Privacy Policy

When you donate or contact us we collect: name, email address, mobile number, state of residence, PAN (required by the Income Tax Department for issuing 80G receipts and filing Form 10BD), donation amount, and payment reference IDs generated by our payment gateway. We also collect standard technical data (IP address, browser type) in server logs for security.

We never collect or store your card numbers, CVV, UPI PIN, netbanking credentials or any other payment instrument details. These are handled entirely by our RBI-authorised, PCI-DSS-compliant payment gateway.

We use your data to: (a) process your donation and issue receipts; (b) comply with statutory obligations under the Income Tax Act, Companies Act and anti-money-laundering rules; (c) respond to your queries; and (d) if you opt in, send programme updates. The legal bases are your consent and our legal obligations.

We share data only with: our payment gateway (to process the transaction), statutory authorities when legally required (e.g. Income Tax Department via Form 10BD), and service providers bound by confidentiality (e.g. email delivery). We never sell or rent personal data to anyone.

We use essential cookies for sessions and security, and (with consent) analytics/marketing cookies. See our Cookie Policy for details and controls.

All traffic is encrypted with TLS (HTTPS). Access to donor records is restricted to authorised personnel, forms are protected with anti-forgery tokens, and databases are accessed only through parameterised queries.

Donation and receipt records are retained for at least 8 years as required by Indian tax and company law, after which they are securely deleted or anonymised. Contact-form messages are retained for up to 2 years.

Under the DPDP Act you may request access to, correction of, or erasure of your personal data (subject to statutory retention requirements), and you may withdraw consent for optional communications at any time. Write to our Grievance Officer at info@nuran.foundation with the subject "Data Request"; we respond within 30 days.

Our services are intended for persons aged 18 and above. We do not knowingly collect data from minors.

We may update this policy from time to time; the "Last updated" date above will change accordingly. Material changes will be highlighted on this page.