Privacy Policy
We collect the minimum information necessary. Where contact is needed a working email address is enough. It is never shown on a notice. When you reply to someone, they receive your name and email, so that they can answer you.
Our Commitment to Your Privacy
IndiaAbroad.org provides and maintains the shared platform. India Abroad is a program of Maxsys International Inc., a registered 501(c)(3) nonprofit in the United States, EIN 92-2184705. This page says what we collect, why, who else sees it, and what you can ask us to do about it. It is written to be read once.
Key Privacy Principles
- • We never sell, rent, or trade your personal information
- • We ask only for what a task needs, and no task on this site needs a profile
- • Your email address is never shown on a notice. It reaches another participant only when you reply to them
- • Private messages stay private: moderators cannot read them
- • Card details go to our payment processor and never to us
- • The third parties that receive anything are named on this page
Information We Collect
Information you type in
There is no account on this site, so the only information you give us is what you type into a form. Each asks only for what that task needs.
- Contact form: first name, last name if you give one, email address, subject and your message
- Partnership form: organisation name, contact person, email address, what your organisation does, and how you would like to take part
- Donation form: first name, last name if you give one, email address and the amount. Your card details go directly to Stripe and are never sent to us or stored by us
The community board. To share a note you give a title, the note, your name and your email. An offer of help asks for your name, a headline, a few words about you and your email. The town it carries is the one Cloudflare places your connection in, as described under "Information collected automatically". The note, with its name and town, is public and open to search engines: it is a community board. Your email is never shown on it. We email you a link that puts the note up. That link is your key: from it you change, renew or remove the note, and there is no password. We also keep the address of the connection you posted from, with the note, so that abuse can be dealt with. You can remove your note yourself at any time from the link in your email.
How long a notice stays. A note and an offer are up for 30 days, and you renew one from the page your email link opens. We email you three days before it rests. It is deleted, with the connection address kept with it, 90 days after it was last renewed. A note or offer you remove yourself leaves the board at once, and is deleted for good by that same day at the latest. Events, organisations and businesses are put on the board by our staff and stay until our staff remove them; an event is no longer shown once its date has passed.
Changes by our staff. Our staff, and the local moderators who look after a town's board, can change or remove what is on it. A local moderator sees only their own town's board, and one who can change a note also sees the email it was posted with. Nobody sees the connection address in the board's tools. We do not yet keep a record of each change.
Listed from public sources. Some places of worship and organisations in the United States are listed by India Abroad from OpenStreetMap (© OpenStreetMap contributors), and some associations abroad from published lists. Indian embassies, high commissions and consulates are listed by India Abroad from the Ministry of External Affairs' list and each mission's own website. These listings have no expiry, and stay until our staff remove one.
"This is us". An organisation that would like to look after its listing writes to us through the contact form, and what it sends is handled like any other message to us.
Suggest a correction. A correction is sent through the contact form, like any other message to us.
Private replies. To reply, you use the key of a note or offer of your own. A reply goes only to the other person, by email through us, with your name and your email, so that they can answer you directly. It does not show on the board, and their email is not given to you. We keep the reply, with your name and email. Private messages stay private: moderators and volunteers cannot read them. Only the platform's administrator can open one, and only to settle a dispute or answer a lawful request. We do not yet delete a reply when the note it answered is deleted, and we do not yet record when the administrator opens one.
The Helpline. A request carries your name, your email, your town and your message. It reaches our staff by email, the same way as a message from the contact form, and a person replies to you by email.
Volunteering. An offer to volunteer carries your name, email, town, what you would like to do, how you would like to help, and your languages if you give them. It reaches our staff by email, the same way as a message from the contact form, and a person replies to you by email.
On your device. Nothing from the board is kept in your browser's storage. Your key is the link in your email, not something on this device. The board's pages set two cookies of their own, and its public pages carry Google's, all described under "Cookies and Tracking Technologies".
