This policy explains what data IT-Stuff Library (pustakalaya.it-stuff.in) handles and how. It is written to align with India's Digital Personal Data Protection Act, 2023 (DPDP Act).
Each Library that signs up decides what to record about its members and is the Data Fiduciary for that data. IT-Stuff stores and processes it on the Library's behalf, as a Data Processor.
| Data | Who enters it | Why |
|---|---|---|
| Library name, address, phone, logo, owner email | The Library | Account, branding, billing |
| Librarian/volunteer names, emails, hashed passwords | The Library owner | Login |
| Member details — name, parent/guardian, school, class, village, phone, date of birth | The Library | Lending and reminders |
| Catalogue, lending, fee and donor records | The Library | Running the library |
| Payment order IDs and amounts (no card/UPI details) | Cashfree | Subscription billing |
| IP address of failed logins | Automatic | Protection against password guessing (kept 1 day) |
Many members are children. The DPDP Act requires verifiable consent of a parent or lawful guardian before a child's personal data is processed. The Library is responsible for obtaining that consent (for example on the membership form signed by the parent) and should record only what it needs. We never use members' data for advertising, profiling or tracking, and never sell it.
Data is stored on servers in India, served over HTTPS. Passwords are stored as one-way hashes. Login attempts are rate-limited.
Data is kept while the Library's account exists. A Library can export everything at any time and may ask us to delete its account; we delete its data within 30 days of the request, except billing records we must keep by law.
Members (or their parents) should contact their Library to see, correct or remove their details. Libraries can do this directly in the admin panel. For anything else write to billing@it-stuff.in.