myChap legal

Privacy Policy

Effective 16 September 2026 · Version 2.0
Covers the myChap web app, the myChap member and leader mobile apps, and the services behind them.

1. Who we are and what this covers

myChap is a product of ThetaZero Private Limited, a company incorporated in India, registered office No. 10, Manikandan Nagar, Hasthinapuram, Chennai, Tamil Nadu 600064, India, CIN U74999TN2022PTC157268. In this policy "we", "us" and "ThetaZero" mean that company; "myChap" means the product.

This policy is written primarily against India's Digital Personal Data Protection Act, 2023 (the DPDP Act). Section 13 sets out the additional rights that apply if the EU or UK GDPR covers you.

It does not cover what a chapter does with your data outside myChap, or the practices of the providers listed on our sub-processor page — each has its own policy.

2. Who is responsible for your data

Under the DPDP Act we are a Data Fiduciary for the first layer and a Data Processor for the second. The GDPR calls these controller and processor.

In practice: send any request to us if that is easier. Where it concerns the chapter's layer, we pass it to the chapter and support them in answering, as described in section 12.

3. What we collect

Much of the following is optional and chapter-dependent. A chapter decides which fields it asks for, and you decide what you fill in. A chapter running a job board will ask for a CV; a chapter that does not run one never collects one. The list below is everything the platform is capable of holding, not a list of what is held about you.

Account and identity — always

• Email address, first name and last name.
• One-time sign-in codes we send you, and — for chapter portal access — a password, stored only as a salted hash and never in readable form.

Profile — optional, if you fill it in

• Profile photo, short bio, social links, skills and interests.
• Mobile number and an optional alternate number.
• Gender and date of birth.
• Postal address: street, city, state, country and PIN code.
• Occupation and employer.
• An emergency contact number, where your chapter asks for one.

Membership and activity

• Which chapters you belong to, your roles and portfolios, and the membership status your chapter records — including whether your membership is live or expired.
• Program registrations, attendance and no-show status, cancellations and refund outcomes.
• Volunteer hours logged, recognition awarded, and PDUs recorded.
• Content you create in a workspace: announcements, minutes, action items, comments, feedback, budget and expenditure entries.

Payments

• We do not store card numbers, CVVs, UPI PINs or netbanking credentials. Those go directly to our payment gateway and never reach our servers.
• We store payment metadata: amount, currency, status, timestamps, and the gateway's order, payment and refund identifiers.
• For a chapter that receives settlements, we store its settlement destination: account holder name, bank account number, IFSC code, bank and branch name, and where supplied a UPI ID and PAN.
• When a chapter pays a vendor or reimburses a volunteer, its administrators record that payee's details in the workspace. The chapter decides whose details it enters and is the Data Fiduciary for them.

Files you upload

• Profile photos, program gallery images, program documents and Knowledge Library files.
• If your chapter runs a job board and you use it: your CV, plus the profile you build there — name, headline, summary, contact details, location, skills, experience, education and links.

Device, session and technical data

• For each signed-in session: device type and name, operating system or app version, browser user agent, and IP address.
• If you enable push notifications: a device push token, platform, device identifier and last-seen timestamp.
• Server logs generated when your app calls our services, used to diagnose faults.

What we do not collect

• We do not collect your device location. The coordinates shown against a program are venue coordinates typed in by the organiser; the apps do not read your device's location.
• We do not read your contacts, your photo library beyond what you deliberately upload, your calendar, your microphone or your camera except when you actively use a feature that needs it.
• We do not use advertising identifiers. There is no advertising in myChap.

4. Why we use it, and on what basis

ThetaZero does not use your personal data for advertising, and does not sell it or share it with data brokers. We do not make automated decisions about you that produce legal effects. myChap embeds no third-party analytics, advertising, session-replay or A/B-testing tools.

Your chapter may analyse its own membership and engagement data to run the chapter — for example, reports on lapsed or inactive members. That analysis belongs to the chapter, under the chapter's own basis, and boards with the Advanced Analytics module can export reports containing member-level personal data.

The AI Assistant answers questions only from documents your chapter has uploaded, inside your chapter. Its content is not used to train general-purpose AI models, ours or anyone else's.

5. Who inside your chapter can see your data

This is the most consequential thing for a member to understand, so we state it plainly.

The owner and administrators of a chapter you belong to can see the data that chapter holds about you: your profile and contact details as stored in its workspace, your registrations and attendance, payment and refund records for its programs, volunteer hours, content you post there, and — if it runs a job board — the profile and CV you submit.

• Role holders see what their role allows. A finance role sees and approves payments; a program owner sees that program's registrants; a portfolio holder sees the members and records in their portfolio.
• Other chapters cannot see you. Workspaces are isolated. A member or administrator of one chapter has no access to another's data.
• Guest access. A chapter can open parts of its workspace to people who are not members. What becomes visible depends on that chapter's configuration.
• Our staff. A small number of our people can reach chapter data through an internal console, for support, billing and settlement operations. Access is limited to those who need it, and is logged.

6. Sharing and disclosure

We share personal data only:

• with your chapter, as described in section 5;
• with the providers on our sub-processor page, so myChap can function;
• with the audience your chapter's settings expose it to, when you publish something yourself;
• where required by law, a court order or a lawful authority, or to establish or defend legal claims, or to protect the safety of people using myChap;
• with an acquirer in a merger, acquisition or sale of assets — we will give notice before your data becomes subject to a different policy.

Unless we are legally prevented, we will tell you and your chapter before disclosing data to an authority.

