Comprehensive Global Privacy Policy & Data Protection Framework
Version 5.0 | Last Revised & Effective: July 26, 2026
India & Gujarat: DPDP Act 2023 & ITA 2000
EU GDPR (2016/679) & ePrivacy
UK GDPR & DPA 2018
US CCPA/CPRA & COPPA
Canada PIPEDA & Law 25
Australia, Brazil, SG, UAE, NZ
Comprehensive Transparency & Worldwide Legal Compliance Statement
This Privacy Policy provides a transparent, exhaustive disclosure of how our family tree and genealogical member directory platform ('Platform', 'we', 'us', or 'our') collects, processes, stores, transmits, safeguards, and disposes of personal, biographical, and ancestral data. We operate in strict compliance with primary Indian data protection statutes—including the Digital Personal Data Protection Act, 2023 (DPDP Act), Information Technology Act, 2000 (ITA Sections 43A & 72A), and Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011—as well as international legal frameworks: European Union General Data Protection Regulation (GDPR - EU 2016/679) & ePrivacy Directive 2002/58/EC, UK GDPR & Data Protection Act 2018, California Consumer Privacy Act (CCPA/CPRA) & Children's Online Privacy Protection Act (COPPA), Virginia CDPA, Colorado CPA, Connecticut CTDPA, Utah UCPA, Texas TDPSA, Canada Personal Information Protection and Electronic Documents Act (PIPEDA) & Quebec Law 25, Australia Privacy Act 1988 (Cth) & APPs, Brazil Lei Geral de Proteção de Dados (LGPD), Singapore Personal Data Protection Act (PDPA), UAE Data Protection Law (Federal Decree-Law No. 45/2021), and New Zealand Privacy Act 2020. Our platform functions as a collaborative community directory to preserve ancestral heritage and support location-based searches by Country, State, District, Taluka, and Village.
Section 1: Preamble, Scope & Statutory Applicability
1.1 Scope of Policy: This Privacy Policy applies universally to all visitors, registered members, directory contributors, profile claimers, and platform administrators interacting with our web application across all global jurisdictions.
1.2 Collaborative Purpose: The Platform is designed as a collaborative, multi-generational genealogical repository allowing related families to document lineage, connect shared ancestors, and filter family members geographically across Country, State, District, Taluka, and Village locations.
1.3 Statutory Definitions: 'Personal Data' means any information relating to an identified or identifiable living natural person. 'Genealogical Data' refers to biographical details, vital statistics (birth and passing dates), photos, and relationship links connecting individuals into family tree structures.
Section 2: Lawful Bases for Data Processing Under Global Statutes
2.1 Explicit Legal Bases: We process personal and genealogical data under clear, codified legal grounds:
(a) Legitimate Interest (GDPR Art. 6(1)(f), UK GDPR): Preserving historical, cultural, familial, and community heritage across generations is a core legitimate interest of this platform and its community members.
(b) Contractual Necessity (GDPR Art. 6(1)(b)): Fulfilling directory search functionality, member account registration, profile claiming, and lineage linkage features requested by users.
(c) Explicit Consent (DPDP Act Sec. 6, GDPR Art. 6(1)(a)): Obtained from living members who register accounts, claim profiles, or voluntarily submit personal contact details.
(d) Legal Obligation (GDPR Art. 6(1)(c), ITA 2000): Complying with statutory security auditing, law enforcement requests, and court orders under Indian law and local jurisdictions.
Section 3: Exhaustive Data Collection Taxonomy
3.1 We collect specific data points directly from user submissions, administrative entries, and automated technical telemetry:
• Account Registration Data: User login email address, phone number, bcrypt-encrypted password hashes, role permissions (Super Admin, Admin, Registered User), and profile claim security challenge Q&A.
• Biographical & Identity Data: First names, surnames, honorific suffixes/titles (e.g., Bhai, Ben, Kumar, Devi), gender alignment (female, male, other, unknown), biographical notes, and uploaded profile photos.
• Vital Statistics & Chronology: Exact or approximate dates of birth and dates of death/passing to construct chronologically validated family timelines.
• Geographic Hierarchy Data: Ancestral and native location selections—including Country, State, District, Taluka, and Village—enabling location-based directory searches and regional filtering.
• Relational Linkage Network: Direct genetic and marital ties linking fathers, mothers, spouses, siblings, and children into the unified family tree.
• Security & Audit Logs: User access timestamps, IP addresses, system audit logs (audit_logs), login security logs (login_logs), and failed login attempt records (login_attempts).
Section 4: Client Browser Telemetry & Timezone-Based Location Detection
4.1 Non-Invasive Localization: To deliver a seamless localized user interface in English and Gujarati without engaging in invasive GPS location tracking, our system automatically processes client browser technical telemetry.
4.2 Technical Attributes: Specifically, we read your client-side browser timezone (via JavaScript Intl.DateTimeFormat().resolvedOptions().timeZone API), client IP address, and HTTP Accept-Language headers.
