Privacy Policy

1Who we are and what this covers

myChap is a product of ThetaZero Private Limited, a company incorporated in India, registered office No. 10, Manikandan Nagar, Hasthinapuram, Chennai, Tamil Nadu 600064, India, CIN U74999TN2022PTC157268. In this policy "we", "us" and "ThetaZero" mean that company; "myChap" means the product.

This policy is written primarily against India's Digital Personal Data Protection Act, 2023 (the DPDP Act). Section 13 sets out the additional rights that apply if the EU or UK GDPR covers you.

It does not cover what a chapter does with your data outside myChap, or the practices of the providers listed on our sub-processor page; each has its own policy.

2Who is responsible for your data

Under the DPDP Act we are a Data Fiduciary for the first layer and a Data Processor for the second. The GDPR calls these controller and processor.

In practice: send any request to us if that is easier. Where it concerns the chapter's layer, we pass it to the chapter and support them in answering, as described in section 12.

3What we collect

Much of the following is optional and chapter-dependent. A chapter decides which fields it asks for, and you decide what you fill in. A chapter running a job board will ask for a CV; a chapter that does not run one never collects one. The list below is everything the platform is capable of holding, not a list of what is held about you.

Account and identity: always

• Email address, first name and last name.
• One-time sign-in codes we send you, and (for chapter portal access) a password, stored only as a salted hash and never in readable form.
• When you agree to our Privacy Policy and Terms of Use (at sign-in, and again whenever we publish a new version), we record which version you agreed to, the date and time, your IP address and browser or app details, and a copy of the documents and consent statement you were shown. If an agreement is set to expire, we may email you a reminder to renew it.

Profile: optional, if you fill it in

• Profile photo, short bio, social links, skills and interests.
• Mobile number and an optional alternate number.
• Gender and date of birth.
• Postal address: street, city, state, country and PIN code.
• Occupation, employer and industry.
• An emergency contact number, where your chapter asks for one.

Membership and activity

• Which chapters you belong to, your roles and portfolios, and the membership status your chapter records (including whether your membership is live or expired) and, if you choose to tell your chapter why you are not renewing, in the app or through a feedback link the chapter emails you, your reason and any note you add. Your chapter's administrators can also record their own reason and note.
• Program registrations, attendance and no-show status, cancellations and refund outcomes.
• Volunteer hours logged, recognition awarded, and PDUs recorded.
• Content you create in a workspace: announcements, minutes, action items, comments, feedback, budget and expenditure entries.
• Depending on the features you use: answers to registration questions a chapter sets for a program; star ratings and reviews; chat messages and their attachments, and any report or block you make in chat; mentoring profiles, applications and goals; volunteer sign-ups; certificates issued to you; and your viewing progress on Knowledge Library videos.
• If your chapter sends you a survey: whether you were invited and whether you opened, started or completed it, and your answers. In an anonymous survey your answers are stored without your name or member ID (only a one-way code that stops the same person answering twice), so your chapter cannot link them to you. In other surveys your answers are stored with your name, membership type, industry and city. If you answer through a public survey link without signing in, we store a one-way code made from your IP address and browser instead of your identity.
• If you register for a public program without an account: your name, email address, optional mobile number and your answers to the program's registration questions. Registering creates a guest account for you.
• When you accept a chapter agreement: the name you type as your signature, with the date, IP address and browser user agent at the time.
• If you raise a support request: what you write, and any attachments you add.

Payments

• We do not store card numbers, CVVs, UPI PINs or netbanking credentials. Those go directly to our payment gateway and never reach our servers.
• We store payment metadata: amount, currency, status, timestamps, and the gateway's order, payment and refund identifiers.
• For a chapter that receives settlements, we store its settlement destination: account holder name, bank account number, IFSC code, bank and branch name, and where supplied a UPI ID and PAN.
• When a chapter pays a vendor or reimburses a volunteer, the payee's details are recorded in the workspace, either by the chapter's administrators, or by the payee through a link the chapter sends. For an individual payee this can include PAN, whether that PAN is linked to Aadhaar, residential address and a cancelled cheque image, used to verify the account before money is sent to it. Where tax is deducted at source, the chapter also keeps the payee's TDS certificate (Form 16A). The chapter decides whose details it collects and is the Data Fiduciary for them.

Files you upload

• Profile photos, program gallery images, program documents and Knowledge Library files.
• If your chapter runs a job board and you use it: your CV, plus the profile you build there (name, headline, summary, contact details, location, skills, experience, education and links), the cover note you send with an application, and a record of which recruiters viewed your profile.

