Privacy Policy

1. Institutional Commitment & Scope

ALLALIVE FOUNDATION (“the Foundation”, “we”, “us”, or “our”) operates the canonical website https://allalives.org. As a registered Section 8 non-profit organisation incorporated under the laws of India, we are committed to ethical stewardship, radical transparency, and strict adherence to the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Information Technology Act, 2000.

This Privacy Policy explains what information we collect when you visit our website, submit messages through our contact desk, review field rescue documentation, or make contributions to our charitable mission.

2. Information We Collect

We practice strict data minimisation: we only collect personal information that is genuinely necessary to fulfill specific, disclosed purposes.

3. Cookies & Third-Party Tracking

All Alive Foundation does not use advertising cookies, marketing tracking pixels, cross-site behavioral tracking scripts, or commercial ad networks.

We store essential client-side state (such as administrative session tokens in session storage for the management console) strictly for functional session handling. If privacy-preserving analytics are deployed, they are configured to run without personal identifiers or cross-site tracking.

4. Purpose of Collection & Legal Basis

Personal data is processed solely under valid legal grounds under Section 6 of the DPDP Act, 2023:

• Consent: For responding to inquiries submitted through the contact desk.
• Statutory Compliance: For recording non-profit contributions and fulfilling mandatory Form 113 filings with the Income-tax Department.
• Legitimate Operational Security: For safeguarding our servers against malicious attacks, spam submissions, or unauthorized administrative tampering.

5. Data Retention & Security Safeguards

We maintain appropriate administrative, technical, and physical safeguards:

• Encryption in Transit & at Rest: All web traffic is enforced over HTTPS with TLS 1.3 encryption. Database storage enforces AES-256 encryption at rest.
• Row-Level Security (RLS): Our database employs strict PostgreSQL row-level security. Public visitors can only access explicitly published stories; draft or archived records are restricted to authenticated administrators.
• Data Retention Limits: Contact inquiries are retained only for as long as necessary to address the correspondence (maximum 180 days unless statutory record-keeping applies). Statutory financial records are preserved in accordance with Indian tax laws (minimum 7 years).

6. Third-Party Infrastructure Providers

We engage select, reputable cloud providers to deliver our digital services:

• Database & Object Storage: Supabase Inc., hosted in its dedicated South Asia (Mumbai, India) facility.
• Static Edge Delivery: GitHub Pages (secure global content distribution).
• Social Links: External links to Instagram (@allalivefoundation) direct you to Meta Platforms, Inc., which operates under its own independent privacy terms.

We do not sell, rent, trade, or disclose your personal data to commercial third parties or marketing brokers.

7. Your Rights under the DPDP Act, 2023

Under the Digital Personal Data Protection Act, you possess explicit rights regarding your personal data:

• Right to Access: The right to obtain a summary of your personal data processed by the Foundation.
• Right to Correction & Erasure: The right to rectify inaccuracies or request deletion of data no longer required for statutory purposes.
• Right to Grievance Redressal: The right to have data protection complaints addressed promptly.
• Right to Nominate: The right to designate a representative in the event of death or incapacity.