4.3 Functional Use: This telemetry is strictly used to infer your regional timezone, apply local time formatting, set default language options (EN/GU), and protect against automated brute-force attacks.
Section 5: Analytics, Google Services & Advertising Disclosures
5.1 Google Analytics 4 (GA4): Our platform incorporates GA4 operated by Google LLC to measure aggregated page views, session duration, scroll depth, browser specifications, operating system, screen resolution, and navigation patterns to optimize platform usability.
5.2 Google Ads & Remarketing: We deploy Google Ads conversion tracking pixels, remarketing tags, ad impression counters, and audience segmentation identifiers to promote platform reach.
5.3 Opt-Out Options: Users may opt-out of Google Analytics tracking by installing the official Google Analytics Opt-out Browser Add-on.
Section 6: Cookies, Storage & Session Tokens Taxonomy
6.1 Storage Taxonomy: We deploy essential session cookies (session_id, XSRF-TOKEN) for account authentication, functional language cookies (locale=EN/GU) for language selection, and analytics cookies (_ga, _gid, _gat) for usage metrics.
6.2 Management: Users can manage cookie preferences directly through browser settings.
Section 7: Collaborative Database Architecture & Branch Merging
7.1 Collaborative Archive: Genealogical databases function as shared community archives. Data contributed by members is connected publicly to allow relatives to trace shared lineage.
7.2 Merging Common Ancestors: When common ancestors are identified, administrators may merge duplicate nodes to prevent fragmentation of family trees.
Section 8: Deceased Ancestors vs. Living Members Privacy
8.1 Deceased Ancestors: Data privacy regulations (such as GDPR Art. 4 and Indian DPDP Act) apply to living natural persons. Historical records of deceased individuals are permanently retained to maintain ancestral tree integrity.
8.2 Living Members: Living individuals retain full autonomy over personal contact details, right to lock profiles, and right to request contact detail redaction.
Section 9: Children's & Minors' Data Safeguards (COPPA & DPDP Act)
9.1 Age Thresholds: Under COPPA (US) and Section 9 of the Indian DPDP Act, profiles of minors under 18/13 require explicit parental or legal guardian authorization before public directory publication.
Section 10: Technical Security, Encryption & Data Retention Schedules
10.1 Technical Security: We enforce SSL/TLS HTTPS 256-bit encryption in transit, bcrypt password hashing, Role-Based Access Control (RBAC), and database foreign key RESTRICT constraints.
10.2 Retention Schedules: Active account credentials are retained while active + 90 days post-deletion. Security audit logs are retained for 365 days. Deceased ancestral records are retained permanently.
Section 11: Cross-Border Data Transfers & International Safeguards
11.1 International Transfers: Data transfers across international boundaries comply with EU Standard Contractual Clauses (SCCs), UK Addendum, and statutory data transfer mechanisms.
Section 12: Global User Rights Framework (10 Fundamental Rights)
12.1 Rights Inventory: Regardless of your geographic location, you possess 10 fundamental data rights:
(1) Right to Access & Transparency;
(2) Right to Data Portability;
(3) Right to Rectification;
(4) Right to Erasure ('Right to be Forgotten');
(5) Right to Restriction of Processing;
(6) Right to Object & Opt-Out;
(7) Right to Withdraw Consent;
(8) Right to Human Intervention in Automated Decisions;
(9) Right to Nominate a Representative (under Indian DPDP Act);
(10) Right to Lodge a Complaint with Data Protection Authorities.
Section 13: Third-Party Data Disclosures & Law Enforcement Compulsion
13.1 Non-Sale Warranty: We NEVER sell, rent, or trade personal data to third parties.
13.2 Legal Compulsion: Data may be disclosed to law enforcement authorities under valid legal process (Section 91 CrPC/BNSS in India, subpoena, court order).
Section 14: Data Protection Officer & Grievance Redressal Mechanism
14.1 Grievance Redressal: For privacy inquiries, rights enforcement, or grievance redressal under the Indian DPDP Act 2023 or EU GDPR, please contact our Data Protection Officer via the support portal or at our official legal contact email.
Official Legal Contact Email:
hksphere.6853@gmail.com
Section 15: Policy Amendments, International Harmonization & Governing Jurisdiction
15.1 Policy Updates: We reserve the right to modify or update this Privacy Policy periodically to reflect changes in legal regulations or platform features. Material changes will be published with an updated version number.
15.2 Governing Law & Primary Jurisdiction: This Privacy Policy and the processing of platform data are primarily governed by and construed in accordance with the laws of India and the State of Gujarat.
15.3 International Statutory Harmonization: Nothing in this Section limits, restricts, or overrides non-waivable statutory privacy rights granted to international users under their respective mandatory local privacy legislation—including the EU/UK GDPR for European residents, CCPA/CPRA for California residents, PIPEDA for Canadian residents, and DPDP Act for Indian residents. International users may exercise their local statutory privacy rights directly through our Data Protection Officer.