Privacy Notice

सार (Hindi summary)

• Libolink एक डिजिटल प्लेटफ़ॉर्म है, जिसका संचालन अखिलेश निगम द्वारा किया जाता है।
• Libolink लाइब्रेरी चलाने का सॉफ़्टवेयर है। छात्रों की जानकारी उनकी लाइब्रेरी के लिए रखी जाती है। वह जानकारी लाइब्रेरी तय करती है, और Libolink उसे लाइब्रेरी की ओर से सुरक्षित रखता है।
• हम आपकी जानकारी बेचते नहीं हैं और विज्ञापन के लिए इस्तेमाल नहीं करते।
• अटेंडेंस के लिए लोकेशन सिर्फ़ चेक-इन के समय जाँची जाती है। हम सिर्फ़ यह रखते हैं कि आप लाइब्रेरी के दायरे में थे या नहीं, आपकी लगातार लोकेशन नहीं।
• आप अपनी जानकारी देख सकते हैं, सुधार सकते हैं, मिटाने के लिए कह सकते हैं, और दी हुई सहमति वापस ले सकते हैं। छात्र पहले अपनी लाइब्रेरी से संपर्क करें। ऐप में "Privacy requests" से भी अनुरोध कर सकते हैं।
• शिकायत के लिए: अखिलेश निगम (Grievance Officer), info@libolink.com।

1. Who we are and our role

• Libolink is a digital platform managed by Akhilesh Nigam, Gorakhpur, Uttar Pradesh, India ("Libolink", "we", "us"). This notice explains how we handle personal data under the Digital Personal Data Protection Act, 2023 and other applicable Indian law.
• We are the Data Fiduciary for:
  • library owners' and staff accounts;
  • agents;
  • visitors to our website and people who contact us;
  • billing for Libolink subscriptions.
• We are a Data Processor for students' data and a library's operational records. The library decides what it collects and why, and we process that data on its instructions. If you are a student, contact your library first; we help the library respond.

2. What we collect

Owner, staff and agent accounts

• Name, email, mobile number, role and permissions.
• A password, stored only as a secure hash by our authentication provider.
• For platform administrators: the authenticator (two-step) setup.

Library details

• Library name, address and city.
• Public page content and photos.
• Fee collection details you add, such as a UPI ID or QR code, payee name and bank details.
• Plans, prices, seats and shifts.

Students (on behalf of their library)

• Identity and contact: name, mobile, email, date of birth, joining date, student code and photo.
• Studies and family: exam or course, guardian name and mobile, address and emergency contact.
• Membership: plan, seat and shift; fee and deposit records; payment references such as UTR numbers; payment proof screenshots.
• Attendance: check-in and check-out times, method and breaks.
  • For location-checked attendance, we keep only whether the device was inside the library area, with the distance and accuracy in metres.
  • We do not store your coordinates or track your location continuously.
• Study and progress: study sessions, goals, habits, mock test scores and syllabus progress.
• Library communications: notices, complaints, discipline notes, support requests and documents uploaded to the library.
• Guardian consent records for students under 18.

Agents and invites

• Referral code, commissions and payouts.
• Details an agent enters to invite a library owner: owner name, mobile, email, library name and city. Invites that do not become a library are deleted after 90 days.

Technical data

• IP address, used for security, rate limiting and fraud prevention.
• Device push token, if you turn on notifications.
• App version and error logs.
• Audit logs of important actions, such as approvals, exports and permission changes.

Website

• What you send through contact or demo forms.
• Optional analytics, collected only if you turn it on. These are counts of page events and are not used to build a profile of you.
• Browser storage for your sign-in session, language and branch choice.

Payments to Libolink

• Plan, amount and payment reference.
• Card and UPI details for online payments are handled by Razorpay; we do not store card numbers.

3. Why we use it

We use personal data to:

• provide the service and the features the library uses;
• keep accounts secure and prevent fraud;
• bill Libolink subscriptions and issue tax invoices;
• give support;
• send service notifications;
• keep the service reliable, using aggregated information;
• meet legal obligations.

We process personal data on the basis of consent, or for legitimate uses permitted by Section 7 of the Digital Personal Data Protection Act, 2023. Examples are data you provide voluntarily for a stated purpose, or processing needed to comply with law.

We send marketing messages to library owners only with their consent, and you can opt out at any time. We do not sell personal data. We do not use students' data for advertising.

4. Children

• Many students are adults, but some are under 18.
• For a student under 18, the library must obtain verifiable consent from a parent or lawful guardian before processing their data. Libolink provides a guardian-consent workflow for this.
• We do not use children's data for targeted advertising or for behavioural profiling unrelated to the library's services.

5. Who we share data with

• The student's library. Student data is available to the library and the staff it authorises.
• Service providers that process data for us under contract. They are listed in our Sub-processors page and include hosting and database, payments (Razorpay), push notifications (Google Firebase and Apple) and email delivery.
• Authorities, when the law requires it.
• A buyer or successor, if our business is transferred, with notice to you.

6. Where data is stored

• Our primary database is hosted in India (Mumbai).
• Some service providers may process data outside India, as permitted by Indian law and subject to any restrictions the Government notifies.

7. How long we keep it

• Account data is kept while the account is active.
• A library's data is kept while its subscription and export window last. It is then deleted or anonymised, except data we must keep by law.
• Backups are overwritten within 35 days.
• Financial and tax records are kept for as long as tax and accounting laws require.
• Security and audit logs are kept for 12 months, unless they are needed for an investigation or a legal claim.
• Unused agent invites are deleted after 90 days.

8. Your rights

You can ask to:

• access a summary of your data and of who it was shared with;
• correct, complete or update it;
• erase it, where the law allows;
• withdraw consent, which is as easy as giving it;
• nominate another person to act for you in case of death or incapacity;
• have a grievance redressed.

How to make a request:

• Students: contact your library, or use Privacy requests in the app.
• Owners, staff and agents: use the app, or email info@libolink.com.

We verify identity before acting. We respond within the time the law requires, and aim to do so within 15 days. Some records must be kept by law, such as financial and audit records. When that applies, we tell you what was kept and why.

9. Security

• Encryption in transit.
• Each library's data is kept separate by database access rules.
• Role-based permissions for staff.
• Two-step verification for platform administrators.
• Libolink administrators may open a library's workspace to set it up, give support or correct records. This access lasts at most 8 hours at a time, and every entry and change is recorded in that library's audit log, which the library owner can see.
• Malware scanning of uploads.
• Audit logs and regular backups.
• If a personal data breach occurs, we inform affected users and the Data Protection Board of India as the law requires. Where we act for a library, we inform the library promptly so it can do the same.

10. Contact and complaints

• Grievance Officer / contact for privacy questions: Akhilesh Nigam, info@libolink.com, Gorakhpur, Uttar Pradesh, India.
• If you are not satisfied with our response, you may complain to the Data Protection Board of India.

11. Changes to this notice

• We update this notice when our practices or the law change. For material changes, we notify users in the app or by email before they take effect.