Privacy Policy

1. About This Policy

GospelWed (“we”, “our”, or “us”) operates a Christian matrimonial service for adults in India. We act as the Data Fiduciary under the Digital Personal Data Protection Act, 2023 (DPDP Act) and are committed to protecting the privacy, dignity, and safety of every Data Principal who uses our mobile application, admin portal, and marketing website (together, the “Services”). This Privacy Policy explains how we collect, use, disclose, retain, and secure personal data, the choices available to you, and the rights you can exercise under the DPDP Act and other applicable laws.

2. Scope & Key Definitions

This policy covers all GospelWed branded experiences, including discovery, interest, match, and trust & safety workflows.

• Data Principal: An identified or identifiable individual using GospelWed, including members and guardians acting with consent.
• Personal Data: Any data about a Data Principal such as name, age, location, photos, religious affiliation, or preferences.
• Sensitive Personal Data: Faith affiliation, denominational details, matrimonial intent, and photos submitted to the platform.

3. Data We Collect

4. Purposes & Lawful Bases

We process personal data only for lawful purposes and in alignment with the DPDP Act:

• Account creation & authentication: Verify your identity via MSG91 OTP and maintain secure sessions. (Consent)
• Discovery & matchmaking: Generate recommendations, surface relevant profiles, and manage private photo access post-match. (Consent)
• Trust & safety: Investigate reports, enforce community standards, and protect against fraud. (Legitimate use / compliance)
• Service improvement: Analyse aggregated trends, address bugs, and enhance performance. (Legitimate use)
• Communication: Provide policy updates, feature announcements, or respond to support enquiries. (Consent or legitimate use depending on message type)
• Legal obligations: Meet requirements under Indian law, respond to lawful requests, and maintain audit logs. (Compliance)

5. Consent Management & Withdrawal

When you sign up, complete your profile, or upload photos, you consent to GospelWed processing your personal data for the stated purposes. You may withdraw consent or restrict specific activities by:

• Editing or deleting information in the profile and photo management screens.
• Using the in-app account deletion feature to remove your profile and associated data.
• Contacting support@gospelwed.com to request withdrawal or targeted restrictions.

Withdrawing consent may affect matching outcomes or access to features. We will explain the consequences before completing your request.

6. Sharing & Disclosure

We never sell personal data. We share information only with trusted processors to deliver the Services:

• MSG91: Sends OTP messages to authenticate accounts.
• Google Cloud Platform & MongoDB Atlas: Host our API, database, and photo storage infrastructure within secure regions.
• Firebase (planned): Crash reporting and push notifications will follow separate notice and consent before activation.
• Trust & safety partners: External advisors or legal counsel engaged for investigations, only when necessary and under confidentiality.

We may disclose data when required by law, regulatory request, or to protect the rights and safety of users.

7. Data Retention & Deletion

Retention aligns with the data inventory matrix in our implementation plan.

• Active account data remains available while you use GospelWed.
• Upon account deletion, we remove profile data, photos, interests, and matches within 30 days and revoke signed photo URLs immediately.
• Reports, blocks, and audit logs may be retained for up to 24 months to comply with legal obligations and protect community safety.
• System logs rotate on a 90-day schedule, with IP addresses anonymised where feasible.

8. Security Safeguards

• Encryption in transit (HTTPS/TLS) for all API and admin traffic.
• Access controls, role-based permissions, and audit trails for staff actions.
• Segregated Google Cloud Storage buckets for public and private photos with signed URL expiry.
• Continuous monitoring and incident response runbooks to detect and resolve security events.

If a breach risks your rights or interests, we will notify you and regulators as required by the DPDP Act.

9. Data Principal Rights

You can exercise the following rights under the DPDP Act:

• Access: View or request a copy of your personal data.
• Correction & Completion: Update inaccurate or incomplete information.
• Erasure: Delete your account and associated data, subject to legal exceptions.
• Portability: Receive a structured export of key profile fields and contact history.
• Grievance Redressal: Escalate unresolved concerns to our Grievance Officer.

Submit requests through the in-app privacy controls or email. We acknowledge within 7 days and aim to resolve within 30 days.

10. Children & Age Restrictions

GospelWed is strictly for individuals aged 18 or older. We do not knowingly collect data from children. If we learn that data from a minor has been submitted, we will delete it promptly.

11. International Transfers

Production systems are hosted in regions aligned with Indian data protection requirements. If we transfer data across borders, we will ensure adequate safeguards and provide additional notice where required.

12. Grievance Officer & Contact

Grievance Officer: GospelWed Trust & Safety Lead
Email: support@gospelwed.com
Response timeline: acknowledgement within 7 days; resolution within 30 days.

For additional escalation, you may contact the Data Protection Board of India once internal remedies are exhausted.

13. Updates to This Policy

We revise this policy when we launch new features, onboard new processors, or update our legal obligations. Updated versions will be posted here with a new effective date, and significant changes will be communicated via in-app notice and email where available.