Data Collection, Telemetry & Proof-of-Consent Policy
Effective Date: October 2, 2026 • Domain: eligohub.in • Jurisdiction: Republic of India
Eligo operates on an irrevocable, legally binding principle: We do NOT sell, rent, lease, trade, or transfer your personal contact information (Full Name, Mobile Number, Email Address, or Assessment Profile) to any third-party broker, marketing agency, advertiser, or private enterprise under any circumstance. Ever.
Our public-interest civic portal is supported exclusively through non-personal contextual advertisements (Google AdSense) and institutional grants. Your personal data is never an asset for commercial sale.
1. Statutory Framework & Legal Scope
Eligo (eligohub.in) operates as an independent civic-technology discovery platform. This Policy governs the processing of interaction telemetry and voluntary notifications in strict compliance with the laws of the Republic of India:
- The Digital Personal Data Protection Act, 2023 (DPDP Act 2023) — including Section 3(c) (Non-Personal Data), Section 6 (Consent Architecture), and Section 6(10) (Proof of Notice & Consent).
- The Information Technology Act, 2000 (IT Act) — Section 43A and Section 72A.
- The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (SPDI Rules).
- The Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016 — Section 29.
2. Categories of Data Collected & Processing Purposes
Eligo processes data under two distinct, segregated classifications:
A. Anonymized Eligibility Assessment Inputs ("Find My Scheme")
When you use our interactive Citizen Eligibility Assessment tool (/eligibility-checker/), you enter demographic attributes: age group, state/UT of residence, estimated annual income ceiling, occupation category, constitutional social category (SC, ST, OBC, EWS, General), and gender.
- Purpose: Solely to evaluate mathematical qualification against published statutory criteria in Central and State Gazette notifications.
- Non-Personal Classification: These demographic parameters are decoupled from individual personal identities and assigned an ephemeral browser session identifier (
session_id) that expires upon closing your browser.
B. Civic Search Queries & Navigation Metrics
Search keywords submitted in our instant search interface, result counts, language selection (en / hi), and clicked autocomplete suggestions.
- Purpose: Identifying which welfare programs and scholarships are most actively sought by citizens to prioritize editorial verification.
C. Scheme Engagement Dwell & Outbound Redirection
Individual scheme views (logged only after a 2.5-second reading dwell time or 30% scroll depth) and clicks on outbound official application buttons redirecting to official nodal portals (.gov.in / .nic.in).
- Spam & Bot Filtering: Automated web crawlers, headless scrapers, and accidental bounces are automatically filtered out via client-side gates.
D. Voluntary Citizen Contact Details ("Curated Schemes for You")
When you voluntarily subscribe to receive curated welfare alerts and impending deadline notifications, we collect:
- Full Name: To personalize notifications and alerts.
- Indian Mobile Number (10 digits): To dispatch WhatsApp / SMS notifications for urgent scheme deadlines, new application windows, and subsidy releases.
- Email Address (Optional): To dispatch detailed scheme eligibility briefs and document checklists.
- Sector of Interest: To filter notifications (e.g. Agriculture, Education, MSME Loans).
E. Citizen Civic Advisory & Document Verification Services (/advisory/)
When you voluntarily engage our independent advisory desk for a Personalized Scheme Blueprint (₹49), Application Document Audit (₹299), or 1-on-1 Consultation Call (₹599), we collect:
- Applicant Name & Contact: Full Name, 10-digit Indian Mobile/WhatsApp Number, and Email Address to deliver reports and coordinate sessions.
- Civic Demographic Context: State of domicile and specific scheme query (e.g. Post-Matric Scholarship, NIT Fee Remission, PMEGP readiness).
- Statutory Proof of Consent: Exact timestamp, IP address, and affirmative checkbox acceptance acknowledging independent advisory scope.
- Payment Transaction Data: Transaction ID and order ID generated by RBI-authorized payment aggregators (Razorpay). Zero bank card numbers, CVVs, or UPI PINs are ever collected or stored by Eligo.
- Purpose Limitation (DPDP Act): Data is utilized solely to deliver the commissioned report or consultation and is never sold, shared, or repurposed.
3. Statutory Proof of Consent Protocol (DPDP Act 2023, Section 6(10))
Under Section 6(10) of the DPDP Act 2023, where personal data is processed based on consent, the Data Fiduciary is mandated to prove that notice was given and consent was affirmatively granted. Eligo implements an automated, immutable digital audit trail for every consent transaction:
consent_timestamp captures the exact millisecond ISO 8601 UTC & IST timestamp generated by the user's browser at the precise moment the affirmative submission occurs.created_at records the cryptographic PostgreSQL server timestamp upon ingestion into our Mumbai database cluster.policy_version and terms_version record the exact version identifier of the policies displayed and accepted.consent_notice_text archives the verbatim notice language that was presented next to the unchecked consent checkbox.page_url and user_agent capture the exact URL location and browser client context to prevent fraudulent attributions.4. Strict Data Red Lines — What We Never Collect
In accordance with our core non-governmental mission and Indian statutory law, Eligo strictly prohibits and never solicits, collects, or stores:
5. Domestic Storage, Security & Data Localization (Mumbai, India)
Eligo maintains rigorous security controls aligned with Section 8(5) of the DPDP Act 2023 and Section 43A of the Information Technology Act, 2000:
- Sovereign Domestic Hosting: All telemetry and voluntary subscription data is stored exclusively on managed database infrastructure physically situated in Mumbai, India (
ap-south-1). No citizen data is exported outside the sovereign borders of India. - Cryptographic Encryption: All transmissions are encrypted in transit via Transport Layer Security (TLS 1.3/HTTPS) and encrypted at rest utilizing AES-256 encryption.
- Row-Level Security (RLS) Isolation: The database enforces strict PostgreSQL Row-Level Security policies. Public client endpoints are configured with INSERT-ONLY permissions; public access to read, query, update, or delete existing records is strictly blocked by the database engine.
- Anti-Flooding Rate Limits: Automated sliding-window database triggers drop write bursts exceeding 25 events per minute to prevent abuse.
6. Right to Withdraw Consent & Erasure (DPDP Act 2023, Section 6(4))
As a Data Principal under Indian law, you have the statutory right to withdraw your consent at any time as easily as it was given. To withdraw consent or request complete erasure of your voluntary contact details:
Send an email to privacy@eligohub.in from the registered email address or mentioning the registered 10-digit mobile number with the subject line WITHDRAW CONSENT - [Mobile Number].
Service Level Agreement (SLA): Upon receipt, our compliance team executes complete and irreversible deletion of your lead record from our Mumbai database cluster within 72 business hours, and confirms deletion via reply.
7. Grievance Redressal Mechanism
Under the Digital Personal Data Protection Act, 2023 and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, any questions, audit requests, or compliance inquiries may be submitted to our designated Grievance Officer:
Grievance Officer: Eligo Civic-Tech Compliance Desk
Email: privacy@eligohub.in
Official Domain: https://eligohub.in
Physical Jurisdiction: New Delhi, Republic of India