1. WHO WE ARE

Impact Guru Technology Ventures Private Limited owns and operates the Platform and acts as the Data Fiduciary in respect of Personal Data for which it determines the purpose and means of processing. For the purposes of applicable data protection law, including the Digital Personal Data Protection Act, 2023 (“DPDP Act”), and, where applicable, other data protection laws governing our processing activities, Personal Data shall be processed in accordance with applicable law.

References in this Privacy Policy to "Impact Guru", "we", "us" or "our" include Impact Guru Technology Ventures Private Limited and its subsidiaries, affiliates and group companies to the extent they process Personal Data in connection with the Platform and the services offered through it. Such entities may process Personal Data as Data Fiduciaries, joint decision-makers, service providers, or data processors, depending on the nature of the relevant processing activity and applicable law.

Impact Guru Technology Ventures Private Limited and/or its Group Companies may engage third-party service providers to process personal data on our behalf; such parties act as our service providers/data processors in accordance with applicable law and our contractual instructions.

"Group Companies" means Impact Guru Technology Ventures Private Limited and any of its present or future holding companies, subsidiaries, affiliates, associate companies, or other entities under common control, whether incorporated in India or outside India.

2. APPLICABILITY OF THIS PRIVACY POLICY

This Privacy Policy applies to personal data collected, received, generated, or otherwise processed by us in connection with:

1. Browsing or visiting the Platform.
2. Creating or using an account on the Platform.
3. Creating, publishing, managing, supporting, or contributing to a fundraising campaign.
4. Donating or making payments through the Platform.
5. Receiving disbursements or payouts through the Platform.
6. Submitting campaign verification, KYC, grievance, support, medical, compliance, or fundraising documents.
7. Interacting with us through email, chat, telephone, forms, surveys, support channels, or social media.
8. Participating in promotions, newsletters, updates, events, or community features; and
9. Any other lawful interaction connected with the Platform or our services.

This Privacy Policy does not apply to third-party websites, applications, payment pages, hospital pages, charity pages, Insurance company pages or external services that may be linked to or accessible from the Platform but are not controlled by us. Your interaction with such third-party services shall be governed by their own privacy policies and terms.

3. PERSONAL DATA WE COLLECT

Depending on your interaction with the Platform and the nature of the services used, we may collect the following categories of personal data:

3.1 Identity and Contact Information We may collect your name, email address, mobile number, alternate contact details, postal address, billing address, shipping address, date of birth where required, profile photo, and government-issued identification details where required for verification, KYC, fraud prevention, or legal compliance.

3.2 Account and Profile Information We may collect account registration details, username, login credentials, password-protected account information, fundraiser profile details, campaign profile information, communication preferences, and other information you choose to add to your account or profile.

3.3 Campaign and Fundraising Information Where you create, manage, support, verify, or otherwise interact with a fundraising campaign, we may collect information such as campaign title, campaign description, photographs, videos, beneficiary details, campaign updates, relationship between the campaigner and beneficiary, and documents supporting the campaign or the purpose for which funds are being raised.

3.4 Beneficiary / Patient / Medical Information Where a campaign relates to medical treatment or healthcare support, we may collect and process beneficiary or patient information, including hospital records, treatment estimates, discharge summaries, prescriptions, medical reports, diagnostic records, hospital letters, invoices, identity documents, and other supporting medical or health-related records provided to us by the campaigner, beneficiary, hospital, authorised representative, or any other person lawfully sharing such information for the campaign.

3.5 Donation, Payment, and Transaction Information When you donate, contribute, receive funds, seek disbursement, or otherwise transact through the Platform, we may collect transaction details such as donation amount, contribution amount, payment confirmation details, transaction IDs, billing details, payout details, bank account details, UPI details, refund or reversal information, chargeback-related information, and related accounting, settlement, and tax information. We do not intentionally store full card numbers, CVV, or similar highly sensitive payment credentials where regulated payment gateway, banking, or payment service providers process such details directly.

3.6 Verification, KYC, and Compliance Information We may collect information and documents required for campaign verification, identity verification, KYC, anti-fraud checks, due diligence, sanctions screening, dispute resolution, law-enforcement responses, and legal or regulatory compliance.

