Privacy Policy

Overview

NetworkDada ("we", "us") operates a professional referral network platform. This policy explains how we collect, use, and protect your personal data. We comply with the Digital Personal Data Protection Act, 2023 (DPDPA 2023) in India and applicable data protection laws globally.

Data We Collect

How We Use Your Data

• Account Management: Creating and managing your membership, profile, and Circle roles.
• KYC Verification: Confirming identity for regulatory compliance and security.
• Referral Tracking: Logging VCOB, tracking referrer/referee relationships, facilitating confirmations.
• Scoring: Computing RINGS scores and Circle Health Index (CHI).
• Notifications: Sending membership confirmations, ask notifications, VCOB reminders, and Circle director alerts.
• Guest Management: Enforcing 2-visit/year limits, tracking guest profiles, enabling director approvals.
• Analytics: Anonymized, aggregate usage patterns (no individual profiling for marketing).
• Legal Compliance: Responding to lawful requests from law enforcement (with DPDPA safeguards).
• Fraud Prevention: Detecting and preventing misuse of VCOB records or multiple-profile abuse.

KYC Data Handling (India Members)

We partner with authorized KYC providers for Aadhaar verification. The following protections apply:

• Aadhaar Hash Only: We never store your actual Aadhaar number. Only the hashed result of verification is stored.
• GST Lookup: GST numbers are verified via government databases but not permanently stored, only confirmation recorded.
• Encryption: All KYC-related data in transit and at rest is encrypted (AES-256).
• Third-Party Compliance: KYC providers are bound by DPDPA 2023 and ISO 27001 standards.
• Retention: KYC records retained for 7 years per Indian tax law, then securely deleted.

VCOB Record Privacy

• Dual Visibility: Only the referrer and referee see full VCOB details.
• Circle Director View: Directors see aggregate VCOB in their circle (not individual business descriptions) for CHI calculation.
• Admin Audit Only: NetworkDada admins can view VCOB records only for fraud investigation, never for marketing.
• Confidentiality: VCOB business descriptions remain private between the two parties.
• Permanent Record: VCOB records are never deleted (required for audit trail and past relationship mapping).

Data Retention

• Active Member Data: Retained while membership is active.
• Soft Deletion on Exit: When a member leaves, their account is marked deleted but data retained (no hard delete ever).
• Re-Admission: Former members can re-activate accounts; all history is preserved.
• VCOB & RINGS History: Permanent record for audit and future reference.
• Backup & Disaster Recovery: Data backed up regularly; old backups deleted after 30 days of being superseded.

Email Communication

• Transactional Emails: Membership confirmations, ask notifications, VCOB reminders (cannot be opted out).
• Marketing Emails: Tips, new features, event invites (can be toggled in account settings).
• Unsubscribe: Click "unsubscribe" in any marketing email. Transactional emails continue per service terms.
• Email Storage: All emails sent and received via platform are stored for compliance audit (max 2 years).

Third-Party Data Sharing

We do NOT sell or share personal data with third parties except as necessary:

• KYC Providers: Limited to Aadhaar/GST verification (no access to your profile or VCOB data).
• Payment Processors: Razorpay (India) and Stripe (global) receive only transaction data (no business descriptions or VCOB details).
• Email Service: AWS SES receives recipient email and notification text (no sensitive business data).
• Compliance: Law enforcement requests honored only with legal process (warrant/court order) and DPDPA safeguards.
• Analytics: PostHog and GA4 receive anonymized, aggregated usage (no PII).

Security & Infrastructure

• Hosting: AWS Mumbai (ap-south-1) — compliant with PDPB 2023 (data residency in India).
• Encryption: TLS 1.3 for data in transit. AES-256 for sensitive data at rest (KYC, bank details).
• Authentication: JWT tokens, refresh token rotation, optional 2FA available.
• Access Controls: Role-based access. Admins can audit logs but cannot see passwords or decrypted KYC data.
• Monitoring: Sentry for error tracking (no sensitive user data logged). Security patches applied within 24 hours.

Your Data Rights (DPDPA 2023)

Under India's DPDPA 2023, you have the right to:

• Access: Request a copy of all personal data we hold. Submit via hello@networkdada.com
• Correction: Update inaccurate data in your account anytime.
• Deletion (Limited): Request anonymization of PII (name, email, phone). VCOB records, RINGS history, and KYC records cannot be deleted (required for accuracy and compliance).
• Portability: Export your data in machine-readable format. Requests processed within 5 business days.
• Grievance: File a complaint with the Data Protection Board of India (dpboard.gov.in).

Policy Updates

We may update this policy. Changes with 30 days' notice are binding on continued use. Critical changes (data sharing, retention) require explicit opt-in. Review this page regularly for updates.