Privacy Policy

1. Who We Are and Our Role

• 1.1 CitizenPulse is operated by Oriva Technologies ("Oriva", "we"), Kochi (Ernakulam), Kerala. CitizenPulse is a civic-engagement platform that connects an Elected Representative's office (the "Representative Office") with citizens.
• 1.2 Data Fiduciary / Data Processor. For personal data arising from your engagement with a particular Representative Office, that Representative Office is the Data Fiduciary (it decides why your data is used) and Oriva acts as its Data Processor. For your account, billing and the security of the Platform, Oriva is the Data Fiduciary in its own right.

2. Personal Data We Collect

• Account data: name, mobile number and/or email, password (stored in hashed form), and constituency/area, if provided.
• Profile and content: comments, opinions, replies, reactions, survey responses, grievances and any media you submit.
• Device and usage data: device model, operating system, app version, IP address, app-interaction logs and diagnostics.
• Location: approximate area, only where you enable it for locally relevant content. Precise location is not collected unless you explicitly permit it.
• Communications: messages you send to our support channels.

3. Why We Use Your Data and the Lawful Basis

3.1 We process personal data on the basis of your consent and, where applicable, the "legitimate uses" permitted under the DPDP Law.

• To create and operate your account and authenticate you.
• To display the Representative Office's posts and to publish and route your comments, opinions and grievances.
• To operate polls, surveys and engagement features you choose to use.
• To maintain security, prevent abuse and fraud, and meet legal obligations.
• To improve the Platform using aggregated or de-identified analytics.

4. Sharing and Disclosure

• 4.1 We share personal data with the relevant Representative Office (as Data Fiduciary), and with sub-processors who help us run the Platform under contract (see the Sub-processor Disclosure).
• 4.2 We may disclose data where required by law, a court, or a competent authority. We do not sell personal data.

5. Children's Data

CitizenPulse is intended for users aged 18 and above. We do not knowingly process a child's personal data for tracking, behavioural monitoring or targeted advertising. Where use by minors is specifically enabled, it requires verifiable parental/guardian consent under the DPDP Law (see the Minor / Parental Consent Policy).

6. Your Rights as a Data Principal

• Access: a summary of your personal data and how it is processed.
• Correction and erasure: correct inaccurate data and erase data no longer required.
• Withdraw consent: at any time, as easily as you gave it.
• Grievance redressal: contact us and, if unresolved, escalate to the Data Protection Board of India.
• Nomination: nominate another person to exercise your rights in the event of death or incapacity.

7. Retention, Security and Transfers

• 7.1 We keep personal data only as long as necessary for the purposes above or as required by law; details are in the Data Retention & Deletion Policy.
• 7.2 We apply reasonable technical and organisational safeguards described in the Security Policy. No system is perfectly secure.
• 7.3 Data is hosted in Mumbai, India. Any transfer outside India is made in accordance with the DPDP Law and any restriction notified by the Central Government.

8. Breach Notification

If a personal data breach occurs, we will notify the affected persons and the Data Protection Board of India as required by the DPDP Law, and assist the relevant Representative Office in meeting its notification duties.

9. Cookies and Similar Technologies

The app and any website use device identifiers and similar technologies as described in the Cookie Policy.

10. Changes

We may update this Policy and will notify material changes in-app or by email. The "Version" above indicates the current edition.