3.7 Communications and Support Information We may collect information and documents required for campaign verification, identity verification, KYC, anti-fraud checks, due diligence, sanctions screening, dispute resolution, law-enforcement responses, and legal or regulatory compliance.

3.8 Technical and Usage Information When you use the Platform, we may automatically collect technical and usage information such as IP address, device information, browser type, operating system, session information, referral URLs, approximate location derived from technical data, pages visited, time spent, clickstream behaviour, crash logs, app usage data, and other interaction data.

3.9 Marketing and Preference Information We may collect your preferences relating to newsletters, updates, reminders, campaign communications, promotional messages, surveys, and other engagement or outreach communications.

3.10 Data Relating to Children or Persons Represented by Others Where a fundraising campaign concerns a child, a patient, or any other beneficiary whose data is provided by a parent, lawful guardian, family member, campaigner, or authorised representative, we may process such data to the extent necessary for the campaign, verification, compliance, or service-related purposes, subject to applicable law.

3.11 Call Recordings Telephone calls made to or received from our customer support, verification, fundraising, grievance handling, relationship management, or similar teams may be recorded and monitored for quality assurance, training, fraud prevention, verification, dispute resolution, legal compliance, and service improvement.

3.12 Mandatory and Optional Information Certain categories of Personal Data requested by us are mandatory in order to create an account, verify campaigns, process donations, or disbursements, comply with applicable law, prevent fraud, or otherwise provide the Platform and our services. Where mandatory information is not provided, we may be unable to create or maintain your account, process transactions, publish campaigns, or provide certain Platform features or services. Information that is optional will be identified, where practicable.

4. HOW WE COLLECT PERSONAL DATA

We may have to share your personal information with third parties set out below for the purposes set out in the table above.

4.1 Information You Provide Directly

You may provide personal data directly to us when you:

1. Create an account on the Platform;
2. Create, manage, edit, or support a campaign;
3. Donate or contribute to a campaign;
4. Upload beneficiary details, campaign content, verification documents, or medical records;
5. Contact us by email, phone, chat, support form, or otherwise;
6. Participate in surveys, promotions, newsletters, or feedback exercises; or
7. Submit grievances, disputes, refund requests, or legal / compliance documents.

4.2 Information Collected Automatically

We may automatically collect technical, device, usage and interaction information through cookies, SDKs, pixels, web beacons, server logs, device identifiers, and similar technologies. Such information may be used to operate and secure the Platform, improve functionality and user experience, personalise content, detect and prevent fraud, analyse Platform performance, monitor security, troubleshoot issues, generate analytics, and support our legitimate business operations.

4.3 Information Received from Third Parties

We may receive personal data from third parties such as:

1. Payment gateways, banks, UPI, and payout partners;
2. Campaigners, beneficiaries, hospitals, NGOs, treatment providers, and authorised representatives;
3. KYC, verification, fraud screening, analytics, communication, or cloud service providers;
4. Social login providers or integrated third-party platforms; and;
5. Regulators, law-enforcement authorities, courts, or other lawful sources;

5. PURPOSES FOR WHICH WE PROCESS PERSONAL DATA

We process personal data only for lawful purposes connected with the Platform and our services. Depending on the context, we may use personal data for the following purposes:

5.1 To Provide and Operate the Platform

We use personal data to create and manage user accounts, host and administer campaigns, enable fundraising activities, process donations and disbursements, provide customer support, and maintain the functioning of the Platform.

5.2 To Process Donations, Payments, Disbursements and Financial Transactions

We use personal data to process donations, contributions, refunds, reversals, chargebacks, settlements, payouts, and related accounting, tax, reconciliation, and financial operations.

5.3 To Verify Campaigns and Maintain Trust and Safety

We use personal data to verify campaigns, validate beneficiary details, assess authenticity of fundraising requests, review supporting records, prevent fraud, investigate suspicious activity, enforce our Terms of Use, protect donors and beneficiaries, and maintain trust and safety on the Platform.

5.4 To Communicate with You

We use personal data to send service-related communications, transaction confirmations, campaign updates, customer support responses, grievance responses, account notifications, legal notices, and, where permitted, newsletters or promotional communications.

