Privacy Policy

Last Updated: May 28, 2026

1. Introduction

The Student Activities Portal (“Portal”) is operated by the WebOps & Multimedia Department on behalf of the Student Executive Committee, IIT Madras BS Degree Program (“we”, “us”, or “our”). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our web portal, API services, and related services (collectively, “Services”).

We are committed to protecting your privacy and being transparent about our data practices. Please read this policy carefully to understand our practices regarding your personal data. By using our Services, you agree to the collection and use of information in accordance with this policy.

2. We Do Not Sell Your Data

We do not sell, rent, trade, or otherwise transfer your personal information to third parties for marketing or commercial purposes. Period.

Your data is not used to:

Train artificial intelligence or machine learning models
Create advertising profiles
Be sold to data brokers
Be shared with third parties for their marketing purposes

3. Information We Collect

3.1 Account Information

When you create an account, we collect:

Email address (restricted to authorized institutional domains)
Display name and profile picture through institutional authentication
Roll number, house affiliation, region, and program details as synced from official records

3.2 User-Generated Content

When you use our Services, you may submit:

Event proposals and budget requests
Comments, votes, and feedback
Messages or queries through contact and feedback forms

3.3 Usage and Analytics Data

We automatically collect certain information when you use our Services, including:

IP address
Browser type and version
Device information
Pages visited and features used
Time and date of access
Error logs and performance data

4. How We Use Your Information

All collected data is used exclusively for:

Authentication and Access Control: Verifying your identity and determining your role within the Portal.
Service Delivery: Displaying your profile, affiliations, event participation, and relevant analytics.
Community Features: Enabling comments, voting, event proposals, and collaborative features.
Diagnostics: Identifying and fixing bugs, errors, and technical issues.
Performance: Optimizing application speed, responsiveness, and reliability.
Security: Detecting and preventing fraud, abuse, unauthorized access, or malicious activity.
Communication: Sending important Portal updates and responding to support requests.

5. Data Retention

We retain your data for as long as necessary to provide our Services and fulfill the purposes outlined in this policy:

Account data: Retained while your enrollment is active and for a reasonable period thereafter. Upon account deletion, we will delete or anonymize your personal data within 30 days, subject to institutional record-keeping obligations.
User-generated content: Retained for the duration it remains relevant to the student community. Archived content may be removed after the academic year.
Session data: Session cookies are deleted when you sign out or when the browser session ends.
Server logs and error reports: Retained for up to 90 days for security and diagnostic purposes.
Analytics data: Retained for up to 24 months for performance and usage analysis.

6. Data Sharing

We only share your information in the following limited circumstances:

Within the Community: Certain profile information (name, house affiliation, society memberships, contributions) is visible to other authenticated students as part of the Portal’s community features. You can review what is visible from your profile page.
Service Providers: With trusted third-party service providers who assist in operating our Services (e.g., hosting, authentication, data storage), under strict confidentiality agreements.
Student Executive Committee: Aggregated and individual data may be shared with authorized members of the Student Executive Committee for official student governance purposes.
Legal Requirements: When required by law, court order, or official request from IIT Madras administration.
Safety: To protect the rights, property, or safety of our users, the IIT Madras community, or the Portal.
Business Transfers: In connection with a transfer of Portal ownership or operations, with prior notice.
With Your Consent: When you explicitly agree to share your information.

7. Data Security

We implement appropriate technical and organizational security measures to protect your personal data, including:

Encryption of data in transit (TLS/SSL) and encryption of sensitive data at rest
Secure authentication with domain-restricted access (authorized institutional emails only)
HTTP-only session cookies to prevent client-side script access
CSRF protection on all state-changing requests
Comprehensive HTTP security headers
Regular security updates and dependency audits

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your data, we cannot guarantee absolute security.

8. Your Rights

As a user of the Portal, you have the following rights regarding your personal data:

Access: Request a copy of the personal data we hold about you.
Correction: Request correction of inaccurate profile or affiliation information.
Deletion: Request deletion of your personal data, subject to institutional record-keeping obligations.
Visibility Control: Review and understand what information about you is visible to other students through the Portal.
Objection: Object to certain processing of your data.
Withdraw Consent: Stop using our Services or sign out at any time.

To exercise these rights, please contact the WebOps & Multimedia Department through official communication channels. We will respond to your request within 30 days.

9. Cookies and Tracking

We use cookies and similar technologies to:

Maintain your session and authentication
Remember your preferences
Ensure security and prevent unauthorized access
Analyze usage patterns to improve our Services

We do not use third-party tracking cookies. You can control cookies through your browser settings. Note that disabling certain cookies may affect the functionality of our Services.

10. Marketing Communications

We only send promotional communications to users who have explicitly opted in. You can opt out at any time by:

Updating your preferences in account settings
Contacting us directly

Note that even if you opt out of marketing communications, we may still send you important service-related notifications.

11. International Data Transfers

Your data may be transferred to and processed in countries other than your country of residence, as our service providers may operate data centers globally. We ensure appropriate safeguards are in place for such transfers. By using our Services, you consent to such transfers.

12. Children's Privacy

Our Services are intended exclusively for enrolled students of the IIT Madras BS Degree Program, who are typically 18 years of age or older. We do not knowingly collect personal information from children under 13. If we learn we have collected personal information from a child under 13, we will delete that information promptly.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

Updating the “Last Updated” date at the top of this page
Posting announcements on official communication channels
Displaying in-app notifications for significant changes

Your continued use of our Services after changes become effective constitutes acceptance of the updated policy.

14. Contact Information

If you have any questions about this Privacy Policy or our data practices, please contact:

WebOps & Multimedia Department, Student Executive Committee, IIT Madras BS Degree Program
Website: iitmbs.org

By using the Student Activities Portal, you acknowledge that you have read and understood this Privacy Policy and agree to our Terms of Service.