Privacy Policy

GovtSevas (www.govtsevas.com) is a private portal operated by an individual proprietor. We are NOT affiliated with, endorsed by, or connected to any Government of India ministry, department, or agency. We provide a convenient interface to publicly available government data via third-party APIs.

When you register or use our services, we collect: • Mobile number (for OTP-based login only — hashed in logs) • Name and email (optional, if you provide them) • State and district (for personalisation — optional) • Usage data: which services you used, timestamps (no PAN/Aadhaar stored in our system) • Device and browser information for security and debugging • IP address (hashed — never stored in plain text) We do NOT collect: Aadhaar numbers, PAN numbers, bank account details, passwords (we use OTP-only), or any biometric data.

Your data is used ONLY for: • Providing OTP-based login and session management • Personalising your dashboard (state-specific services) • Detecting and preventing abuse and fraud • Improving our services through anonymous usage analytics • Complying with legal obligations We do NOT sell your data, share it with advertisers, or use it for targeted advertising profiling.

We share data with: • Supabase (database hosting — data stored in India/EU — see supabase.com/privacy) • MSG91 (SMS provider for OTP delivery — your phone number is sent to them only to deliver OTP) • Google Analytics 4 / Google LLC (anonymous usage analytics — only loaded after your explicit consent. Google receives: anonymised page views, session data, approximate city-level location, device type, browser. Your IP address is anonymised before transmission. See policies.google.com/privacy) • Google AdSense / Google LLC (advertising — only if ads are enabled. Google may set cookies to show relevant ads. See google.com/adsense/policies) • Supabase Inc. (database hosting — data stored in EU/US under standard contractual clauses) • MSG91 (SMS provider — your phone number is shared only to deliver OTP, not stored by them beyond delivery) We do NOT sell your data. We do NOT share your personal data with any other third parties. We do NOT use your data for targeted advertising profiling.

Under the Digital Personal Data Protection Act 2023, you have the right to: • Access: Request a copy of all personal data we hold about you • Correction: Request correction of inaccurate personal data • Erasure: Request deletion of your personal data (Right to be Forgotten) • Grievance: Raise a grievance with our Grievance Officer • Nominate: Nominate a person to exercise your rights in case of incapacity To exercise any right, email: privacy@govtsevas.com or raise a support ticket at /support

• Account data: Retained while your account is active • OTP records: Deleted automatically after 24 hours • Service usage logs: Retained for 90 days (no PII) • Support tickets: Retained for 3 years (legal compliance) • Consent logs: Retained for 7 years (DPDP compliance) • After account deletion: All personal data deleted within 30 days

We protect your data using: • HTTPS encryption on all connections • OTP hashed with bcrypt — never stored in plain text • IP addresses SHA-256 hashed in logs • Aadhaar/PAN masked (XXXX-XXXX-1234) in all displays • Row Level Security on database • No secrets in source code (environment variables) • Regular security reviews

We use: • Session cookie (__Host-gs_session): HttpOnly, Secure, SameSite=Strict. Used for login session. Required for site functionality. Cannot be declined — site will not work without it. • Google Analytics cookies (_ga, _ga_*): Set only after you click "Accept & Continue" on the consent banner. Used to count unique visitors and page views anonymously. You can decline by clicking "Decline Analytics" on the consent banner. • Google AdSense cookies: Set only if ads are enabled and you have accepted analytics consent. Used to display ads. Governed by Google's cookie policy. You can withdraw consent at any time by clearing your browser cookies and declining on the next visit. We do NOT use fingerprinting, cross-site tracking, or any tracking that operates without your consent.

We use Google Analytics 4 (GA4) operated by Google LLC to understand how visitors use GovtSevas. Here is exactly what is collected and what is not: WHAT WE COLLECT (anonymously): • Pages visited and time spent on each page • Approximate location (city/state level only — not your exact address) • Device type (mobile/desktop/tablet) and browser • How you arrived at the site (search engine, direct, referral) • Which features and services you used • Session count and frequency of visits WHAT WE DO NOT COLLECT: • Your name, phone number, email, or Aadhaar/PAN • Your exact GPS location or IP address (IP is anonymised before leaving your device) • Any personally identifiable information (PII) • Data from users who declined the consent banner HOW TO OPT OUT: • Click "Decline Analytics" on the consent banner when you visit • Clear browser cookies and decline on next visit • Install the Google Analytics Opt-out Browser Add-on: tools.google.com/dlpage/gaoptout The GA4 Measurement ID used on this site is configurable and can be verified in our open codebase. Analytics are loaded only after your explicit consent as required by the DPDP Act 2023.

Our services are not directed at children under 18 years of age. We do not knowingly collect personal data from minors. If you believe we have collected data from a child, contact us immediately at privacy@govtsevas.com

As required by IT (Intermediary Guidelines) Rules 2021 and DPDP Act 2023: Grievance Officer: [Name — update in Admin Settings] Email: grievance@govtsevas.com Address: [Update in Admin Settings] Response time: Within 48 hours of receipt Resolution time: Within 30 days You may also contact the Data Protection Board of India once established.

We may update this policy from time to time. Material changes will be notified via the site banner. Continued use after changes constitutes acceptance. The "Last updated" date above reflects the most recent revision.