Privacy Policy

1. Who we are (Data Controller / Data Fiduciary)

Nitya Panchangam operates the website nityapanchangam.com. For the purposes of India's Digital Personal Data Protection Act 2023 (DPDP), we are the Data Fiduciary. For the purposes of the EU General Data Protection Regulation (GDPR), we are the Data Controller. For California residents under CCPA, we are the Business.

Registered contact: use the Contact page. Grievance Officer contact for India DPDP-related complaints: same page.

2. Data we collect

• City preference: if you select a city for panchangam, we store the choice in your browser's localStorage. It never leaves your device.
• Newsletter signup (double opt-in): if you subscribe to the daily panchangam email, we store your email address, chosen city, signup time, IP address and the page you signed up from, on our own server. Nothing is added to the mailing list until you confirm via the link we email you. Used only to send you the newsletter; never shared or sold.
• Contact form / email: if you email us via the Contact page, we retain the email and its contents for up to 3 years to resolve your request and for our records.
• Advertising data (collected by Google, not by us): ads on this site are served by Google AdSense. Google receives your IP address, user-agent and the page you are viewing, and may set cookies or read device identifiers to serve, cap and measure ads. We never see that data at individual level — only aggregate earnings reports. Details: How Google uses information from sites that use our services.
• Link clicks (no identifier): when you click a link that leaves this site — an Amazon product link or any other outbound link — we record one line on our own server: the time, the event name, the page you were on, the destination domain, and the Amazon Associates tag if the link carries one. No IP address, no user agent, no cookie, no session or device identifier and no query string is stored, so the line cannot be connected to you, to your other visits, or to anything else. We keep it only to see which links are useful and remove the ones nobody uses. If your browser sends DNT: 1 or Global Privacy Control, nothing is sent at all.
• What we do NOT collect: we do not require registration, we do not collect names, phone numbers, addresses, birth dates, or any special-category (sensitive) personal data. If you provide birth data for a kundli/horoscope calculation, it is computed client-side and never transmitted to our servers.

3. Purposes & legal basis

4. Data sharing (third parties)

• Resend (email delivery): newsletter confirmation and daily emails are delivered through Resend, our email service provider, which processes recipient addresses on our behalf under its privacy policy. Servers may be located outside India / EU (see §7 International Transfers).
• Amazon.in (affiliate links): when you click an Amazon product link (tagged digitalshala4-21), Amazon may set its own cookies and process your data under Amazon's privacy policy. We receive only aggregated commission reports, not identifiable browsing data.
• Hostinger (hosting): server logs (IP, user-agent, timestamp) are processed by our hosting provider for security and network operation. Retained per Hostinger policy (~30 days for access logs).
• WhatsApp (channel link): if you click through to our WhatsApp channel, WhatsApp/Meta's policies apply.
• Google AdSense (advertising): Google and its advertising partners serve the ads on this site and process your IP address, user-agent, approximate location and the page you are viewing for that purpose, including through cookies and device identifiers. See How Google uses information from sites that use our services. Opt out of personalisation at Google My Ad Center.
• We do not sell or rent your personal data for money. Serving personalised advertising counts as “sharing” under California’s CPRA; you can stop it using the privacy options link on the page or in Google My Ad Center.

5. Data retention

• Contact emails: up to 3 years, then deleted.
• Newsletter list: until you unsubscribe (every email carries a one-click unsubscribe link) or ask us to delete your address.
• Server access logs: ~30 days.

6. Your rights

All users

• Unsubscribe from the newsletter at any time — every email carries a one-click unsubscribe link.
• Object to processing.
• Request access to any personal data we hold on you.
• Request correction or deletion (erasure).
• Request portability (structured, machine-readable export).
• Complain to your supervisory authority.

EU / UK (GDPR Art. 13-22)

Rights above + right to restriction of processing (Art. 18) + right to lodge a complaint with your national Data Protection Authority (list at edpb.europa.eu).

California (CCPA / CPRA)

Right to know what personal information is collected, disclosed, sold or shared; right to delete; right to correct; right to opt out of the “sale” or “sharing” of personal information for cross-context behavioural advertising; right to limit use of sensitive personal information (we do not process any); right to non-discrimination. We do not sell personal information for money. To stop the “sharing” involved in personalised advertising, use the privacy options link shown on the page or Google My Ad Center. Other requests: Contact page.

India (DPDP Act 2023)

Right to access, correction, erasure, grievance redressal (§11-13), right to nominate. Grievance Officer: contact via the Contact page — mark subject "DPDP Grievance". Response within 15 days. If unresolved, complain to the Data Protection Board of India.

7. International data transfers

We run no third-party analytics. Two flows involve processing outside India / the EU: advertising served by Google, whose infrastructure is global (Google relies on the EU Standard Contractual Clauses and its own adequacy arrangements), and newsletter email delivery through Resend, whose servers may be outside India / EU. If you are in India, the DPDP Act permits transfers to territories not specifically restricted by the Central Government.

8. Cookies

See the dedicated Cookie Policy. In short: strictly-necessary functional storage (city and theme preferences), no analytics cookies of any kind, and Google’s advertising cookies — which you can refuse in the EEA / UK / Switzerland and switch off anywhere at Google My Ad Center.

9. Do Not Track

We honour it. The outbound-link counter described in §2 is the only measurement running on this site, and it sends nothing at all when your browser sets DNT: 1 or Global Privacy Control. Google’s advertising cookies do not respond to DNT — control those through the consent message (EEA / UK / Switzerland) or Google My Ad Center, which do take effect.

10. Children's privacy

The site is not directed at children under 13. We do not knowingly collect personal data from children. If you believe a child has provided data, contact us and we will delete it.

11. Security

The site is served over HTTPS with HSTS preload; Content Security Policy limits which origins can execute scripts; strict-origin-when-cross-origin referrer policy prevents URL leakage across sites. No system is perfectly secure — we mitigate known risks and disclose breaches per DPDP §8 / GDPR Art. 33-34 if they occur.

12. Changes to this policy

We may update this policy to reflect legal changes or new features. The "Last updated" date at the top always reflects the current version. Material changes will be announced on this page.

13. Contact

All privacy queries + DPDP grievance requests: Contact page. Please mark subject line with "Privacy" or "DPDP Grievance" as appropriate.