1. Introduction
This Privacy Policy describes how Celestiq Insights OPC Pvt Ltd ("the Company", "we", "us", or "our"), the operator of VoteMyThought ("the Platform", accessible at votemythought.com), collects, uses, discloses, and protects your personal data.
This Privacy Policy is published in accordance with the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021.
By using the Platform and providing your personal data, you consent to the practices described in this Privacy Policy. If you do not agree with this policy, you must not use the Platform.
2. Data We Collect
2.1 Personal Data Collected at Registration
| Data Type | Purpose | Legal Basis |
|---|---|---|
| Email address | Account authentication, password recovery, communication | Consent (Section 6, DPDP Act) |
| Username | Public display name on the Platform | Consent (Section 6, DPDP Act) |
| Password (hashed) | Account authentication | Consent (Section 6, DPDP Act) |
2.2 Data Collected Through Platform Use
| Data Type | Purpose | Legal Basis |
|---|---|---|
| Vote records (which poll option you selected) | Display vote results, prevent duplicate voting | Consent (Section 6, DPDP Act) — necessary for core service functionality |
| IP address | Fraud prevention, abuse detection, rate limiting | Legitimate use (Section 7, DPDP Act) — platform security and integrity |
| Poll content you create | Display and operate user-generated polls | Consent (Section 6, DPDP Act) |
| Locale/language preference | Display content in your preferred language | Legitimate use (Section 7, DPDP Act) |
2.3 Data We Do Not Collect
- We do not collect biometric data;
- We do not collect precise geolocation data;
- We do not collect data from your contacts or device storage;
- We do not use tracking cookies for advertising or marketing purposes;
- We do not sell your personal data to any third party.
3. Lawful Basis for Processing
Under the DPDP Act, 2023, we process your personal data on the following lawful bases:
- Consent (Section 6): You provide free, specific, informed, and unambiguous consent at the time of registration and when creating or voting on polls. You may withdraw your consent at any time.
- Legitimate Use (Section 7): Processing of IP addresses for fraud prevention and platform security, and processing of locale preferences for service delivery, constitutes legitimate use under Section 7 of the DPDP Act.
4. How We Use Your Data
We use your personal data exclusively for the following purposes:
- Account management: Creating and maintaining your account, authenticating your identity, and recovering access;
- Platform functionality: Displaying polls, recording votes, showing real-time results, and preventing duplicate voting;
- Abuse prevention: Detecting fraudulent activity, rate-limiting, and preventing manipulation of poll results;
- Communication: Sending service-related notifications (e.g., password reset links, policy updates);
- Legal compliance: Responding to lawful requests from courts and government agencies, and maintaining records as required by law.
We do not use your personal data for any purpose other than those listed above without obtaining separate consent.
5. Data Retention
| Data Type | Retention Period |
|---|---|
| Account data (email, username, password hash) | Until account deletion by the user or termination by the Platform |
| Vote records | Until the associated poll is deleted or the user's account is deleted |
| IP addresses | 90 days from collection, then automatically deleted |
| Poll content created by users | Until the user deletes the poll or the account is terminated |
| Removed content (pursuant to takedown) | 180 days from date of removal, as required by Rule 3(1)(g) of the IT Rules, 2021 |
| Access logs | 1 year, as required by DPDP Rules, 2025 |
Upon account deletion, we will erase your personal data within a reasonable period, except where retention is required by law.
6. Data Sharing & Disclosure
We do not sell, rent, or trade your personal data. We may share your data in the following limited circumstances:
- Third-party processors: We use Cloudflare, Inc. for hosting, content delivery, and database services. Cloudflare processes data on our behalf under a contractual arrangement and is bound by their own privacy practices. Your data is stored on Cloudflare's infrastructure.
- Legal compliance: We may disclose your data to courts, government agencies, or law enforcement authorities upon receiving a valid order, court directive, or reasoned written intimation from an authorised officer, in accordance with applicable law.
- Grievance resolution: We may share information with complainants as necessary to resolve grievances related to content posted on the Platform.
7. Your Rights as a Data Principal
Under the DPDP Act, 2023, you have the following rights regarding your personal data:
- Right to access: You may request a summary of your personal data processed by us and the processing activities undertaken;
- Right to correction: You may request correction of inaccurate or incomplete personal data;
- Right to erasure: You may request deletion of your personal data, and we shall erase it unless retention is required by law;
- Right to grievance redressal: You have the right to file a complaint with our Grievance Officer and, if unresolved, with the Data Protection Board of India;
- Right to withdraw consent: You may withdraw your consent at any time. Withdrawal shall be as easy as giving consent. Upon withdrawal, we shall cease processing your data (except where retention is legally required) within a reasonable period.
To exercise any of these rights, please contact us at support@votemythought.com.
8. Data Security
We implement reasonable security safeguards to protect your personal data from unauthorised access, alteration, disclosure, or destruction, in accordance with Section 8(5) of the DPDP Act, 2023 and the DPDP Rules, 2025. These safeguards include:
- Password hashing using industry-standard algorithms;
- Encryption of data in transit (TLS/SSL);
- Access controls limiting data access to authorised personnel only;
- Continuous logging and monitoring of data access;
- Retention of access logs for a minimum of one year.
9. Data Breach Notification
In the event of a personal data breach, we shall:
- Notify each affected user without delay, describing the nature and extent of the breach, likely consequences, mitigation measures taken, and steps you can take to protect yourself;
- Provide an initial intimation to the Data Protection Board of India without delay;
- File a detailed report with the Data Protection Board of India within seventy-two (72) hours of becoming aware of the breach, in accordance with Rule 7 of the DPDP Rules, 2025.
Separately, where a data breach constitutes a cyber incident, we shall report it to the Indian Computer Emergency Response Team (CERT-In) within six (6) hours of becoming aware of the incident, in accordance with the IT Act, 2000.
10. Children's Data
The Platform does not impose a minimum age requirement for account registration. However, we do not knowingly collect personal data from children under the age of 13. If we become aware that we have collected personal data from a child under 13 without verifiable parental consent, we shall take prompt steps to delete such data in accordance with the DPDP Act, 2023.
Parents or guardians who believe their child has provided personal data to the Platform may contact us at support@votemythought.com to request deletion.
11. Grievance Officer
In accordance with Section 8(9) and 8(10) of the DPDP Act, 2023, and Rule 3(2) of the IT Rules, 2021, we have designated a Grievance Officer to handle queries and complaints related to your personal data:
Grievance Officer: Celestiq Insights OPC Pvt Ltd
Email: support@votemythought.com
Address: Bangalore, Karnataka, India — 560077
The Grievance Officer shall acknowledge your complaint within 24 hours and resolve it within 15 days from the date of receipt.
If you are not satisfied with the resolution, you may file a complaint with the Data Protection Board of India in accordance with Section 27 of the DPDP Act, 2023.
12. Cookies
We use essential cookies for session management and authentication, and preference cookies for language selection. We do not use analytics, marketing, or tracking cookies. For details, please refer to our Cookie Policy.
13. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated through the Platform or via email. We shall inform users of changes at least once every year, in accordance with Rule 3(1)(f) of the IT Rules, 2021.
14. Contact
For any questions or concerns regarding this Privacy Policy or your personal data, please contact:
Email: support@votemythought.com
Address: Celestiq Insights OPC Pvt Ltd, Bangalore, Karnataka, India — 560077