1. Who we are
Devgaman (“we”, “us”) is run by [organisation name], [type of organisation], registration number [registration number], with its registered office at [registered address]. For the purposes of the Digital Personal Data Protection Act, 2023 (the “DPDP Act”), we are the Data Fiduciary for the personal data described here.
This policy applies to the Devgaman website and everything on it. It explains what we collect, why, who we share it with, how long we keep it and how you can exercise your rights. It is our notice to you under the DPDP Act and the Digital Personal Data Protection Rules, 2025, and our privacy policy under the Information Technology Act, 2000 and the rules made under it.
2. What we collect, and why
We collect personal data only when you give it to us, and only for the purpose stated next to it.
| When you… | We collect | So that we can |
|---|---|---|
| Create an account | Your name and email address, and a password, which we store only in scrambled (hashed) form that no one can read. If you use “Sign in with Google”, we receive your name, email address and Google account ID from Google. | Create and protect your account, sign you in, and send password-reset messages you ask for. |
| Create or edit a memorial | What you write about your loved one: their name, dates of birth and passing, the place they called home, photo links, their story, a line to remember them by, the seva chosen in their name and the page’s privacy setting. Also your relation to them and the email addresses of family members you invite to look after the page. | Publish the memorial as you choose, let invited family help look after it, and show the gifts given in their name. |
| Share a memory or prayer, or light a diya | The name you give and your message. | Show them on that memorial, as you intend. |
| Make a gift (donation or pledge) | Your name, email address, the amount, the seva chosen, the memorial it is in honour of, any message, and whether to keep your name private. If you ask for a tax certificate, also your PAN and address. | Record your gift, contact you to complete a pledge, send receipts and tax certificates, and meet our tax and accounting duties. |
| Verify your identity (asked once, before you give or create a memorial) | Your full name as printed on the ID, date of birth, mobile number and address (city, state and PIN code); the type of ID you choose and only the last 4 characters of its number; and photos of the ID (and, if you choose, a photo of you holding it). We never store the full ID number. Aadhaar is never required: any one of the listed government photo IDs will do, and if you choose Aadhaar we ask only for the masked copy. | Make sure gifts and memorials come from real adults, prevent fraud and misuse, and keep Devgaman safe for families and donors. |
| Write to us or raise a ticket | Your name, email address, phone number (if you give it), the topic and your message. | Answer you and fix the problem. |
| Ask Diya, our assistant | The questions you type. | Answer you. Your conversation is kept only in your own browser and is cleared when you close the tab. |
| Use the website | Your IP address, for a short time, and basic technical details your browser sends (such as the browser type), in our hosting provider’s security logs. | Keep the site safe, stop spam and misuse, and fix errors. |
Card, UPI and bank details for online payments are entered directly with our payment partner. We never see or store your full card number, CVV, UPI PIN or bank password.
Memorials are about people who have passed away. Please share only what you have the right to share, and take care with details about living family members and others. You must not upload anyone’s personal data without their permission.
3. Why we may use your data
We use your personal data on the basis of your consent, which you give by filling in and sending a form for the purpose shown on it, or for a legitimate use allowed by Section 7 of the DPDP Act, such as data you give us voluntarily for a stated purpose, or to comply with the law (for example tax and accounting laws).
You may withdraw your consent at any time, as easily as you gave it (see “Your rights” below). Withdrawing does not undo what was lawfully done before, and we may still keep data that the law requires us to keep, such as records of gifts.
We do not use your data for advertising, profiling or automated decisions about you, and we do not sell it to anyone.
4. What other people can see
- A public memorial, with its memories, prayers and the names given when lighting diyas, can be seen by anyone and may appear in search engines.
- A private memorial is not listed or searchable: only people who have its link can open it. Anyone with the link can still share it, so share it with care.
- Gifts: if you give without an account, your name and email are never shown publicly; only the Devgaman team sees them. Signed-in donors may choose to be listed by name or to stay private.
- Family members you invite as co-keepers can see and edit the memorial’s details.
- Identity details and ID photos are never shown publicly. Only the members of our team who check identities can see them.
5. Who we share it with
We share personal data only as needed to run Devgaman, with service providers who act on our instructions under contract and must protect it:
- Our hosting provider ([hosting provider]), which stores the website and its data.