5.5 To Improve the Platform and User Experience

We use personal data for analytics, troubleshooting, internal reporting, user behaviour analysis, product improvement, service optimisation, platform security, and fraud monitoring.

5.6 To Comply with Law and Protect Rights

We use personal data to comply with legal, regulatory, tax, accounting, reporting, contractual, law-enforcement, or court-related obligations; to respond to legal requests; and to establish, exercise, or defend legal claims.

5.7 To Support Reward Fulfilment, Logistics or Ancillary Campaign Functions

Where a campaign involves reward fulfilment, acknowledgements, shipping, or ancillary campaign activities, we may use relevant contact and delivery information for those limited purposes.

5.8 Use of Artificial Intelligence and Automated Technologies

We may use automated systems, artificial intelligence tools, machine learning models, statistical techniques, and similar technologies to assist in fraud detection, campaign verification, customer support, communication analysis, security monitoring, operational analytics, Service Development, Platform improvement, service optimisation, issue prioritisation, and other legitimate business purposes. Such systems are intended to assist our operations and, where required by applicable law, shall remain subject to appropriate human oversight.

5.9 Group Operations

We may process and share Personal Data within our Group Companies for internal administration, customer support, technology operations, fraud prevention, analytics, product development, legal compliance, risk management, financing, insurance facilitation, and other legitimate business purposes connected with the Platform.

6. LEGAL BASIS / GROUNDS OF PROCESSING

We process personal data in accordance with applicable law, including the DPDP Act. Depending on the nature of the interaction, processing may be based on:

1. your consent;
2. your voluntary provision of personal data for a specified purpose connected with the Platform or services requested by you, where you have not indicated that you do not consent to such processing and such processing is otherwise permitted by applicable law;
3. compliance with legal or regulatory obligations;
4. lawful uses, legitimate operational purposes, fraud prevention, grievance handling, or other grounds permitted by applicable law; and/or;
5. processing necessary to provide the services, transactions, campaign support, or platform features requested by you.

Where you provide us with personal data relating to another person, including a beneficiary, patient, family member, or nominee, you represent that you are lawfully authorised to share such data with us and that such sharing and our processing of the same for the relevant purpose is lawful.

7. CONSENT NOTICE, CONSENT AND WITHDRAWAL

7.1 Consent Notice

Where we seek your consent for processing personal data, we will provide, at or before the time of seeking such consent, a clear and itemised notice in accordance with applicable law. Such notice may be provided through account registration flows, campaign creation flows, donation flows, cookie banners, document submission workflows, email / SMS communications, or other appropriate means and may include, as applicable:

1. the personal data proposed to be collected and processed.
2. the purpose for which such personal data is proposed to be processed.
3. the manner in which you may exercise your rights under applicable law.
4. the manner in which you may make a complaint or raise a grievance; and
5. such other information as may be required under applicable law.

7.2 Consent

Where processing is based on your consent, we may obtain such consent through account registration flows, campaign creation flows, donation flows, website notices, cookie banners, email / SMS opt-ins, document submission workflows, or other affirmative actions.

Where required under applicable foreign data protection laws, we shall obtain consent or rely upon another lawful basis of processing recognised under such laws.

7.3 Withdrawal of Consent

1. You may withdraw consent for future processing by contacting us or by using available controls on the Platform, subject to applicable law and operational limitations. Withdrawal of consent will not affect processing already undertaken lawfully prior to such withdrawal.
2. Please note that if you withdraw consent for personal data that is necessary for us to provide a particular service, process a donation, administer a campaign, or comply with law, we may be unable to continue providing that service or feature.

7.4 Consent Managers

Where applicable and as may be enabled under law or through the Platform, you may also exercise consent-related choices through a registered Consent Manager or other legally recognised mechanism.

