Privacy Policy

Version 2026-09-05. Effective 5 September 2026.

This explains what Riyasat collects, why, how long it is kept, and what you can ask us to do about it. It is written to be read, not to be survived.

1. Who is responsible

Madhusudan Singh, a sole proprietor based in Rajasthan, India, is the data fiduciary under the Digital Personal Data Protection Act, 2023 and the controller for the Service. Contact for any privacy question or request: madhusudansinghlearning@gmail.com.

Grievance Officer. Under the Consumer Protection (E-Commerce) Rules, 2020 and the Digital Personal Data Protection Act, 2023, complaints may be sent to the same address, marked for the Grievance Officer. We acknowledge within 48 hours and aim to resolve within 30 days.

2. What we collect, and why

If you only look at the board

A random browser id, generated in your browser and kept in its local storage. It counts you once toward “online” and once, ever, toward “visitors”. It is not linked to your name, and clearing site data resets it.
A one-way hash of your network address, used to rate-limit abuse and to count a click only once an hour. We do not store raw IP addresses.
Ordinary server logs from our hosting provider, kept briefly for security and debugging.

We set no advertising cookies and run no cross-site tracking. We do not sell personal data, and we do not share it for targeted advertising.

If you claim a place

The web address you enter, and the handle, name, and description shown on the board.
Your site’s public information — its title, description, and icon — fetched from the address you gave and stored by us so we can display it without linking to your servers.
Your agreement to the Terms: the version, the time, a hash of your network address, and your browser’s user-agent string. This exists to answer a payment dispute and for no other purpose.
Your payment record: the amount, currency, provider reference, and time. We never see or store your full card number.
Click counts on your outbound link, in aggregate. We keep a per-hour de-duplication hash, not a profile of who clicked.

What the payment provider collects

Checkout is handled by Dodo Payments as merchant of record. They collect your name, email, billing country and postcode, and payment details directly, under their own privacy notice. We receive a payment reference, the amount, and the settlement figures.

3. Why we are allowed to hold it

To perform our contract with you — listing you, taking payment, showing your place.
Legitimate interests — keeping the board working, preventing abuse and fraud, defending payment disputes, and counting visitors in aggregate.
Legal obligation — tax and accounting records.
Consent — where you tick a box, which you may withdraw.

4. How long we keep it

Listings, stakes, and payment records — for as long as the board exists, and afterwards where tax or legal rules require it. The board is a public ranking with a history; a claim is a matter of public record.
Consent records — at least as long as a payment can be disputed, and then as evidence of what was agreed.
Presence and visitor identifiers — the online window is five minutes; the visitor count keeps a hash so you are not counted twice.
Click de-duplication hashes — about an hour.
Rate-limit counters — minutes.

5. Who else sees it

Dodo Payments — payments, tax, and dispute handling.
Our hosting and database providers — to run the Service.
An analytics provider, where used, on a cookieless, aggregate basis.
Authorities, where the law requires it.

Some of these operate outside India. Where that happens we rely on the provider’s own safeguards and standard contractual protections.

6. What is public

A listing is public by design: the handle, name, description, logo, the places held, the amounts staked, and the time of each claim are shown to everyone and may be archived, quoted, or indexed by search engines. Do not put anything in your name or description that you would not want published permanently.

7. Your rights

Depending on where you live you may ask us to give you a copy of your data, correct it, delete it, restrict or object to a use, or withdraw consent. Write to madhusudansinghlearning@gmail.com and we will respond within 30 days.

Two honest limits. Deleting your data does not undo a payment or return a stake — the financial record must survive for tax and dispute reasons, and we may keep a minimal record that a claim was made. And a listing that has been public may already exist in third-party caches and archives that we do not control.

You may complain to your data protection authority, or in India to the Data Protection Board under the DPDP Act, 2023.

8. Children

The Service is not for anyone under 18. We do not knowingly collect data from children. If you believe we have, write to us and we will delete it.

9. Security

Payments run through a PCI-compliant provider; we never hold card numbers. Network addresses are stored only as one-way hashes. Access to the database is restricted. No system is perfectly secure, and we do not claim otherwise. If a breach affects you we will notify you and the relevant authority as the law requires.

10. Changes

We may update this policy. The version and date at the top change when we do. Material changes will be announced on the board.

Privacy questions: madhusudansinghlearning@gmail.com.