Information collected automatically
- Usage data: the public pages carry one Google tag, for Google Analytics and Google Ads. It reports the pages viewed and, once our server has confirmed it, a completed form or gift, as set out under "Google Analytics and Google Ads". Our host, Cloudflare, sees each request as part of serving it
- Device information: browser, operating system and IP address, which reach our host as part of an ordinary web request
- Advertising identifiers: if the link that brought you here carries an advertising click identifier, Google's tag reads it from that link, and Google Ads may keep it in a cookie of its own for up to 90 days, so that it can count a visit, a completed form or a gift that came from an ad. It is also kept with your contribution's record at Stripe when you give from the donation page that link opened, or from the board's Donate link within two hours. For that link to carry it, the board's pages keep the identifier with your session for those two hours
- Cookies: Google's measurement cookies on the public pages, and one of our own on the thank-you page after a gift, both described under "Cookies and Tracking Technologies". The community board's pages set two more of our own, described there too. Stripe on the donation page and reCAPTCHA on the forms may set their own, as their policies describe
- Where you are: the board shows the town that Cloudflare, our host, places your connection in. Cloudflare passes that place to our community engine with each request, and it is not stored. If you type a different town and save it, the engine keeps it with your session until you have been away for two hours. The session does not record your connection's address or the name of your browser
How We Use Your Information
Answering you
- • Reading and replying to what you send us
- • Following up on something you reported
- • Talking to your organisation about taking part
- • We have no newsletter and no mailing list, so you will not be added to one
Running the platform
- • Keeping the site working and seeing which pages are read
- • Telling a person apart from a bot when a form is submitted
- • Understanding which ads bring people here, so the money is not wasted
- • We do not build profiles of readers and do not sell anything to anyone
Legal and Compliance
- • Keeping the records a US charity is required to keep
- • Responding to a lawful legal request
- • Investigating fraud, abuse or a threat to someone's safety
Contributions
- • Taking the payment and emailing you the receipt
- • Keeping the record of the gift for tax and audit purposes
- • Stopping a monthly contribution when you ask
Who else sees your information
We never sell your data
We do not sell, rent or trade your personal information, and we never show your email address on a notice. It reaches another participant only when you reply to them.
The companies that run parts of this site
Naming them is the point. Each one has its own privacy policy, and its own terms apply to the data it receives.
- Stripe processes every payment. Your name, email address, amount and card details go to Stripe. We never receive or store the card details.
- Google reCAPTCHA runs on the contact, partnership and donation forms, the Helpline and the volunteer form to tell a person from a bot. It is governed by Google's privacy policy (opens in a new tab) and terms of service (opens in a new tab).
- ZeptoMail delivers the emails we send you, including the donation receipt, the message that reaches us from the contact form, the Helpline or the volunteer form, and the board's emails: the link to your notice and the private replies we pass on.
- Cloudflare hosts and serves this site, so every request to it passes through Cloudflare.
- Google Analytics and Google Ads receive the measurement described under "Google Analytics and Google Ads", and nothing else from this site. They are governed by Google's privacy policy (opens in a new tab).
- Amazon Web Services hosts the community engine, the server that keeps the board: the notices, the private replies, and the email addresses and connection addresses described above.
The only other times we share anything
- Legal requirements: when required by law, a court order, or to protect someone's safety
- What you post publicly: anything you choose to share in public is public, and you decide what goes in it
- Aggregated figures: counts that identify nobody
How your information is protected
We would rather describe what is true than list reassuring words. This is a small platform run by a small nonprofit, and the honest account of it is short.
What is in place
- • The whole site is served over an encrypted connection
- • Card details are handled by Stripe and never reach us
- • Email addresses are never displayed on a notice, and reach another participant only in a reply you send
- • We hold no passwords for anyone who reads or posts, because there are no accounts. Only our staff and local moderators sign in, to look after the board
- • Access to what we do hold is limited to the people who need it
What we do not claim
- • No system is perfectly secure, and we will not tell you this one is
- • We hold no security certification and claim none
- • If something happened to information you gave us, we would tell you and say what we knew
Your Privacy Rights
Each of these is exercised the same way: write to us and ask. There is no settings page, because there is no account to have settings on. A notice you posted you can also remove yourself, at any time, from the link in your email.
See what we hold
Ask for a copy of the personal information we hold about you
Correct it
Tell us what is wrong and we will fix it
Delete it
Ask us to delete it, and we will, except where charity or tax law requires a record of a contribution to be kept
Stop hearing from us
Ask us not to email you again, other than a receipt for a payment you made
Stop a monthly contribution
Ask, and we will stop it. There is nothing to cancel other than the payment itself
How to ask
Write to [email protected], or use the contact page. Both reach the same people.
A request is answered by a person, not a system, so we will not promise you a turnaround in hours. We may need to check that the request really comes from you, which usually means replying from the address the information is attached to.
Google Analytics and Google Ads
India Abroad runs free search ads through Google's Ad Grants programme for nonprofits. To see whether those ads bring people who go on to use the site, the public pages carry one Google tag, which reports to Google Analytics and Google Ads. Google may also use what its tag learns to choose the ads it shows you elsewhere, as its own policy describes; your Google ad settings, below, control that.
