Privacy Policy — OJAS Bharati Bot

DPDP Act (2023) Compliant Privacy Policy

In compliance with the **Digital Personal Data Protection Act (DPDP Act), 2023** of India, this document details how we process the digital personal data of our users (referred to as "Data Principals"). The Service Provider operates as the "Data Fiduciary" responsible for protecting your personal information.

01. Fiduciary Identity & Scope

The **OJAS Bharati Bot** team processes user data as a Data Fiduciary. This Privacy Policy outlines what personal data we collect, why we process it, where it is stored, and your rights concerning your personal information when utilizing our Telegram bot alert service or web dashboards.

02. Categories of Personal Data Collected

We only collect the absolute minimum personal data required to deliver real-time recruitment updates. This includes:

Telegram Identity Data Your unique Telegram ID, Username, and First/Last name as provided by the Telegram API. We use this to route alerts to your active chat thread.
Contact & Registration Data Your name, email address, and mobile number provided during the payment checkout or account initialization process to manage subscriptions.
Transaction Metadata Subscription level, purchase histories, and payment receipts. Note: payment operations are securely handled directly by Razorpay (PCI-DSS compliant). We do not store raw card credentials or bank passwords.
Technical Network Logs IP address, access timestamps, and browser configurations collected purely for rate limiting, DDoS protection, and abuse detection.

03. Lawful Basis and Purpose of Processing

In compliance with Section 4 of the DPDP Act 2023, we process personal data only under a lawful basis.

A. Consent-Based Processing

By initiating the Telegram bot (using /start), confirming your mobile number, or paying for a plan, you provide explicit, specific, and clear consent for us to process your data to deliver job alerts.

B. Service Fulfilment & Security

Processing transaction details is necessary to assign tokens and credit plans. Log processing is carried out to detect crawler abuse, verify subscription licenses, and secure system stability.

04. Data Retention & Storage Limitation

Section 8(7) of the DPDP Act 2023 mandates that a Data Fiduciary must erase personal data as soon as the purpose of collection is fulfilled, or when the user withdraws consent.

Active Subscription Retention We retain your Telegram ID, subscription metadata, email, and contact number only for the active lifespan of your subscription.

Consent Withdrawal & Erasure Period If you choose to withdraw your consent (by blocking the Telegram Bot or requesting account deletion via email), all personal identifiers will be permanently deleted or irreversibly anonymized in our production systems within 30 business days.

Inactive Accounts Purging Accounts that remain expired and completely inactive (no logins, no alert actions) for a continuous period of 180 days will be automatically marked for database deletion, and all personal details will be purged.

Statutory Retention Exceptions Notwithstanding consent withdrawal, billing data, transaction logs (e.g., Razorpay payment tokens, invoice IDs, GST billing addresses) will be securely retained for 7 years solely to satisfy fiscal accounting, taxation, and statutory audit obligations under Indian law.

05. Rights of the Data Principal (User Rights)

Under Chapter III of the DPDP Act 2023, you have active rights which you can exercise by emailing our support or Grievance Officer:

Right to Information

Request a summary of the personal data we process, along with details of processing activities and partners shared with.

Right to Correction & Update

Correct misleading info, update outdated contact data (emails, mobile numbers), or complete missing profile details.

Right to Erasure / Deletion

Request full erasure of your Telegram identity or subscription account data when processing consent is withdrawn.

Right to Nominate

Nominate another representative to act on your behalf regarding your rights in the event of incapacity or death.

06. Security Safeguards & Breach Management

In compliance with Section 8(5) of the DPDP Act 2023, we deploy industry-standard technical and operational safeguards to secure personal data. This includes secure database access tokens, encrypted transaction tunnels (HTTPS), and isolated scraping nodes.

Breach Notification: In the highly unlikely event of a personal data breach, we are legally committed to notifying the **Data Protection Board of India (DPBI)** and all impacted Data Principals (users) immediately via Telegram alerts or register email addresses, detailing remediation steps.

07. Cookie & Analytical Data Usage

To enhance website responsiveness, maintain checkout session tokens, and optimize our alert scrapers, we utilize cookies and analytical tracking files:

Essential System Cookies: These are strictly necessary for core operations, including security checks (Django CSRF middleware), subscriber token verification, and checkout payment status flows. If blocked via browser preferences, core website components may fail to function.
Analytics & Performance Cookies: We utilize third-party analytics utilities (such as Google Analytics or Meta Pixel) and server-side interaction telemetry to analyze visitor volumes, locate broken hyperlinks, and improve layout interfaces. All analytical data is processed in aggregate.
Consent Management: By navigating the platform, you acknowledge the storage of essential cookies. You may manage, block, or delete cookies using your browser software settings at any time.

08. Grievance Redressal & Support

Under Section 13 of the DPDP Act 2023, you have a right to register grievances. If you have any inquiries regarding data protection, consent withdrawal, or wish to exercise data rights, please contact our designated Grievance Officer:

Email: privacy@ojasbharatibot.com