Device, session and technical data

• For each signed-in session: device type and name, operating system or app version, browser user agent, and IP address.
• If you enable push notifications in the web app: a device push token, platform, device identifier and last-seen timestamp. The mobile apps do not currently use push notifications and do not collect a push token.
• Server logs generated when your app calls our services, used to diagnose faults.

What we do not collect

• We do not collect your device location. The coordinates shown against a program are venue coordinates typed in by the organiser; the apps do not read your device's location.
• We do not read your contacts, your photo library beyond what you deliberately upload, your calendar, your microphone or your camera except when you actively use a feature that needs it.
• We do not use advertising identifiers. There is no advertising in myChap.

4Why we use it, and on what basis

ThetaZero does not use your personal data for advertising, and does not sell it or share it with data brokers. We do not make automated decisions about you that produce legal effects. myChap embeds no third-party analytics, advertising, session-replay or A/B-testing tools.

Your chapter may analyse its own membership and engagement data to run the chapter: for example, reports on lapsed or inactive members. That analysis belongs to the chapter, under the chapter's own basis, and boards with the Advanced Analytics module can export reports containing member-level personal data.

5Who inside your chapter can see your data

This is the most consequential thing for a member to understand, so we state it plainly.

The owner and administrators of a chapter you belong to can see the data that chapter holds about you: your profile and contact details as stored in its workspace, your registrations and attendance, payment and refund records for its programs, volunteer hours, content you post there, and (if it runs a job board) the profile and CV you submit.

• Role holders see what their role allows. A finance role sees and approves payments; a program owner sees that program's registrants; a portfolio holder sees the members and records in their portfolio.
• Other chapters cannot see you. Workspaces are isolated. A member or administrator of one chapter has no access to another's data.
• Guest access. A chapter can open parts of its workspace to people who are not members. What becomes visible depends on that chapter's configuration.
• Our staff. A small number of our people can reach chapter data through an internal console, for support, billing and settlement operations. Access is limited to those who need it, and changes made through the console are logged.

6Sharing and disclosure

We share personal data only:

• with your chapter, as described in section 5;
• with the providers on our sub-processor page, so myChap can function;
• with the audience your chapter's settings expose it to, when you publish something yourself;
• where required by law, a court order or a lawful authority, or to establish or defend legal claims, or to protect the safety of people using myChap;
• with an acquirer in a merger, acquisition or sale of assets. We will give notice before your data becomes subject to a different policy.

Unless we are legally prevented, we will tell you and your chapter before disclosing data to an authority.

7Sub-processors

The third parties that process personal data on our behalf are listed, with what each one receives and where it operates, on our sub-processor page. That page carries its own effective date so it can be kept current.

We will give at least 30 days' notice before adding a new sub-processor that handles personal data, so chapters have time to object.

8Where your data is kept

Our primary database and file storage are hosted in India. Some providers operate globally, so limited technical data (a push token, an IP address) may be processed outside India. The hosting region for each provider is shown on the sub-processor page.

Under the DPDP Act, personal data may be transferred outside India except to territories the Central Government restricts; we monitor that list and comply with it. Where data covered by the GDPR leaves the EEA or the UK, we rely on the receiving provider's Standard Contractual Clauses or another approved mechanism.

9How long we keep it

10How we protect your data, and what we do not claim

What we do:

• Traffic between your device and our servers runs over HTTPS, and data is encrypted at rest.
• Requests for member or chapter data are authenticated and checked against your permissions before they reach any data. Some pages are intentionally public: chapter pages, program listings and public program registration, and certificate verification. These show only what the chapter has chosen to publish, what you have chosen to show on your chapter's public page, and (on certificate verification) the holder's name and the program.
• Passwords are stored only as salted hashes. Neither we nor your chapter can read them.
• Uploaded files are held in private storage. They are served either through an authenticated request to myChap, or through a short-lived link that expires. In both cases they are not readable without an authorised, current session.
• Access inside a workspace is governed by roles and permissions, and workspaces are isolated from one another.
• Sensitive actions are protected by separate permissions, so that approving something is a different privilege from creating it. A chapter's vendor payments and reimbursements cannot be approved by the person who raised them (unless no one else in the chapter is able to approve, in which case the approval is flagged as an exception for review), and our payouts to chapters cannot be approved by the staff member who requested them. Deleting your account additionally requires a confirmation code sent to your email.
• Key changes inside your chapter, to the document vault (including downloads), chapter agreements and their acceptances, your public page, administrator appointments and ownership transfers, payee bank details (including who viewed a full account number), budget approvals, promo codes, and program bookings an administrator creates or overrides, are recorded in an audit log your board can inspect, showing who did what and when. The app lists exactly which areas are covered. Areas outside that list are not recorded, and the absence of an entry is not proof that nothing happened.
• Payment credentials never touch our servers.

