OASIS — Privacy Notice & Data Protection Policy
Drafted and enforced in accordance with the Digital Personal Data Protection Act, 2023 (DPDP Act) of India, the IT Act 2000, and SPDI Rules 2011.
We collect only fields required to verify identity, enable role discovery, host events, and secure the portal.
Phone numbers and email addresses are private by default and never disclosed without mutual connection consent.
We never sell, rent, monetize, or license member data to third-party data brokers or advertisers.
§ 1Data Fiduciary Identity & Statutory Compliance
OASIS, headquartered in Bhubaneswar, Odisha, India, operates the OASIS platform and acts as the Data Fiduciary in respect of all personal data collected and processed through the Platform under the Digital Personal Data Protection Act, 2023 (DPDP Act).
Personal data is collected strictly on the lawful basis of your free, specific, informed, unconditional, and unambiguous Consent (immutably recorded in ConsentRecord) and for legitimate community safety and administration uses under Section 4 and Section 7 of the DPDP Act.
§ 2Personal Data Inventory
Fields: Full name, email address (unique ID), Argon2id salted password hash or Google OAuth sub, 18+ age confirmation, time zone.
Visibility: Full name & role visible to approved members. Email is Private by default.
Fields: Phone number (verified via SMS OTP), City and State, profile photo (≤2 MB), bio (≤500 chars), areas of interest, LinkedIn/website.
Visibility: Phone is Private by default. City, bio, interests, and photo visible to approved members (customizable).
Fields: Idea/focus area (≤500 chars), preferred sectors, skills & experience (≤1,000 chars), current stage (Exploring, Validation, Planning, Pre-MVP), guidance needed.
Visibility: Visible to approved members according to your field privacy settings.
Fields: Startup name, role in company, industry sector, stage (Ideation, MVP, Launched, Revenue, Scaling), product summary (≤1,000 chars), website URL, location.
Visibility: Visible to approved members. Multiple co-founders link to one shared Startup record.
Fields: Current organization, years of experience (1-3, 3-5, 5-10, 10-15, 15+), expertise tags, mentoring topics, availability status, LinkedIn URL, verification evidence (PDF/JPEG/PNG ≤10 MB).
Visibility: Profile fields visible to approved members. Verification evidence is Strictly Private to reviewing admins via signed URLs.
Fields: Task titles (≤200 chars), notes (≤2,000 chars), deadlines, priorities, reminders.
Visibility: Strictly Private to the Member. Zero visibility to other members or administrators.
§ 3Purposes of Processing
We process your personal data exclusively for:
- Membership Vetting: Verifying email and phone OTP, evaluating application details against the OASIS 6-point Rubric, and matching pre-approved WhatsApp community records.
- Directory & Expertise Discovery: Enabling approved members to search peers, founders, and mentors across sectors and cities in Odisha.
- Consent-Based Connections: Revealing contact details only when both parties mutually accept a mentor guidance request.
- Event Registrations & Automated Waitlists: Processing RSVPs, waitlist promotions, and sharing confidential meeting links to confirmed attendees.
- Security & Abuse Prevention: Rate limiting, brute-force defense, ClamAV antivirus scanning, and 3-year compliance audit logging.
§ 4Your Rights as a Data Principal (DPDP Act 2023)
Inspect all personal data held about you at any time via Settings and your profile view.
Download a complete, machine-readable JSON archive of your account in Settings → Data & Account within 48 hours.
Update profile fields directly. Request permanent account deletion which purges your personal data within 30 days.
Submit formal privacy inquiries or appeals to our Designated Grievance Officer at [email protected].
§ 5Data Retention Schedule
Active Accounts: Retained for the duration of active community membership.
Inactive Accounts: Warning sent after 12 months; deactivated at 15 months; subject to purge upon request.
Deleted Accounts: Personal data and uploaded files are purged within 30 days. Community posts display “Former Member”.
Rejected Applications: Unapproved application drafts and evidence attachments are permanently purged after 90 days.
Audit Logs: Security, admin actions, and consent logs are retained for 3 years in compliance with Indian statutory requirements.