Privacy Policy

We collect only what a donation actually needs. That falls into four groups:

Account details — your name and email address, and, if you choose Google sign-in, the identifier Google shares with us. No password is ever created or stored; sign-in is by magic link.

Pickup and donation details — the address and phone number for the collection slot, the category, quantities and condition of what you are giving, and any note you add for the volunteer.

Photos and messages — images of the items you list, the occasional handover photo taken by a volunteer, and anything you send us through the contact form or by email.

Activity and technical logs — your Impact Stars ledger, donation statuses, and standard server logs such as IP address, browser and device type, which we keep for security and debugging.

We use your data to run the service: to send you a magic link, to book and confirm a pickup, to show your donation timeline, to credit Impact Stars after verification, and to answer you when you write in.

Beyond that, we use aggregated, non-identifying figures to publish impact statistics, and we may occasionally email you about a donation that needs your attention or a change to how SevaKarya works. Marketing emails are separate, optional, and every one of them has a one-click unsubscribe.

Our legal bases are your consent (you chose to give us this information to make a donation happen), the performance of our agreement with you, and our legitimate interest in keeping the Platform secure and improving it. Where Indian law requires a notice of consent, we ask for it at the point of collection.

Photos are the heart of verification, so it is worth being specific about them. They are used to check condition and counts against what you listed, to help the partner decide what it can accept, and to show progress on your own donation timeline.

They are shared with the partner organisation receiving that specific donation — nobody else. They are never published with your name attached, never used in marketing without asking you first, and never sold or licensed to anyone.

Photos stay with the donation record until the donation completes and for 12 months afterwards, or until you ask us to delete them — whichever comes first. If you would rather a particular photo was removed, write to us with the donation code and we will delete it.

SevaKarya uses a small number of first-party cookies to keep you signed in and to remember preferences such as your chosen city. We do not run advertising cookies, and we do not drop third-party trackers that follow you across other websites.

We also use localStorage in your browser. Your session, donations, star transactions and preferences are saved under the key rekindle:v1 so the dashboard loads instantly and still works when your connection does not. That data lives in your browser, not on a marketing profile — clearing your browser data signs you out and clears your local draft.

You can block or clear cookies and localStorage in your browser settings at any time. The Platform will still work; you will simply need to sign in again, and any unsaved donation draft will be lost.

We do not sell your personal data. Not to advertisers, not to data brokers, not to anyone. We share it only in these situations:

The partner organisation receiving your donation — they get your first name, the pickup or drop-off details, the item list and the photos for that donation, because they cannot receive it otherwise.

Pickup volunteers and logistics partners working on our behalf — they get the address, the slot window and your contact number for that collection, and nothing more.

Service providers who host our database, deliver magic-link emails, or help us run support. They process data on our written instructions and may not use it for their own purposes.

Authorities, when the law requires it. If we ever receive a lawful request, we will tell you unless we are legally prohibited from doing so.

SevaKarya is an Indian company and your data is stored on servers located in India, operated by established cloud providers. Pickup details, photos and star records stay within India.

Our email delivery provider may process messages outside India in order to deliver them. Where that happens, we rely on contractual safeguards and keep the amount of data involved to the minimum needed to send the message.

Volunteers and partner staff who can see your information are based in India, are trained on handling it, and are given access only for the donation in front of them.

While your account is active, we keep your account details, donation history and star ledger so the service works. When you ask us to delete your account, we remove your profile, address, phone number and photos within 30 days and email you a confirmation.

We keep donation and star transaction records for as long as legally required for audit and accounting — usually eight years for financial and tax records — stripped of your address and photos. Support emails are kept for 24 months so we can see what we told you before.

Server logs are kept for 90 days, then deleted or aggregated. Anything past these periods is either anonymised beyond recognition or erased.

You are in control of your information. Under Indian law, including the Digital Personal Data Protection Act, 2023, you can ask us to:

Access a copy of everything we hold about you; correct anything inaccurate; delete your account and personal data; port your donation history in a readable file; and withdraw consent for anything you previously agreed to, including marketing emails.

To exercise any of these, email help@sevakarya.com from the address on your account with the word “privacy” in the subject line. We reply within 30 days, usually within three working days, and we will not ask you why you want it. If we ever refuse a request, we will explain the reason in writing.

If you are unhappy with how we handle your data, you can raise a complaint with us first — and, if you remain unsatisfied, with the Data Protection Board of India.

SevaKarya is not directed at children under 18, and we do not knowingly create accounts for them. We do not knowingly collect their personal data either.

When a school, college or youth group runs a donation drive, the account is held by a teacher or an adult coordinator who is responsible for it. Children can take part in the collection without an individual account or a personal address being stored.

If you believe a child has given us personal data without that kind of supervision, write to us and we will delete it promptly.

All traffic to SevaKarya is encrypted in transit (HTTPS). Access to production data is limited to a small number of engineers who need it, is logged, and is revoked when someone's role changes.

We never collect payment card details — donors pay nothing — so there is no card data for anyone to steal. Donation photos are stored separately from public web paths and are only reachable through an authenticated request for that donation.

If something does go wrong, we will tell you and the relevant authorities within the timelines Indian law requires, and we will tell you what happened in plain language rather than a legal one.

When we change this policy materially, we update the date below, show a notice on the Platform and email the address on your account at least 14 days before it takes effect. Minor clarifications just get a new date.

The controller of your data is SevaKarya Foundation, No. 42, 3rd Floor, 80 Feet Road, 4th Block, Koramangala, Bengaluru 560034. For anything privacy-related, email help@sevakarya.com or use the contact form.