What we do not claim:

• We hold no third-party security certification (no SOC 2, no ISO 27001) and we do not claim one.
• No system is completely secure. We cannot guarantee that a determined attacker will never succeed.

11Cookies and similar technologies

myChap sets no tracking or advertising cookies. If we set any cookie, it will be strictly necessary: for example, to authorise access to a file you are entitled to view. The web app keeps your sign-in tokens, your profile, your selected chapter and, if you enable notifications, your push token in your browser's local storage. Nothing is stored for advertising, cross-site tracking or measurement.

• Because we set no tracking cookies and run no analytics, there is no cookie banner and no preferences to manage.
• Clearing your browser's site data for myChap removes the stored tokens and signs you out.
• The mobile apps store your session on the device. They do not currently use push notifications.

12Your rights under the DPDP Act 2023

As a Data Principal in India you have the right to:

• obtain a summary of the personal data we hold about you and how it is processed;
• have inaccurate or incomplete data corrected, completed or updated;
• have your personal data erased, where it is no longer needed for the purpose it was collected for and we are not required by law to keep it;
• have a grievance heard and answered by the officer named in section 17;
• nominate another person to exercise these rights on your behalf if you die or become incapacitated.

Erasure is self-service. In the myChap app, go to Profile → Settings → Delete my account. In the web app, open Settings (members: Profile → Settings) and choose Delete my account. Or follow the steps on our account deletion page. We email you a confirmation code; once you enter it, deletion happens immediately and cannot be undone.

Deletion applies to your whole myChap account, across every chapter you belong to. You are removed from every chapter on myChap, but whether you remain a member of the chapter itself is for the chapter to decide, because the chapter holds your membership in its own records. You cannot delete your account while you own a chapter's workspace, are one of its administrators, or hold a portfolio in it. Transfer ownership, ask another administrator to change your role, or hand the portfolio over first. myChap tells you which chapter is affected. We keep your Member ID, without your name or contact details, so that a later import by your chapter does not bring your profile back.

What survives, and why: your chapter keeps its payment records, invoices, ledger entries and program history, because it needs them for its accounts and tax law requires it to keep invoices. Issued tax invoices and credit notes keep your name and the contact details on them, as explained in section 9. Everywhere else, your name is replaced with Deleted User.

Other requests are handled manually. Email privacy@mychap.net or the Grievance Officer in section 17. We acknowledge within 48 hours and respond within 30 days. Where a request concerns data your chapter controls, we pass it to the chapter and help it respond.

We may need to verify your identity before acting, and we may decline a request the law requires or permits us to decline; we will tell you why. The Act also places duties on you, including not raising false or frivolous complaints and not impersonating another person. If we cannot resolve your grievance, you may complain to the Data Protection Board of India.

13Additional rights in the EEA and the UK (GDPR)

This section applies only where the EU or UK GDPR covers your data. It adds to section 12 rather than replacing it. You have the right to access and receive a copy of your data; to rectification; to erasure where a ground in Article 17 applies; to restriction while a dispute about accuracy or lawfulness is resolved; to portability; to object to processing based on legitimate interests; and to withdraw consent at any time.

We respond within one month, extendable by two further months for complex requests; we will tell you if that happens. You may complain to your local supervisory authority, or to the Information Commissioner's Office in the UK.

We have not appointed an Article 27 representative. myChap is operated from India. If your chapter is established in the EEA or the UK, it is likely the controller for its member data and its own privacy notice applies alongside this one.

14Children's data

myChap is not intended for anyone under 18, and we do not knowingly collect personal data from children.

The DPDP Act requires verifiable parental consent before a child's data is processed, and prohibits tracking, behavioural monitoring and targeted advertising directed at children. myChap has no mechanism for obtaining verifiable parental consent, so chapters must not create member records for people under 18 or upload their personal data to the platform.

If you believe a child's data has been given to us, email privacy@mychap.net and we will delete it.

15If there is a breach

If a personal data breach occurs, we will notify the Data Protection Board of India and the affected Data Principals in the form and manner the DPDP Act requires. Where the GDPR applies, we will notify the relevant supervisory authority within 72 hours of becoming aware where feasible, and affected individuals where the risk to them is high. We will also inform the affected chapter, since it is the Data Fiduciary for its member data and has its own notification duties.

16Changes to this policy

We update this policy when myChap changes. Where a change materially affects how your data is handled, we give notice by email and in-app at least 30 days before it takes effect. We keep every previous version, and will send you a copy on request to legal@mychap.net. The effective date at the top of this page is the authoritative version marker.

17Contact and grievance redressal