Privacy Policy

Last updated: 2026-05-18

This page is published in English and हिंदी to comply with DPDP §5(3). Use the language switcher at the top of the site to toggle.

1. Who we are

PMC Hindi (this website, pmcmeditation.com, and the PMC Hindi mobile app) is operated by Onemedia Network Limited, a company registered in India [FILL IN: registered address]. We are the data fiduciary for personal data you provide to us through these channels.

If you have any question about this policy or your data, contact our grievance officer (see Section 13).

2. What data we collect

We collect only what we need to deliver the program or service you signed up for, and what India's Income Tax Act or other laws require us to record.

• Account data when you register: name, mobile number, email (optional), date of birth, gender, city, profession.
• Children's data (Jagrut Kids only): child's first name, age band, gender (optional), traits the parent describes, the parent's name and contact. We also record the parent's explicit consent timestamp and the consent version they accepted.
• Donation data: full name, PAN or Aadhaar (you choose; needed only for §80G receipts), email, phone, address, donation amount and currency. Payment card details are entered directly with Razorpay and are NOT seen or stored by us.
• Usage data: device type, operating system, browser, IP address (truncated), referring page, pages visited, time spent. We use this to understand traffic patterns and improve the product.
• Cookies & local storage: a session cookie, your selected language, referral attribution, and (if you accept) marketing analytics trackers. Essential cookies cannot be disabled without breaking the site; everything else is optional.
• If you sign in with Google or Apple: name, email, and profile picture URL as released by the OAuth provider. We do not get your password.

3. Why we collect it (lawful basis)

Under DPDP Act 2023 §6 and (where it applies) GDPR Art. 6, every processing operation needs a lawful basis. Ours are:

• Performance of service: to deliver the meditation program, send session links, manage your registration.
• Legal obligation: to issue donation receipts and retain records under the Income Tax Act §80G, and to comply with the Information Technology Act and rules thereunder.
• Your explicit consent: for marketing emails/WhatsApp/SMS, for storing Aadhaar (you tick a separate consent box for this), and for parental consent on Jagrut Kids.
• Legitimate interest: security, fraud prevention, and aggregated analytics to understand how the site is used.

4. Who we share it with (our processors)

We do not sell your personal data to anyone. We do rely on the following third-party processors to operate the service; each is bound by their own data protection agreement with us:

• Supabase Inc. — database and authentication hosting.
• Vercel Inc. — application hosting and CDN.
• Razorpay Software Private Limited — payment processing for Indian donations.
• MSG91 — OTP/SMS/WhatsApp delivery for sign-in and program communications.
• Google LLC — Google Analytics, Google Ads conversion tracking, Google Sign-In OAuth.
• Meta Platforms Inc. — Meta Pixel for advertising attribution.
• Apple Inc. — Sign in with Apple OAuth (only if you choose to use it).

5. Cross-border transfers

Several of the processors above store data on servers outside India. We transfer your data to them under DPDP §16 (processing in notified countries) and, for EU residents, under GDPR Chapter V (Standard Contractual Clauses where applicable). If the Government of India restricts transfer of any data category, we will update this policy and the relevant processors.

6. How long we keep your data (retention)

• Active account data: while your account exists. Within 30 days of an account-deletion request, we delete your profile, addresses, registrations and referrals.
• Donation records: retained for at least 7 years from the donation date to satisfy Income Tax Act record-keeping for §80G claims. Personally-identifying fields (mobile, email) are redacted at the end of the active period if your account is deleted earlier.
• Children's traits and preferences (Jagrut Kids): purged 12 months after the child's last program.
• Aadhaar number: stored only as long as needed to issue your §80G receipt, then redacted to the last four digits. You may ask us to redact it earlier.
• Analytics, funnel events, log data: 13 months.
• OTP request logs: 90 days (security audit only).

7. Your rights

As a data principal under DPDP Act 2023, you have the following rights:

• Access — request a summary of the personal data we hold about you.
• Correction — ask us to correct, complete or update inaccurate data.
• Erasure — ask us to delete your personal data. Self-serve via the “Delete my account” button on your profile page, or by emailing us.
• Withdraw consent — for any processing that relies on consent (marketing, Aadhaar storage, parental consent), at any time and without giving a reason.
• Grievance redressal — write to our grievance officer (Section 13). We respond within 30 days of receiving a grievance, and you can escalate to the Data Protection Board of India if you are not satisfied.
• Nominate a successor — you can nominate another natural person to exercise your rights in the event of your death or incapacity (write to the grievance officer).

8. Children

Our general programs are intended for users aged 18 and above. Jagrut Kids is the only program offered to children, and registration there requires explicit consent from a parent or legal guardian on a separate, versioned consent statement (DPDP §9). We do not run targeted advertising at children, do not profile them, and do not allow under-18s to create independent accounts on the main site.

A parent can withdraw consent and request deletion of a child's data at any time by emailing the grievance officer.

9. Cookies and tracking

We use a small number of essential cookies (your session, your language, your referral attribution) that are needed for the site to function. We also use analytics and advertising trackers from Google and Meta. We are in the process of introducing a consent banner for non-essential trackers; until that ships, you can opt out at the browser level (Do Not Track / extension-level blockers) and the site will still work.

10. Security

All traffic to this site is served over HTTPS. Passwords are hashed and salted at the database layer (we never see your password). Payment card information is entered directly with Razorpay and never reaches our servers. Mobile OTPs are delivered through MSG91 with short expiry windows. We work to limit access to personal data inside the team to those who need it for the job they're doing.

11. Changes to this policy

We update this policy from time to time. When the change is material (e.g. a new processor, a new data category, a change in retention), we post a banner on the site and email signed-in users at the address on file. The “Last updated” date at the top of this page is authoritative.

12. GDPR (for EU/UK residents)

If you are in the European Economic Area, the United Kingdom, or Switzerland, the EU/UK General Data Protection Regulation (GDPR) applies in addition to DPDP. Onemedia Network Limited is the data controller. Our lawful basis for processing is set out in Section 3 above and corresponds to GDPR Art. 6 (consent, contract, legal obligation, legitimate interest as relevant). You have the rights listed in Section 7 plus the GDPR-specific right to data portability and the right to object to direct marketing. To exercise these rights, contact the grievance officer; you may also complain to your local supervisory authority.

13. Grievance officer

As required by DPDP Act §10 and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021, our grievance officer is reachable as follows:

• Name: [FILL IN: grievance officer name]
• Email: support@pmchindi.com (subject line: “Grievance — <your topic>”)
• Acknowledgement: within 24 hours of receipt.
• Resolution: within 30 days for DPDP grievances, within 15 days for IT Rules 2021 grievances.
• Escalation: if you are not satisfied, you may approach the Data Protection Board of India (once established) or the relevant Indian court.

14. Contact

General questions, account help, withdrawal of consent: support@pmchindi.com.