What is sent
- Page views: the address of each page you view, with its title and the page you came from, and nothing you typed in it. A page whose address carries anything but an ad's click and campaign details, a list's page number or filter, or a gift's amount and frequency, is not measured at all. A search, for example, is not. A town's board has the town's name in its address, so a view of it names that town, as the page itself does. That includes a town you type to see its board, the only thing you type that a page view carries.
- Five events, each sent only after our server has confirmed it: an offer to volunteer sent, a Helpline request sent, a message from the contact form sent, a note or offer confirmed onto the board, and a gift Stripe confirms as paid. Each carries only its kind: which form it was, the topic of the note or offer, or the gift's amount, whether it is monthly, and a reference number of our own that identifies nobody.
- The ad click identifier, when the link that brought you here carries one.
- What Google's tag learns from your browser, as on any site it runs on: the kind of device and browser, the screen size, the language, and your connection's address, from which Google works out an approximate location.
What is never sent
Your name, your email address, your messages, anything else you type into a form or a search, and your payment details. Google's tag is told not to collect an email address or other details it finds on a page (what Google calls user-provided data). Nor is the address of a private page: the pages your email links open, the pages where you manage a notice and the staff's pages carry no Google tag at all, and they never pass their address on to the next page.
How long it is kept
Google keeps it for Google's standard retention period for Google Analytics and Google Ads.
Your choices
- Google's opt-out add-on for Google Analytics (opens in a new tab) stops your browser sending to Google Analytics on any site.
- Your Google ad settings (opens in a new tab) control how Google uses what it learns for ads.
- Blocking Google's scripts or cookies in your browser stops all of this measurement, Google Ads included, and the site keeps working.
- The pages your email links open, and the pages where you manage a notice, carry no measurement at all, whatever you choose.
Cookies and Tracking Technologies
What is actually set
Google Analytics and Google Ads
On the public pages, Google's tag sets _ga and _ga_P8NPVCJNS7 (Google Analytics, to tell one visit from another, for up to two years; some browsers keep them for less). Google Ads may also set _gcl_au and, after an ad click, _gcl_aw (to connect a completed form or gift to the ad that brought you, for 90 days). These are Google's standard lifetimes. The pages your email links open set none of them.
One of our own, after a gift
When Stripe sends you back after a gift, the thank-you page sets ia_gift for up to ten minutes. It holds the gift's amount, whether it is monthly and a reference number of our own, so that the gift is counted once, and it is removed as soon as the page is shown.
Stripe
On the donation page, Stripe may set its own cookies to process the payment and prevent fraud.
Google reCAPTCHA
Runs on the contact, partnership and donation forms, the Helpline and the volunteer form to keep automated spam out.
Two of our own, on the board
The community board's pages set a session cookie, which keeps a town you typed until you have been away for two hours, and XSRF-TOKEN, which protects the board's forms. Neither follows you to other sites. If the link that brought you carried an advertising click identifier, the session keeps that too, for up to two hours. There is no login to remember for anyone who reads or posts.
Turning them off
Every browser can block or delete cookies, Google's included, without affecting this site, because none of them is needed to read it. Your browser's own help pages explain how for that browser, and "Your choices", above, lists Google's own opt-outs.
Wherever you are reading this
Global in reach. Local in everyday life.
People read this site from many countries. The organisation behind it is in the United States, and the companies named above hold data in the United States and elsewhere, so information you give us crosses borders.
If you are in the European Union or the United Kingdom
The rights the GDPR gives you are the rights listed above, and you exercise them the same way. You can also complain to your national data protection authority.
If you are in California
You may ask what we hold, ask us to delete it, and ask us not to share it. We do not sell personal information, so there is nothing to opt out of on that count.
Everywhere else
Ask us for the same things. We do not intend to give a person in one country fewer rights over their own information than a person in another.
What we do not have
We have no local representative in any country, and we would rather say so than imply an office that does not exist.
Children's Privacy
Age Restrictions
These Services are for people aged 18 and over. We do not knowingly collect personal information from anyone under 18.
If you believe a child under 18 has given us information, write to [email protected] and we will delete it.
Changes to This Privacy Policy
This page changes when what we do changes, and it says what a new part of the platform collects before you use it.
How you will know: the date at the top of this page changes, and a material change is described here rather than buried
We cannot email you about it: we hold no mailing list, which is itself the point of the policy
Earlier versions: ask us and we will send you the one you are asking about
Contact Us
Privacy Questions or Concerns?
If anything on this page is unclear, or if you want something we hold removed, say so and it will be dealt with by a person.
Postal address
Maxsys International Incorporated
1968 S. Coast Hwy #5786
Laguna Beach, CA 92651
United States
The rest of the paperwork
The transparency page has the public filings.