, subject to internal authentication controls.
  • OTP security: OTPs are time-bound, single-use, and not stored in plain, reusable form beyond the verification window.
  • Regular review of security practices: To guard against unauthorized access, accidental loss, or destruction of data.

Despite these safeguards, no method of electronic storage or transmission is 100% secure. We encourage you to avoid sharing your OTP or login credentials with anyone.

7. Data Sharing and Disclosure

We do not sell or rent your personal data. We may share personal data only in the following circumstances:

  • Within a Trust: Donation and expense data entered by a user is visible to authorized administrators/members of the relevant trust, since this data is inherently trust-operational (e.g., donation receipts, collector names).
  • Service Providers: With SMS/OTP gateway providers (for authentication) and payment gateway providers (for online payment processing), strictly limited to what is necessary to perform their function, under contractual confidentiality obligations.
  • Legal Requirements: Where required by law, court order, or a government/regulatory authority, including the Data Protection Board of India.
  • Business Transfers: In case of a merger, acquisition, or restructuring, subject to equivalent privacy protections.

We do not transfer personal data outside India except where permitted under the DPDP Act and any applicable government notifications restricting cross-border transfer.

8. Data Retention (Section 8(7), DPDP Act)

We retain personal data only for as long as necessary to fulfil the purposes described in this Policy, or as required by applicable law (including financial and trust/audit record-keeping requirements typically applicable to registered trusts).

  • Donation and expense records: Retained as long as the associated trust account remains active, and thereafter as required for statutory/audit compliance.
  • Account/profile data: Retained until you delete your account, subject to Section 9 below.
  • OTP data: Not retained beyond the verification window.

Where you have not used the App for an extended period and retention is no longer necessary or legally required, we will erase or anonymize your personal data, unless retention is otherwise mandated by law.

9. Account and Data Deletion

You may delete your account at any time using the "Delete Account" option within the App.

Upon account deletion:

  • Your personal profile data (name, mobile number, referral code) will be deleted or anonymized.
  • Donation and expense records associated with a trust may be retained by the trust and/or us, where necessary for the trust's statutory, financial, audit, or legal record-keeping obligations, even after your individual account is deleted. In such cases, your personal identifiers linked to those records may be retained only to the extent legally required, and not for any other purpose.
  • You may also request erasure of your data directly by contacting our Grievance Officer (Section 12), unless we are legally required to retain it.

10. Your Rights as a Data Principal (Sections 11–14, DPDP Act)

Subject to applicable exceptions under the DPDP Act, you have the right to:

  • Right to Access Information — Obtain a summary of personal data we hold about you and the processing activities undertaken.
  • Right to Correction and Erasure — Request correction of inaccurate/incomplete data, and erasure of data that is no longer necessary for the purpose it was collected, subject to legal retention requirements.
  • Right to Grievance Redressal — Raise a grievance regarding processing of your personal data and receive a response within a reasonable timeframe.
  • Right to Nominate — Nominate another individual to exercise your rights in the event of your death or incapacity.
  • Right to Withdraw Consent — Withdraw previously given consent at any time (see Section 4).

To exercise these rights, contact us at [privacy@yourdomain.com] or through the in-App support option. We will respond within the timelines prescribed under the DPDP Act and its rules.

11. Grievance Redressal

If you have concerns about how your personal data is processed, please contact our Grievance Officer:
Name: Megha Mahesh Jadhav Email: grievance@pavatipustak.com Phone: 7745837614
We aim to acknowledge and resolve grievances within the timeframe prescribed under the DPDP Act. If you are not satisfied with our resolution, you may approach the Data Protection Board of India, established under the DPDP Act

12. Data Breach Notification

In the event of a personal data breach that is likely to affect you, we will notify the Data Protection Board of India and affected Data Principals as required under Section 8(6) of the DPDP Act, along with details of the nature of the breach and mitigation steps taken.

13. Cookies and Similar Technologies

As PavatiPustak operates through a WebView-based interface, we may use session identifiers/tokens necessary for authentication and app functionality. We do not use third-party advertising cookies or trackers.

14. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes through the App or via SMS/notification. Continued use of the App after such changes constitutes acceptance of the updated Policy.

15. Governing Law

This Privacy Policy is governed by the laws of India, including the Digital Personal Data Protection Act, 2023, and applicable rules issued thereunder. Any disputes shall be subject to the jurisdiction of the courts at [City, State].

16. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact:
Suyash Enterprises (PavatiPustak) Email: pavatipustak@gmail.com Phone: 9028772128 Address: Shri Gajanand Maharaj,FIRST FLOOR,PROPERTY NO 454FLAT NO 1,Vrundawan Apartment,JANATA COLONY,Daund Patas Road,JANATA COLONY,Pune,Maharashtra,413801