8. ANONYMOUS DONATIONS AND PUBLIC CAMPAIGN DISPLAY

1. The Platform may permit a donor to make an “anonymous” donation or contribution. In such cases, your identity may not be displayed publicly on the campaign page and may not be shown to the campaigner in the manner ordinarily visible on the Platform.
2. However, “anonymous donation” does not mean anonymous to Impact Guru. We may still retain and use the donor’s identity and related transaction information for payment processing, compliance, fraud prevention, support, reward fulfilment, grievance handling, legal requirements, or other legitimate operational purposes.
3. Campaign pages are intended to be publicly accessible for fundraising purposes and may contain personal information, beneficiary stories, photographs, medical records, and campaign updates published by the campaigner. Such publicly available information may be indexed by search engines and may continue to appear through cached pages, internet archives, or other third-party services even after a campaign has ended, or content has been removed from the Platform. While we will take reasonable steps to update or remove information under our control where required by applicable law, we cannot control independent third-party indexing, caching, or archival services.
4. Where a campaigner uploads or publishes personal data, including medical or beneficiary-related information, the campaigner is responsible for ensuring that they are lawfully authorised to share such information and to make such content public.

9. COOKIES AND TRACKING TECHNOLOGIES

1. We use cookies, pixels, SDKs, web beacons, and similar technologies to operate and secure the Platform, remember user preferences, analyse traffic and engagement, measure communication effectiveness, improve platform performance, detect fraud, and support user experience.
2. You may control cookies through your browser or device settings. However, disabling certain cookies may affect the functioning of the Platform. Where required by applicable law, we will seek your consent for non-essential cookies or trackers.

10. SHARING AND DISCLOSURE OF PERSONAL DATA

We do not sell personal data as part of our ordinary business model. We may share or disclose personal data only to the extent reasonably necessary for the purposes described in this Privacy Policy and as permitted by applicable law. Personal Data may, however, be shared within the Impact Guru group of companies for the purposes described in this Privacy Policy and in accordance with applicable law.

We may share personal data with the following categories of recipients:

10.1 Service Providers / Data Processors

We may share personal data with service providers who support our operations, including payment processors, banks, UPI and payout partners, cloud hosting providers, insurers, TPAs, financing partners, analytics providers, KYC and verification vendors, communication service providers, customer support tools, fraud screening partners, logistics providers, and IT or infrastructure service providers.

10.2 Campaign-Related Participants and Institutional Stakeholders

Where necessary for campaign operation, verification, disbursement, or support, we may share relevant personal data with campaigners, beneficiaries, authorised representatives, hospitals, NGOs, trusts, treatment providers, disbursement recipients, reward fulfilment partners, and verification/audit partners.

10.3 Legal and Regulatory Authorities

We may disclose personal data to regulators, law-enforcement authorities, courts, tribunals, governmental agencies, tax authorities, auditors, or other competent bodies where required by law, legal process, regulatory direction, or to protect the rights, safety, property, or legal interests of Impact Guru, our users, or others.

10.4 Corporate Transactions

If we undergo a merger, acquisition, restructuring, investment transaction, sale of assets, or similar corporate event, personal data may be transferred as part of that transaction, subject to applicable legal safeguards.

10.5 Group Companies

We may share Personal Data with our Group Companies where reasonably necessary for:

1. operating the Platform;
2. providing products or services;
3. campaign verification;
4. fundraising support;
5. payment processing;
6. insurance facilitation;
7. financing services;
8. customer support;
9. fraud prevention;
10. analytics;
11. technology and infrastructure support;
12. legal and regulatory compliance;
13. internal administration;
14. business operations;

or any other purpose consistent with this Privacy Policy and applicable law.

11. CHILDREN’S DATA AND PERSONS ACTING THROUGH GUARDIANS

1. The Platform is not intended to be independently used by children except as permitted under applicable law and under the supervision or control of a parent or lawful guardian.
2. However, because the Platform supports medical and charitable fundraising, a child may be the beneficiary of a campaign even though the account holder or campaigner is an adult. In such cases, we may process personal data relating to the child beneficiary to the extent necessary for campaign hosting, verification, donations, disbursements, compliance, trust and safety, grievance handling, or related lawful purposes.
3. Where required under applicable law, we will process the personal data of a child only on the basis of verifiable consent of the parent or lawful guardian, unless an exemption or other lawful basis is available under applicable law for a particular category of processing. Where a parent, lawful guardian, or authorised representative shares personal data relating to a child or a person who is unable to act independently, such person is responsible for ensuring that the sharing of such data with us is lawful and appropriately authorised.
4. If we become aware that personal data of a child has been collected or processed in a manner inconsistent with applicable law, we may take steps to review, restrict, or delete such data as appropriate.

