Privacy Policy

Welcome to The Pawsitive Community ("Platform", "we", "our", or "us"). We operate a free, non-commercial, community-driven animal welfare technology platform across India (accessible via thepawsitivecommunity.org) facilitating ethical pet adoptions, foster care, lost & found pet reunification, injured stray rescue alerts, voluntary pet blood donation discovery, and animal welfare directories.

This Privacy Policy is published in compliance with:

• The Digital Personal Data Protection Act, 2023 ("DPDP Act, 2023"), under which The Pawsitive Community acts as a Data Fiduciary in respect of personal data voluntarily provided by registered users, applicants, rescuers, and visitors (the "Data Principals");
• Section 43A and Section 79 of the Information Technology Act, 2000 ("IT Act");
• The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules"); and
• Rule 3(1)(a) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 ("IT Intermediary Rules, 2021").

We adhere strictly to the principle of data minimization. Depending on which features of the Platform you use, we collect and process the following categories of personal data:

A. Account Registration & Identity Data

• Identity & Profile Details: Full name, display name, account role (User, Volunteer Maintainer, or Administrator), and optional profile bio/preferences.
• Verified Contact Data: Email address and 10-digit Indian mobile phone number, verified via time-bound One-Time Passwords (OTPs).
• Geographic Preferences: Primary city/state and subscribed alert cities within India (used to route local adoption, lost/found, and emergency rescue notifications).
• Authentication Credentials: Passwords (irreversibly salted and hashed using `bcrypt` — never stored in plaintext) and short-lived cryptographic verification/reset tokens.

B. Pet Listings, Screening Applications & Rescue Alerts

• Listing Information: Pet name, species (dog/cat), breed, age, gender, vaccination/sterilization status, temperament notes, injury severity/description (for injured stray reports), and city/neighborhood landmark.
• Uploaded Visual Media: Photographs of animals uploaded to our cloud storage. Uploaded images are validated for safe MIME types and processed to strip embedded camera EXIF/GPS metadata where applicable.
• Adoption, Foster & Rescue Screening Data: Living arrangements, household consent, prior pet care experience, veterinary care commitments, or emergency rescue assistance offers submitted by prospective adopters, fosters, or Good Samaritan volunteers.

C. Community Modules (Blood Bank, Volunteering, Directories & Contact Forms)

• Pet Blood Donor Registry: Guardian name, contact number, city, and donor pet details (species, breed, weight, blood group, vaccination status, and last donation date).
• Volunteer & Partner Submissions: Information submitted when applying to volunteer, suggesting an NGO/veterinary clinic/pet store, RSVP-ing to community events, or submitting support/grievance inquiries.

D. Automated Technical, Security & Audit Telemetry

• Network & Security Logs: IP address, browser User-Agent, operating system, referring URL, request timestamps, rate-limit counters, CSRF verification status, and administrative audit trail logs (recorded strictly for cybersecurity defense, fraud detection, and statutory compliance under CERT-In directives).

Zero Financial or Government ID Collection: The Pawsitive Community is 100% free. We never collect, process, or store bank account numbers, credit/debit card details, UPI PINs, Aadhaar numbers, PAN cards, or biometric data.

Under Sections 4, 6, and 7 of the DPDP Act, 2023, we process your personal data strictly for the following specified, lawful purposes:

To protect pet parents, foster caregivers, and rescuers from unsolicited spam, telemarketing, and harassment, The Pawsitive Community enforces a Contact Privacy Gate on adoption and foster listings:

• Public Contact Masking: When you post a pet for adoption or fostering, your personal phone number and email address are hidden from anonymous public visitors and automated scrapers on the listing page and in city broadcast emails.
• Application-Gated Disclosure: Prospective adopters or fosters must submit a structured Screening Application (or Emergency Rescue Offer). Your contact details are shared only when you review and engage with an applicant, or where you explicitly authorize direct contact on urgent listings.
• Applicant Confidentiality: Information submitted by an applicant inside a screening form (housing details, family consent, experience) is transmitted strictly to the specific listing poster and authorized platform moderators for welfare verification. It is never indexed publicly.

Time is critical when a companion animal goes missing or when an injured street dog or cat requires urgent rescue. When using our Lost & Found Radar or Injured / Stray Rescue modules:

• Voluntary Public Visiblity for Rapid Action: You understand and consent that animal photographs, physical descriptions, injury severity, city, neighborhood landmarks, and any contact details or shareable poster cards you generate will be visible to the community to enable rapid on-ground rescue or reunification.
• Location Safety Practice: Users are strongly advised to provide general street/neighborhood landmarks rather than exact private flat numbers or residential building codes.
• Post-Resolution Privacy Control: Once a missing pet is reunited or an injured animal is rescued, you can immediately update the listing status or delete the post from your dashboard to cease active alerts.

