GiveSetu Privacy Policy

Last Updated: November 14, 2026

This policy applies to the GiveSetu / NGO OS platform — its donation pages, donor portal, APIs and the “NGO OS Embed” WordPress plugin. Our general website privacy policy at govindaniit.com/privacy-policy governs visits to this website and does not replace this one.

1. Who We Are

GiveSetu is a product of Govindani Infotech Private Limited (CIN U74909MP2023PTC069020), registered office MIG 82, C-Sector, BDA Colony Shahpura, Shivaji Nagar, Huzur, Bhopal 462016; principal place of business Row House 8/B, Sunita Niwas, 1st floor, Anant Jyoti Society, Sahakar Nagar No. 1, Parvati, Pune 411009. “We”, “us” and “our” mean that company.

2. The Two Roles We Play

Read this section first; everything else follows from it.

• As data fiduciary — for the nonprofit organisations that hold GiveSetu accounts, and for the people at those organisations who sign in. We decide how that data is handled.
• As data processor — for donor data. When a donor gives to a nonprofit through GiveSetu, that nonprofit is the data fiduciary for the donor. We process donor data only on the nonprofit’s instructions and only to run the service. Donors wanting their data corrected or erased should approach the nonprofit they donated to; we will help that nonprofit act on the request.

3. What We Collect

From nonprofit account holders

Organisation name, registration and tax identifiers (including 80G and FCRA details where provided), contact names, email addresses, phone numbers, billing details, the content you publish (cases, campaigns, images, forms), and sign-in and audit records.

From donors, on behalf of the nonprofit

Name, email address, phone number, postal address where given, donation amount and currency, PAN where required for an 80G receipt, donation and receipt numbers, payment status and the payment reference returned by our payment gateway, subscription and membership records, and any message or dedication the donor adds.

Automatically

IP address, browser and device information, pages viewed and timestamps — for security, fraud prevention and service reliability.

We never collect or store card numbers, CVVs, UPI PINs, net-banking credentials or any other payment instrument credential. Those go directly to our payment gateway and never reach our systems.

4. The WordPress Plugin Specifically

The “NGO OS Embed” plugin connects a nonprofit’s WordPress site to its GiveSetu account.

• Each embed is an iframe pointing at a page on that organisation’s own GiveSetu donate domain. The visitor’s browser loads it directly, so the usual request data — IP address, user agent, referrer — reaches us when a page containing an embed is viewed.
• The plugin sends us the site’s address, its integration client identifier, a signed credential, and the identifier of the item being embedded.
• No donor name or contact detail is written into the WordPress database. The plugin mirrors only event identifiers, donation and receipt numbers, amounts and timestamps, so the site owner can see what happened. That table is deleted when the plugin is uninstalled.
• Where the donor portal is enabled, sign-in requests are forwarded from the site’s own server to us. The donor’s tokens stay on that server and the browser receives only a session cookie.

5. Why We Process It

To provide the service and make donations work; to generate receipts and 80G certificates; to send transactional messages about a donation, receipt or membership; to take payment; to meet legal and tax obligations; to keep the service secure and prevent fraud; to support our customers; and to improve the product using aggregated, non-identifying information.

We do not sell personal data. We do not use donor data for our own marketing, and we do not share one nonprofit’s donor data with another.

6. Who Else Processes It

Each is bound to use the data only to provide its service to us. Payment data handled by Razorpay is governed by its own policy at razorpay.com/privacy.

7. Where Data Is Stored

Platform data is stored on servers located in India. Some processors above may process data outside India; where they do, we rely on their contractual commitments to protect it.

8. How Long We Keep It

Donation, receipt and tax records for eight years, as Indian tax law requires. Nonprofit account data for the life of the account and twelve months after it closes. Security and access logs for twelve months. A nonprofit may ask us to delete donor records earlier, except where we must keep them for tax or legal reasons.

9. Your Rights

If you hold a GiveSetu account, you may ask us to give you a copy of your data, correct it, erase it, or nominate someone to act for you if you cannot. Write to the address in section 12 and we will respond within thirty days.

If you are a donor, contact the nonprofit you donated to. They decide what happens to their donor records; we act on their instructions.

10. Security

Credentials and secrets are encrypted at rest. All traffic runs over TLS. Webhook deliveries are signed and verified. Access to production data is restricted to staff who need it and is logged. No system is perfectly secure, but we will notify affected customers and the relevant authority of a personal data breach as the law requires.

11. Children

GiveSetu is not directed at children, and we do not knowingly collect their personal data. If you believe a child’s data has reached us, contact us and we will delete it.

12. Contact and Grievances

Grievance Officer: Sujeet Govindani, Founder & CEO
Email: support@govindaniit.org
Phone: +91 92019 58274
Post: Govindani Infotech Private Limited, Row House 8/B, Sunita Niwas, 1st floor, Anant Jyoti Society, Sahakar Nagar No. 1, Parvati, Pune 411009, India

13. Changes

We will post any change here and update the date at the top. Material changes will be notified to account holders by email at least fourteen days before they take effect.