12. DATA RETENTION

1. We retain Personal Data only for as long as reasonably necessary for the purposes for which it was collected or processed, including providing the Platform and our services, operating campaigns, processing donations and disbursements, maintaining accounts, responding to grievances, preventing fraud, complying with contractual, statutory, regulatory, tax and accounting obligations, conducting audits, resolving disputes, enforcing legal rights and preserving records required for investigations or legal proceedings.
2. Retention periods may vary depending on the type of personal data and the purpose for which it was collected. In some cases, we may retain records after a campaign closes or an account becomes inactive where such retention is required or permitted for payment reconciliation, anti-fraud review, legal compliance, dispute resolution, or the establishment, exercise, or defence of legal claims.
3. Without limiting the foregoing, certain categories of records may be retained for longer periods where required by applicable tax, accounting, anti-fraud, KYC, audit, payment settlement, or legal preservation requirements.
4. Where personal data is no longer required, and we are not otherwise required or permitted to retain it, we will delete, erase, or irreversibly anonymise such data in accordance with applicable law and our internal retention practices.
5. Where applicable law prescribes a specific period of inactivity after which certain personal data must be erased, we will comply with such a requirement, subject to any lawful ground for continued retention.

13. DATA SECURITY

1. We implement reasonable technical, organisational, administrative, and contractual safeguards designed to protect personal data against unauthorised access, misuse, alteration, loss, destruction, or disclosure. Such safeguards may include encryption, access controls, authentication measures, secure infrastructure, role-based permissions, logging, vendor diligence, and internal data handling protocols.
2. However, no internet-based system or method of electronic storage is completely secure. While we take reasonable measures to protect personal data, we cannot guarantee absolute security of information transmitted to or stored on the Platform.
3. Users are responsible for maintaining the confidentiality of their account credentials and for notifying us promptly if they suspect unauthorized use of their account or personal data.
4. Where a campaigner uploads or provides Personal Data relating to another individual, including a beneficiary or patient, the campaigner represents and warrants that they are duly authorised to provide such Personal Data to Impact Guru and that such disclosure complies with applicable law.

14. PERSONAL DATA BREACHES

If we become aware of a personal data breach affecting personal data under our control, we will take such steps as are required under applicable law, including investigating and containing the incident, assessing its impact, taking remedial and preventive measures, and notifying:

1. the affected Data Principals; and
2. the Data Protection Board of India or such other competent authority as may be required under applicable law,

in the manner and within the timelines prescribed under applicable law.

Where required, our notification to affected individuals will include relevant details regarding the nature of the breach, the likely impact, remedial measures being taken, and contact information for assistance.

15. CROSS-BORDER TRANSFERS

1. Our Group Companies, service providers, infrastructure, tools, support functions, or integrated systems may involve the processing or storage of personal data outside India. Where personal data is transferred outside India, we will do so only in accordance with applicable law and subject to such safeguards, restrictions, or conditions as may be required.
2. Without limiting the foregoing, we will not knowingly transfer personal data to any country or territory in respect of which the Central Government has imposed a restriction or prohibition under applicable law.
3. Where the processing of Personal Data is subject to the laws of a jurisdiction outside India, including the European Union General Data Protection Regulation (GDPR), the United Kingdom GDPR, applicable United States state privacy laws or any other applicable foreign data protection legislation, the Company shall process such Personal Data in accordance with such applicable laws to the extent legally required. Appropriate contractual, technical and organisational safeguards may be implemented where required by applicable law for international transfers of Personal Data.

16. YOUR RIGHTS

Subject to applicable law, you may have the right to:

1. request access to personal data we hold about you;
2. request correction, completion, updating, or rectification of inaccurate or outdated personal data;
3. request erasure of personal data where retention is no longer necessary or lawful;
4. withdraw consent where processing is based on consent;
5. opt out of non-essential promotional communications;
6. nominate another individual to exercise your rights in the event of your death or incapacity, where permitted by law;
7. raise a grievance in relation to our handling of your personal data; and
8. exercise any other rights available under applicable law.