When you voluntarily register your pet in our Pet Blood Bank, apply as a Community Volunteer, or submit an NGO, Veterinary Clinic, Pet Store, or Event listing:

• You explicitly consent to making the submitted contact and location details accessible to community members seeking emergency canine/feline blood donors, veterinary care, or volunteer coordination.
• You may modify your donor availability status or permanently remove your registration at any time through your account or by contacting our privacy desk.

We never sell, rent, or commercially license your personal data. Personal data is disclosed only under the following controlled circumstances:

• Peer-to-Peer Welfare Connections: Between pet posters and prospective adopters, fosters, rescuers, or blood donor requesters when you initiate an application, rescue offer, or inquiry.
• Community Social Media Broadcasts (Facebook & Instagram) & Shareable Posters: To maximize the chances of finding homes for adoptable pets or rescuing lost/injured animals, approved pet listings (pet photographs, pet name, breed, city, purpose, and platform link) may be automatically or manually broadcast to The Pawsitive Community's official city-specific or national Facebook Pages and Instagram accounts, or formatted into downloadable share posters. We do not publish pet parents' private email addresses in automated city broadcast emails.
• Authorized Volunteer Maintainers (City Moderators): To keep the platform safe, vetted volunteer Maintainers assigned to specific cities or modules may view pending listings and screening logs strictly for moderation and anti-fraud review. All Maintainers are bound by role-based access controls (RBAC), city-scope restrictions, and comprehensive administrative audit logging.
• Cloud Infrastructure Processors: We engage industry-recognized cloud infrastructure providers (such as MongoDB Atlas for encrypted database hosting, AWS S3 / cloud object storage for pet photographs, and secure SMTP relays for transactional OTPs and alerts). These processors act solely on our instructions under strict security standards.
• Statutory Law Enforcement & Cyber Crime Disclosures: We reserve the right to preserve and disclose account records, IP addresses, audit trails, and submission logs to Indian courts, Cyber Crime Cells, CERT-In, the Animal Welfare Board of India (AWBI), or law enforcement authorities when required by law or in good faith to investigate: (i) animal cruelty or illegal commercial breeding under the Prevention of Cruelty to Animals Act, 1960; (ii) cyberattacks, scraping, or unauthorized access under the IT Act, 2000; or (iii) fraud, extortion, impersonation, or threats to physical safety under the Bharatiya Nyaya Sanhita, 2023 (BNS).

In accordance with Section 8(5) of the DPDP Act, 2023 and Section 43A of the IT Act, 2000, we implement diligent administrative, technical, and architectural safeguards ("Reasonable Security Practices") to protect your personal data:

• Cryptographic Password & Token Security: User passwords are hashed with salted `bcrypt`. Verification OTPs are time-bound (10-minute TTL) and automatically purged.
• Session & Transport Hardening: All traffic is served over HTTPS/TLS encryption. Sessions (`tpc_sid`) are protected with `HttpOnly`, `SameSite`, and secure cookie flags, automatic 6-hour inactivity expiration, and Cross-Site Request Forgery (CSRF) token validation.
• Upload Sanitization & Rate Limiting: File uploads are restricted by strict MIME-type and file-size filters with randomized filenames to prevent remote code execution or path traversal. API and authentication endpoints are shielded by `express-rate-limit` and input sanitization against injection and brute-force attacks.
• Granular Access & Audit Trails: Administrative and Maintainer actions are restricted by least-privilege permissions and logged in an immutable security audit trail.

A. Zero Liability for Third-Party Misuse of Publicly Shared Data

When you voluntarily publish information on public community boards (such as Lost & Found alerts, Injured Stray reports, Blood Donor listings, or directory entries) or share your contact details with another user during an adoption/foster interaction, you acknowledge that third parties visiting the Platform or receiving your communication may view that information.

While we strictly prohibit data harvesting, spam, extortion, and harassment under our Terms of Service and deploy technical rate-limiters against automated scrapers, we cannot physically control the offline or external actions of independent third parties or malicious actors. Any third party who scrapes, copies, or misuses user data from this Platform acts in criminal violation of the IT Act, 2000 (Sections 43, 66, 66C, 66D), the DPDP Act, 2023, and the Bharatiya Nyaya Sanhita, 2023, and bears sole and exclusive legal liability for such acts.

