Privacy Policy

2.1 Age Restriction

The Platform is available only to individuals aged eighteen (18) years or older. We do not knowingly collect or process the personal data of any child, as defined under the DPDP Act. Registration requires a self-declared date of birth, and any account later found to belong to a person under eighteen (18) is suspended and its personal data erased. No parental or guardian consent mechanism is offered because the Platform is not directed at, and does not knowingly onboard, children.

2.2 Personal Data We Collect

We collect the following categories of personal data:

• Account and profile data: name, date of birth, email address, phone number, profile photograph, parish/diocese affiliation, and FAITHBOOK member verification details.
• Content data: posts, messages, comments, and media you upload to the Home Feed, Chat, or Services & Events features.
• Usage data: log-in activity, device identifiers, app interaction data, and search queries, collected for security, moderation, and service-improvement purposes.
• Communications data: correspondence with the Grievance Officer, Data Protection Officer, or support team.
• Location data: where you enable it, approximate location used for relevant Services & Events discovery.

2.3 How We Use Personal Data

We use personal data to: operate and maintain the Platform, including the Home Feed, Search & Discovery, Messaging/Chat, and Services & Events features; verify FAITHBOOK membership; maintain safety and security, including CSAM detection and moderation; respond to grievances and legal requests; and comply with applicable law. We do not use personal data for behavioural monitoring or targeted advertising. Sponsored placements shown on the Platform are contextual only, limited to Catholic institutions approved by a Platform Administrator, and are not personalised using your data.

2.4 Legal Basis and Consent

We process personal data on the basis of your consent, given at the point of collection through a clear, layered notice explaining what data is collected and why. You may withdraw consent at any time through Settings or by contacting the Data Protection Officer; withdrawal takes effect prospectively and does not affect the lawfulness of processing carried out before withdrawal. Certain processing (e.g., in response to a lawful government or court order, or for compliance with the Information Technology Act, 2000) is carried out under legal obligation independent of consent.

2.5 Sharing and Disclosure of Personal Data

We do not sell personal data. We may share personal data with:

• service providers who process data on our behalf (e.g., Google Firebase for hosting, Razorpay if a payment feature is introduced), under contractual confidentiality obligations;
• law enforcement, the Special Juvenile Police Unit (SJPU), or the National Center for Missing & Exploited Children (NCMEC), where required for child-safety reporting under the POCSO Act, 2012 or upon a valid legal order;
• the Data Protection Board of India, where required under the DPDP Act;
• Platform, Region, Diocese, Zone, or Parish Administrators, solely to the extent necessary for moderation and administration of the community they oversee;
• a successor entity in the event of a merger, acquisition, or asset sale, subject to equivalent privacy commitments.

2.6 Data Storage and Localisation

Personal data of Indian users is stored using Google Firebase (Google Cloud Platform). Firebase services that support regional selection — Cloud Firestore, Cloud Storage for Firebase, and Cloud Functions — are provisioned in the Mumbai (asia-south1) region so that personal data remains resident in India. Where a Firebase service does not currently offer an Indian region, any resulting cross-border transfer is assessed and documented in accordance with the DPDP Act's provisions on transfers to permitted jurisdictions.

2.7 Data Retention

We retain personal data only for as long as necessary for the purpose for which it was collected. Notwithstanding the foregoing, personal data, associated traffic data, and processing logs are retained for a minimum of one (1) year from the date of processing, in accordance with the Seventh Schedule to the Digital Personal Data Protection Rules, 2025. Information required for investigation purposes is retained for the statutory period following account cancellation, as required under the Information Technology Act, 2000. Upon account deletion, retained data is limited to the categories above; deletion and permanent deactivation are irreversible and no restoration path is offered.

2.8 Your Rights as a Data Principal

Subject to the DPDP Act and its rules, you have the right to:

• access a summary of the personal data we hold about you and the processing activities carried out;
• correct inaccurate or incomplete personal data;
• request erasure of your personal data, unless retention is required by law;
• withdraw consent at any time, with prospective effect;
• nominate another individual to exercise these rights on your behalf in the event of death or incapacity;
• lodge a grievance with our Data Protection Officer, and, if unresolved, with the Data Protection Board of India.

We aim to resolve Data Principal grievances within a reasonable period not exceeding ninety (90) days, as contemplated under the DPDP Rules, 2025. Requests may be made through Settings or by contacting the Data Protection Officer using the details in Section 2.11.

2.9 Data Security and Breach Notification

We implement reasonable technical and organisational security safeguards to protect personal data against unauthorised access, loss, or misuse, including encryption in transit, access controls, and restricted, logged access to sensitive content such as flagged CSAM material. In the event of a personal data breach, we will provide prompt initial notice to the Data Protection Board of India and to all affected Data Principals, followed by a detailed report to the Board within the prescribed follow-up period, in accordance with the two-tier structure under the DPDP Rules, 2025.

2.10 Children's Data

The Platform is not directed at children and account creation is restricted to individuals aged eighteen (18) years and above. We do not knowingly process the personal data of a child, do not conduct behavioural monitoring or targeted advertising directed at any user, and do not rely on parental or guardian consent as a lawful basis. If we become aware that we have inadvertently collected personal data from a child, we will suspend the associated account and erase that data.

2.11 Data Protection Officer and Grievance Contact

FAITHBOOK has appointed Mr. Ankit Francis as Data Protection Officer. Queries regarding this Privacy Policy or the processing of your personal data may be addressed to him via the Contact section of this website. Grievances regarding content or conduct on the Platform (as distinct from data-protection queries) should be directed to the Grievance Officer identified in Section 1.13 of the Terms and Conditions.

2.12 Cookies and Similar Technologies

The marketing website (myfaithbook.in) uses cookies and similar technologies for essential site functionality and aggregated, non-personalised analytics. We do not use cookies for cross-site behavioural advertising. You can control cookie preferences through your browser settings.

2.13 Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in law or our practices. Material changes will be notified through the Platform or by email at least fifteen (15) days before taking effect. The "last updated" date at the top of this page indicates the most recent revision.

2.14 Contact Us

For any questions about this Privacy Policy, please contact the Data Protection Officer, Mr. Ankit Francis, via the Contact section of this website.