We may need to verify your identity before acting on a request. We may also decline, defer, or limit a request to the extent permitted or required by law, including where retention is necessary for legal compliance, fraud prevention, dispute resolution, security, or legal claims.

Individuals located in jurisdictions outside India may also be entitled to additional privacy rights under the laws applicable to them. Where such laws apply to our processing activities, we shall honour those rights to the extent legally required.

17. HOW TO EXERCISE YOUR RIGHTS

1. You may contact us to access, update, correct, erase, or otherwise exercise your rights in relation to personal data by writing to us at the contact details set out in Clause 19 below.
2. Where available, you may also update certain information directly through your account settings or profile on the Platform.
3. We will review and respond to requests and grievances within the timelines required by applicable law and, in any event, within ninety (90) days from receipt of a valid request or grievance, unless a shorter period is prescribed by law or the nature of the request requires a shorter response period.

We may need to verify your identity before acting on a request. We may also decline, defer, or limit a request to the extent permitted or required by law, including where retention is necessary for legal compliance, fraud prevention, dispute resolution, security, or legal claims.

Individuals located in jurisdictions outside India may also be entitled to additional privacy rights under the laws applicable to them. Where such laws apply to our processing activities, we shall honour those rights to the extent legally required.

18. THIRD-PARTY LINKS AND EXTERNAL SERVICES

The Platform may contain links to third-party websites, hospital pages, payment interfaces, social media pages, or external services. We do not control and are not responsible for the privacy practices, content, or policies of such third parties. Your use of third-party services is governed by their own terms and privacy policies.

19. GRIEVANCE OFFICER / PRIVACY CONTACT

For any questions, concerns, grievances, or requests relating to this Privacy Policy or our handling of personal data, you may contact our Grievance Officer / Privacy Contact at:

We request that you first write to us so that we may have an opportunity to address your concern. If you are dissatisfied with our response, you may have the right to make a complaint before the Data Protection Board of India in accordance with applicable law.

20. DATA PROTECTION BOARD OF INDIA

If you are dissatisfied with the resolution of your grievance by us, or if you believe that your rights under applicable data protection law have been violated, you may make a complaint before the Data Protection Board of India in accordance with the DPDP Act and the rules made thereunder, subject to the process and requirements prescribed by law.

Nothing in this Privacy Policy limits any right or remedy available to you under applicable law.

21. USE OF NEW TECHNOLOGIES

We may introduce new technologies, including artificial intelligence, automation tools, identity verification systems, fraud prevention technologies, or other digital services from time to time. Where such technologies materially affect the manner in which Personal Data is processed, this Privacy Policy shall be updated accordingly, and any additional notice or consent required under applicable law shall be obtained.

22. SIGNIFICANT DATA FIDUCIARY COMPLIANCE

If Impact Guru is designated as a Significant Data Fiduciary under applicable law, we will comply with such additional obligations as may be prescribed, including obligations relating to appointment of a Data Protection Officer, periodic audits, impact assessments, or other enhanced compliance requirements, to the extent applicable.

23. CHANGES TO THIS PRIVACY POLICY

We may amend, update, or revise this Privacy Policy from time to time to reflect changes in law, regulation, technology, business operations, platform features, or our data handling practices. The updated version will be posted on the Platform with a revised “Last Updated” date. Where required by law, we may provide additional notice or seek fresh consent.

24. CONTACT US

If you have any questions regarding this Privacy Policy or the way in which we process personal data, you may contact us using the details set out above.

25. LANGUAGE AND INTERPRETATION

This Privacy Policy is intended to provide a transparent explanation of how we process personal data in connection with the Platform. It should be interpreted in a manner consistent with applicable law, including the DPDP Act, the DPDP Rules, the Information Technology Act, 2000, and any other applicable legal or regulatory requirements. In the event any provision of this Privacy Policy is held to be invalid or unenforceable, the remaining provisions shall continue to remain in effect.