Privacy Policy

1. Who we are

Voter Contact ("we", "us", "our") is developed and operated by Panchvaktra, an independent software development company based in New Delhi, India. We operate the platform at voters.contact and the associated Android mobile application (collectively, the "Service").

Voter Contact is a private, commercial campaign management tool designed for Indian political candidates, campaign managers, party IT cells, and booth-level workers. We are not a government agency, we do not provide official government services, and we have no affiliation with the Election Commission of India (ECI), any state Chief Electoral Officer (CEO), or any other governmental body at the central, state, or local level.

2. Scope of this policy

This Privacy Policy applies to all users of the Voter Contact web application and Android app. It explains what personal information we collect, why we collect it, how we use and protect it, with whom we share it, and what rights you have. By using the Service you acknowledge that you have read and understood this policy.

3. Data sources & government information disclaimer

Voter Contact displays certain information that originates from government sources. We are transparent about where this data comes from:

Data type	Original source	Official URL
Electoral rolls (voter name, age, gender, address, EPIC number)	Election Commission of India & state CEOs	eci.gov.in
Past election results & candidate data	Election Commission of India	eci.gov.in
Assembly & booth geography	ECI delimitation data	eci.gov.in
Phone numbers, notes, surveys, supporter tags, family links, photos	User-contributed — entered by the app user's campaign team	Not from any government source

Electoral roll data is publicly available information published by the ECI and state CEOs for the purpose of enabling citizens and political parties to verify and use voter lists. We do not generate, alter, or fabricate this data. We do not claim to be an official source of electoral data. Users should always refer to the official ECI and state CEO websites listed above for authoritative, up-to-date information.

4. Information we collect

4.1 Account information

• Email address, mobile number, display name, and password hash (or external OAuth identity via Google, Microsoft, or Facebook).
• Profile preferences — language, theme, push-notification token.
• Two-factor authentication state and biometric handoff tokens (Android).

4.2 Operational data

• The State and Assembly you manage, your role in each Assembly, and the team members you add.
• Per-voter overlay data you save — phone number, WhatsApp, family links, supporter type, survey responses, notes, and photos.
• Subscription and payment records — Razorpay order and payment IDs, payment method type, fee, status, and tax invoice details.
• AI query history — prompts sent to the Election AI feature, report types selected, and token usage.
• App-side audit log of significant actions with tamper-evident hash chain.

4.3 Technical data

• Server logs — timestamp, IP address, request path, response code, user agent.
• Razorpay webhook payloads for payment reconciliation.
• Error reports and diagnostic traces.
• Device information when accessing via the Android app — OS version, screen size, WebView version.

4.4 Data we do NOT collect

• We do not access your device contacts, call logs, SMS messages, or camera without explicit in-app action.
• We do not collect location data unless you explicitly grant geolocation permission for booth-mapping features.
• We do not run background tracking or analytics SDKs.
• We do not use third-party advertising cookies or ad networks.

5. How we use information

• Service delivery — display voter lists, deliver SMS/WhatsApp campaigns, process payments, generate voter slips, run the War Room, and provide Election AI analysis.
• Authentication & security — verify identity, prevent unauthorised access, detect abuse.
• Transactional communication — send receipts, password resets, security alerts, and scheduled-job results via email or SMS.
• Service improvement — anonymised usage analytics to improve features and performance.
• Legal compliance — comply with the IT Act 2000, Digital Personal Data Protection (DPDP) Act 2023, and orders of competent authority.

6. How we share information

We share personal data only with the following categories of recipients, and only to the extent necessary:

• Razorpay Software Private Limited (payment processing) — name, email, mobile, amount, and order metadata. Razorpay is PCI-DSS compliant; we never store full card numbers, CVV, UPI PIN, or net-banking credentials.
• AI service provider (Election AI) — AI analysis prompts containing aggregated demographic data. Prompts are anonymised where feasible; raw voter phone numbers and EPIC IDs are never transmitted.
• Telecom partners (DLT-registered) (SMS/WhatsApp delivery) — recipient mobile number and message body, sent via TRAI-compliant DLT-registered routes.
• Government / law enforcement — only upon receipt of a valid, written legal order from a competent authority.