B. Emergency Defensive Lockdown & Incident Response

If the Platform detects an active cyberattack, brute-force intrusion, scraping surge, or security anomaly, we reserve the absolute right to immediately take emergency defensive measures without prior notice—including blocking IP ranges, invalidating all active login sessions, placing the Platform in read-only or maintenance mode, or disabling specific modules until the threat is neutralized.

In the event of a confirmed personal data breach affecting your rights, we will execute our Incident Response Plan in accordance with Section 8(6) of the DPDP Act, 2023 and applicable CERT-In Directions, including isolating affected systems, rotating cryptographic secrets, and notifying the Data Protection Board of India, CERT-In, and affected Data Principals within prescribed statutory timelines.

A. Rights of Data Principals (Sections 11 to 14, DPDP Act)

As a Data Principal under Indian law, you have the following enforceable rights:

1. Right to Access Information (Section 11): Request a summary of the personal data being processed by us, the processing activities undertaken, and the identities of Data Processors or third parties with whom such data has been shared.
2. Right to Correction & Erasure (Section 12): Correct inaccurate or misleading personal data, complete incomplete data, update your profile, or request complete erasure of your personal data and listings that are no longer necessary for the purpose collected.
3. Right to Withdraw Consent (Section 6(4)): Withdraw your consent at any time via your account settings, the 1-click email unsubscribe link, or by emailing our Grievance Officer (noting that withdrawal does not affect the lawfulness of processing prior to withdrawal).
4. Right of Grievance Redressal (Section 13): Obtain accessible, timely resolution of any privacy complaint through our Grievance Officer before approaching the Data Protection Board of India.
5. Right to Nominate (Section 14): Nominate any other individual to exercise your rights under the DPDP Act in the event of death or incapacity.

B. Statutory Duties of Data Principals (Section 15, DPDP Act)

We use strictly necessary, first-party functional mechanisms to keep your account secure and improve platform reliability:

• `tpc_sid` (Session Cookie): An encrypted, `HttpOnly`, `SameSite` session identifier required to authenticate your login state, enforce CSRF protection, and auto-expire idle sessions after 6 hours.
• Local UI Preferences: Minimal browser `localStorage` / `sessionStorage` keys used solely to remember non-sensitive UI states (such as whether you have completed the onboarding tour).
• First-Party Welfare Telemetry: Aggregated, non-commercial funnel metrics (e.g., page views and form completion counts) used exclusively by platform administrators to diagnose broken flows and improve adoption rates.

Zero Third-Party Ad Trackers: We do not embed third-party behavioral advertising pixels, commercial retargeting cookies, or cross-site data broker scripts.

In compliance with Section 8(7) of the DPDP Act, 2023, we retain personal data only as long as necessary to fulfill the specified purpose or to comply with Indian legal obligations:

• User Accounts: Retained while your account remains active. You may request account deletion at any time.
• Pet Listings & Applications: Active while the animal requires adoption, fostering, or rescue. Once resolved or deleted by the poster, public visibility ceases; underlying moderation records may be retained in restricted archives to prevent repeat animal abuse or fraud.
• OTP & Reset Tokens: Automatically purged within 10 minutes via database TTL indexes.
• Security & Audit Logs: Retained in accordance with CERT-In cybersecurity directions (up to 180 days) and applicable legal limitation periods to investigate security incidents, fraud, or statutory inquiries before automated rotation/deletion.

The Pawsitive Community is intended exclusively for individuals aged 18 years and above who are competent to contract under Section 11 of the Indian Contract Act, 1872. Adopting, fostering, or rescuing an animal involves binding legal, financial, and physical responsibilities.

In strict compliance with Section 9 of the DPDP Act, 2023, we do not knowingly collect personal data from children under 18 years of age, nor do we undertake any tracking, behavioral monitoring, or targeted advertising directed at children. If we learn that an account or listing has been created by a minor without verifiable parental/guardian consent, we will promptly deactivate the account and purge the associated personal data.

In accordance with Section 13 of the Digital Personal Data Protection Act, 2023, Rule 3(2) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, and the Information Technology Act, 2000, the contact details of our designated Grievance & Privacy Officer are provided below:

Updates to this Policy: We reserve the right to update or modify this Privacy Policy at any time to reflect changes in Indian legislation, judicial precedents, security architecture, or platform features. Material updates will be indicated by revising the "Last Updated" date at the top of this page.