- Our payment partner, when online payments are switched on, to process gifts securely.
- Our email service, when switched on, to send receipts, reminders and password-reset messages.
- Google, only if you choose “Sign in with Google”.
- YouTube (Google), in the Seva gallery: for a seva video we keep on YouTube, its picture loads from YouTube, and the video plays from YouTube only when you tap it.
- Anthropic, the provider of the AI that helps Diya answer, only for the questions you type to Diya when AI answers are switched on. They do not use these conversations to train their models.
We also disclose personal data where the law requires it, for example to the Income Tax Department for donor reporting, or to a court, regulator or law-enforcement agency acting under a valid legal order.
Some of these providers may store or process data outside India. The DPDP Act allows this except to countries the Government of India restricts, and we will follow any such restriction.
6. Cookies and browser storage
Devgaman uses only what it needs to work. There are no advertising, analytics or tracking cookies.
| Name | What it does | How long |
|---|---|---|
| dg_token (cookie) | Keeps you signed in. It cannot be read by scripts on the page. | 7 days, or until you sign out |
| dg_lang (cookie) | Remembers whether you chose English or Hindi. | Until you change it or clear your cookies |
| Browser storage | Remembers small things on your own device: that you have seen the opening journey today, an unfinished memorial draft, and your conversation with Diya. | The draft and the conversation end when you close the tab; the rest until you clear your browser data |
If we ever add analytics, we will update this policy first and ask for your consent where the law requires it.
7. How long we keep it
- Your account: until you delete it.
- Memorials: until you delete them. If you delete your account, each memorial you created passes to a family co-keeper who has an account; if there is none, it is deleted with its memories and prayers.
- Records of gifts: for as long as tax and accounting laws require, even after an account is deleted (they are then no longer linked to the account).
- Messages to our team: for up to two years after we last reply, then deleted.
- Identity checks: the ID photos are deleted as soon as our team decides. Your details, the type of ID and its last 4 characters are kept while you have an account, as the record of the check.
- Password-reset links: they stop working after one hour.
- IP addresses kept to stop misuse: only for minutes or hours. Security logs: as long as our hosting provider keeps them, normally a few months.
When we no longer need personal data for its purpose and no law requires us to keep it, we delete it.
8. Your rights
Under the DPDP Act you have the right to:
- Ask for a summary of the personal data we hold about you, how we use it, and who we have shared it with.
- Have your data corrected, completed or updated. You can change your name and your memorials yourself.
- Have your data erased. You can delete your account yourself from your account page.
- Withdraw your consent at any time.
- Nominate another person to exercise these rights for you if you die or become unable to. For a site about remembrance, we think this matters.
- Have your grievances heard and answered.
To use any of these rights, write to our Grievance Officer (details below). We may ask you to confirm your identity first. We will reply as quickly as we can, and within the time the law sets.
If you are not satisfied with our answer, you may complain to the Data Protection Board of India.
9. Children
Devgaman is for adults: you must be at least 18 years old to create an account, make a gift or share content. We do not knowingly collect personal data from children. A parent or guardian may create a memorial for a child who has passed away.
10. How we protect it
- Passwords are stored only in scrambled (hashed) form.
- The sign-in cookie is protected from scripts and is sent only over secure connections.
- Sign-up is protected by a picture code, and repeated attempts are limited to stop misuse.
- Only members of the Devgaman team who need it can see donor details and messages.
No system is perfectly secure. If a breach of personal data happens, we will inform the people affected and the Data Protection Board of India as the law requires, and tell you what we are doing about it.
11. Your responsibilities
Please give true information, do not pretend to be someone else, and do not upload personal data of others without the right to do so. These are also your duties under Section 15 of the DPDP Act.
12. Changes to this policy
We may update this policy when Devgaman or the law changes. The date at the top shows the current version. For important changes, we will tell you on the website or by email before they take effect.
13. Grievance Officer and contact
For any question, request or complaint about your personal data or about content on Devgaman, write to our Grievance Officer:
- [Grievance Officer’s name], [role]
- Email: [Grievance Officer’s email]
- Address: [organisation name], [registered address]
We will acknowledge your message within 24 hours. You can also reach our team through the Support page.