We do not sell personal data. We do not share data with advertising networks. We do not share voter overlay data between different users or organisations — your data is isolated to your Assembly team.

7. Data storage & security

• All data is hosted on servers located in India.
• All traffic is encrypted in transit via HTTPS/TLS. HSTS is enforced.
• Passwords are stored using industry-standard one-way hashing (ASP.NET Identity with PBKDF2).
• Payment secrets and API keys are stored in environment variables / secure vaults, never in source code or client-side storage.
• Database connections use encrypted transport.
• The Android app enforces certificate validation and blocks mixed content.
• Assembly-level access control ensures users can only view voter data for the Assemblies they are authorised for.

8. Data retention

• Account data — retained while the account is active, plus 90 days after a deletion request.
• Voter overlay data — retained per the rolling Voter List Version window (latest 3 voter lists per State); older overlays are archived and eventually purged.
• Payment records — retained for 7 years as required for Indian tax compliance.
• AI query history — retained for 90 days for usage tracking, then deleted.
• Server logs — retained for 30 days, then rotated.
• Audit log — retained per statutory record schedule, tamper-evident.

9. Your rights under the DPDP Act 2023

As a data principal under the Digital Personal Data Protection Act 2023, you have the right to:

• Access — request a summary of the personal data we hold about you.
• Correction — request correction of inaccurate or incomplete personal data.
• Erasure — request deletion of your personal data, subject to legal-retention obligations.
• Withdraw consent — withdraw consent for processing where consent is the lawful basis.
• Nominate — nominate another person to exercise your rights in the event of your death or incapacity.
• Grievance redressal — lodge a complaint with our Grievance Officer or with the Data Protection Board of India.

To exercise any of these rights, email privacy@voters.contact. We will respond within 30 days.

10. Lawful basis for processing

• Consent (Section 6, DPDP Act) — obtained at registration, when you save voter overlay data, when you opt in to marketing, and when you use Election AI.
• Legitimate use (Section 7, DPDP Act) — for processing of publicly available electoral roll data and for fulfilment of subscribed services.
• Compliance with law — to respond to lawful orders, tax retention, and audit requirements.

11. Cookies & similar technologies

We use only first-party, essential cookies:

• .AspNetCore.Identity.Application — authentication.
• vc.theme — your selected theme.
• vc.culture — your selected language.
• vc.shell — identifies the MAUI app shell.

We do not use third-party advertising cookies, tracking pixels, or analytics cookies.

12. Cross-border data transfer

Election AI may transfer aggregated query content to a third-party AI service provider. Raw voter phone numbers and EPIC IDs are never transmitted. Payment data is processed by Razorpay within India. All other data is stored and processed in India.

13. Automated decision-making & AI

Election AI produces summaries and analytical reports based on aggregated demographic data. Outputs are advisory only and do not produce legally affecting decisions about individual voters. You remain fully responsible for any action taken on the basis of AI output.

14. Children's privacy

The Service is for adults (18+) engaged in electoral activity. We do not knowingly collect data from minors. If you believe a minor has provided us data, contact privacy@voters.contact.

15. Data breach notification

On detecting a breach likely to cause harm, we will notify the Data Protection Board of India, CERT-In, and affected users within 72 hours.

16. Grievance Officer

• Name: Panchvaktra
• Email: grievance@voters.contact
• Address: New Delhi, India
• Response time: within 30 days.

17. Third-party links

The Service may link to external sites including eci.gov.in and state CEO websites. Their privacy policies apply when you visit them.

18. Changes to this policy

Changes will be published here with a revised date. Material changes will be notified via email and in-app banner.

19. Contact

Email privacy@voters.contact or visit the home page.