Privacy Policy

Last updated: May 17, 2026

ISHRUTI LLC ("iShruti," "we," "us") respects your privacy. This Privacy Policy explains how we collect, use, disclose, and protect personal data in connection with the iShruti Platform. This policy is designed to comply with the EU General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).

Contact: privacy@ishruti.org

1. What Data We Collect

Account Data

Name, email address, password (hashed), and profile photo
Role (speaker vs. organizer vs. admin)
Speaker-specific: bio, fee range, speaking topics, headshot, video links, credentials
Organizer-specific: company name, event history, billing contact

Behavioral Data

Pages visited, searches conducted, speakers viewed, shortlists saved
Session metadata: IP address, browser type, device type, referral source
Interaction data: button clicks, form completions, time-on-page

Payment Data

Payment method type and last 4 digits (stored by Stripe, not iShruti)
Billing address
Transaction history (amount, date, status, booking ID)

Communication Data

Messages sent through the in-platform messaging system
Support tickets and their content
Email communication history

Cookie and Tracking Data

See our Cookie Policy for details.

2. How We Use Your Data

| Purpose | Legal Basis (GDPR) | |---|---| | Deliver the booking marketplace | Contract performance | | Process payments via Stripe | Contract performance | | Send transactional emails (booking confirmations, receipts) | Contract performance | | Operate the messaging system | Contract performance | | Improve Platform features via analytics | Legitimate interest | | Send marketing emails (The Shruti Brief) | Consent (opt-in only) | | Fraud prevention and security | Legitimate interest | | Comply with legal obligations | Legal obligation |

We do not sell your personal data. We do not use your data to train AI models.

3. Third Parties We Share Data With

| Service | Purpose | Data Shared | |---|---|---| | Supabase | Database and authentication | Account data, booking data | | Stripe | Payment processing | Payment info, billing address | | Cloudinary | Media hosting | Speaker photos and videos | | Resend | Transactional email delivery | Name, email, booking details | | Beehiiv | Newsletter (The Shruti Brief) | Email address (opt-in only) | | Vercel | Platform hosting and edge network | Server logs, IP addresses | | Plausible Analytics | Privacy-first web analytics | Anonymized page views | | Google Analytics (GA4) | Web analytics (consent-gated) | Anonymized behavioral data | | Cal.com | Discovery call scheduling | Name, email, availability |

We require all third-party processors to comply with applicable data protection laws and to process data only as instructed.

4. Data Subject Rights

Depending on your jurisdiction, you have the right to:

Access: Request a copy of all personal data we hold about you
Rectification: Correct inaccurate or incomplete data
Erasure ("right to be forgotten"): Request deletion of your data, subject to legal retention requirements
Portability: Receive your data in a machine-readable format (JSON or CSV)
Objection: Object to processing based on legitimate interest
Restriction: Request that we limit how we process your data
Withdraw consent: Revoke marketing consent at any time

CCPA rights (California residents): You have the right to know, delete, opt-out of sale (we don't sell data), and non-discrimination.

To exercise any right, email privacy@ishruti.org with "Data Request" in the subject line. We will respond within 30 days.

5. Cookies and Tracking

We use cookies for essential platform functions and, with your consent, for analytics and marketing. You can manage your preferences through our Cookie Consent banner. You may also clear cookies via your browser settings; note that essential cookies are required for the Platform to function.

6. Children's Privacy

The Platform is not directed at individuals under 18 years of age. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact privacy@ishruti.org and we will delete it promptly.

7. Data Retention

| Data Type | Retention Period | |---|---| | Account data | Duration of account + 2 years after deletion | | Booking data | 7 years (for tax and legal compliance) | | Payment data | 7 years (Stripe retains payment records) | | Communications | 3 years after last interaction | | Analytics data | 26 months (Plausible) / 14 months (GA4) | | Marketing preferences | Until withdrawn |

8. Data Security

We implement industry-standard safeguards including:

TLS 1.3 encryption in transit
AES-256 encryption at rest (Supabase)
Row-Level Security (RLS) on all database tables
Role-based access controls
Regular security audits

9. Breach Notification

In the event of a data breach affecting your rights, we will notify affected users and relevant supervisory authorities within 72 hours of discovery, as required by GDPR Article 33.

10. International Data Transfers

iShruti is based in the United States. If you are located in the EU/EEA or UK, your data may be transferred to the US. We rely on Standard Contractual Clauses (SCCs) approved by the European Commission for such transfers.

11. Changes to This Policy

We will notify you by email of material changes to this policy at least 14 days in advance. The updated policy will be posted on this page with a new "Last updated" date.

12. Contact

Data Controller: ISHRUTI LLC
Email: privacy@ishruti.org
Address: Indianapolis, IN 46204

For EU/UK residents, you also have the right to lodge a complaint with your local Data Protection Authority.