7. Sub-processors

The third parties that process personal data on our behalf are listed, with what each one receives and where it operates, on our sub-processor page. That page carries its own effective date so it can be kept current.

We will give at least 30 days' notice before adding a new sub-processor that handles personal data, so chapters have time to object.

8. Where your data is kept

Our primary database and file storage are hosted in India. Some providers operate globally, so limited technical data — a push token, an IP address — may be processed outside India. The hosting region for each provider is shown on the sub-processor page.

Under the DPDP Act, personal data may be transferred outside India except to territories the Central Government restricts; we monitor that list and comply with it. Where data covered by the GDPR leaves the EEA or the UK, we rely on the receiving provider's Standard Contractual Clauses or another approved mechanism.

9. How long we keep it

10. How we protect your data — and what we do not claim

What we do:

• Traffic between your device and our servers runs over HTTPS, and data is encrypted at rest.
• Every request is authenticated and checked against your permissions before it reaches any data.
• Passwords are stored only as salted hashes. Neither we nor your chapter can read them.
• Uploaded files are held in private storage and served through short-lived links that expire. They are not readable without an authorised, current session.
• Access inside a workspace is governed by roles and permissions, and workspaces are isolated from one another.
• High-risk actions — financial approvals, data exports — require an additional verification step.
• Administrative actions are recorded in an audit log the chapter's board can inspect.
• Payment credentials never touch our servers.

What we do not claim:

• We hold no third-party security certification — no SOC 2, no ISO 27001 — and we do not claim one.
• No system is completely secure. We cannot guarantee that a determined attacker will never succeed.

11. Cookies and similar technologies

myChap sets no cookies. The web app keeps your sign-in token and your selected chapter in your browser's local storage. Nothing is stored for advertising, cross-site tracking or measurement.

• Because we set no cookies and run no analytics, there is no cookie banner and no preferences to manage.
• Clearing your browser's site data for myChap removes the stored token and signs you out.
• The mobile apps store your session on the device, plus a push token if you allow notifications. Revoking notification permission stops the token being used.

12. Your rights under the DPDP Act 2023

As a Data Principal in India you have the right to:

• obtain a summary of the personal data we hold about you and how it is processed;
• have inaccurate or incomplete data corrected, completed or updated;
• have your personal data erased, where it is no longer needed for the purpose it was collected for and we are not required by law to keep it;
• have a grievance heard and answered by the officer named in section 17;
• nominate another person to exercise these rights on your behalf if you die or become incapacitated.

Erasure is self-service. Go to Profile → Settings → Delete account, or follow the steps on our account deletion page. We email you a confirmation code; once you enter it, deletion happens immediately and cannot be undone.

If you belong to more than one chapter, myChap lists them after you verify your identity and you choose which ones to delete your data from. Selecting every chapter closes your account; selecting some leaves your account open and your other chapters untouched. Either way, your chapter membership itself is unaffected, because myChap does not hold it. We keep a record of your deletion so that a later membership import by your chapter cannot recreate your profile.

What survives, and why: your chapter keeps its financial and attendance records — payments, invoices, ledger entries and program history — because it is legally required to. Those records show Deleted User instead of your name, except for issued tax invoices as explained in section 9.

Other requests are handled manually. Email privacy@mychap.net or the Grievance Officer in section 17. We acknowledge within 48 hours and respond within 30 days. Where a request concerns data your chapter controls, we pass it to the chapter and help it respond.

We may need to verify your identity before acting, and we may decline a request the law requires or permits us to decline — we will tell you why. The Act also places duties on you, including not raising false or frivolous complaints and not impersonating another person. If we cannot resolve your grievance, you may complain to the Data Protection Board of India.

13. Additional rights in the EEA and the UK (GDPR)

This section applies only where the EU or UK GDPR covers your data. It adds to section 12 rather than replacing it. You have the right to access and receive a copy of your data; to rectification; to erasure where a ground in Article 17 applies; to restriction while a dispute about accuracy or lawfulness is resolved; to portability; to object to processing based on legitimate interests; and to withdraw consent at any time.

We respond within one month, extendable by two further months for complex requests — we will tell you if that happens. You may complain to your local supervisory authority, or to the Information Commissioner's Office in the UK.

We have not appointed an Article 27 representative. myChap is operated from India. If your chapter is established in the EEA or the UK, it is likely the controller for its member data and its own privacy notice applies alongside this one.

14. Children's data

myChap is not intended for anyone under 18, and we do not knowingly collect personal data from children.

The DPDP Act requires verifiable parental consent before a child's data is processed, and prohibits tracking, behavioural monitoring and targeted advertising directed at children. myChap has no mechanism for obtaining verifiable parental consent, so chapters must not create member records for people under 18 or upload their personal data to the platform.

If you believe a child's data has been given to us, email privacy@mychap.net and we will delete it.

15. If there is a breach

If a personal data breach occurs, we will notify the Data Protection Board of India and the affected Data Principals in the form and manner the DPDP Act requires. Where the GDPR applies, we will notify the relevant supervisory authority within 72 hours of becoming aware where feasible, and affected individuals where the risk to them is high. We will also inform the affected chapter, since it is the Data Fiduciary for its member data and has its own notification duties.

16. Changes to this policy

We update this policy when myChap changes. Where a change materially affects how your data is handled, we give notice by email and in-app at least 30 days before it takes effect, and the previous version stays available in our archive. The effective date at the top of this page is the authoritative version marker.

17. Contact and grievance redressal