Privacy Policy
1. Who we are
Kripalu Nidhi is a website and mobile app (Android and iOS) offering videos, audio, lectures, keertans and other spiritual content of Jagadguru Shri Kripalu Ji Maharaj. Kripalu Nidhi is owned and operated by Radha Govind Prachar Samagri (“RGPS”, “we”, “us”), a partnership firm established under the Indian Partnership Act, 1932, with its address at G12, G14, Plot No 4, CSC, HAF, Sector 10, Dwarka, New Delhi 110075, India. [[M-9: optionally add one sentence on the relationship with Jagadguru Kripalu Parishat, which owns the content.]]
The Service includes LeelaBliss (LeelaBliss Web and LeelaBliss WhatsApp), which is part of Kripalu Nidhi and operated by RGPS. You use the same Kripalu Nidhi account for it, and this policy applies to it in the same way. Your data is not shared with a separate company for LeelaBliss.
This policy explains what personal data we collect when you use kripalunidhi.org and the Kripalu Nidhi apps (together, the “Service”), why we collect it, who we share it with, how long we keep it, and the rights you have. For the purposes of India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”), RGPS is the Data Fiduciary for your personal data. This policy forms part of our Terms and Conditions.
2. Summary
- We collect only what we need to run the Service: your account details, what you watch and listen to, your subscriptions and payments, and basic technical data.
- We do not sell your personal data, share it with others for their marketing, show third-party advertisements, use an advertising ID, or collect your precise (GPS) location.
- If you sign in with Google, we use only your name, email address, Google account ID and profile photo, and only to sign you in and set up your profile.
- Card, UPI and bank details are handled only by our payment providers. We never store card numbers, CVVs, UPI PINs or banking passwords.
- You can see, correct or delete your data. See section 10.
3. Personal data we collect
3.1 Data you give us
| Data | When | Why |
|---|---|---|
| Name, email address, mobile number, password (stored only as a one-way bcrypt hash) | Sign-up, sign-in, profile | Create and secure your account; contact you about it |
| Profile photo, preferred language, country and state, year of birth | Sign-up and profile | Personalise your profile and content language; confirm age (section 12) |
| “Preacher associated with” and “Philosophy” profile fields | Profile (optional) | Show you relevant content. These fields may reveal your religious affiliation. They are optional, and you can clear them at any time. |
| Billing name, city, state, phone number and GSTIN | Buying a subscription, when a tax invoice is needed | Issue GST tax invoices as required by law |
| Questions you ask, search text, comments or posts, playlists and favourites | Using those features | Provide the feature and answer your questions |
| Messages to our support team, including account-deletion requests | Contact Us form, the delete-account page or email | Answer and act on your request |
3.2 Data collected automatically
| Data | Why |
|---|---|
| Watch and listen history, playback progress, likes, favourites and playlists | Resume playback, show history and recommendations |
| Search history | Show recent searches and improve results |
| IP address, including on each playback record, and approximate location (city, region, country) derived from it | Security and fraud prevention, regional content availability, service statistics |
| Device type, operating system, app version, browser type, crash logs and diagnostics | Keep the Service working and fix errors |
| Push notification token | Send notifications you have allowed |
| App and website usage events, linked only to your numeric customer ID (never your name or email) | Understand which features are used |
3.3 Device permissions (mobile app)
The app asks before using any of these, and you can turn them off in your device settings:
- Camera: profile photo, scanning the TV sign-in QR code, and live Zoom sessions.
- Microphone: voice search and live Zoom sessions.
- Photos / storage: choosing a profile photo and playing downloaded content.
- Local network / Bluetooth: playing downloads and casting to a TV. Not used to find your location.
- Notifications: new content, live sessions and account messages.
We do not access your contacts, call logs, SMS messages or precise location.
4. Sign in with Google
If you choose “Sign in with Google”, Google shares the following with us, with your permission:
- your name,
- your email address,
- your Google account ID, and
- your profile photo.
How we use it. Only to create your Kripalu Nidhi account, sign you in, and show your name and photo in your profile. We do not request access to your Gmail, Contacts, Drive, Calendar or any other Google service.
How we store it. Your name, email address, Google account ID and photo link are stored in your account record on our servers in India (Amazon Web Services, Mumbai region), encrypted at rest. Google’s sign-in token is used once to confirm your identity and is not stored.
Sharing. We do not sell, rent or share Google user data with anyone. We do not send it to analytics or advertising services, and we do not use it for advertising or to train AI or machine-learning models. It is processed only by our hosting provider (AWS) on our behalf.
Deletion. You can remove this data by deleting your account (section 10.1). You can also remove Kripalu Nidhi’s access in your Google Account at myaccount.google.com/permissions. If you then ask us to delete your account, we delete your Google data with it.
Limited Use. Kripalu Nidhi’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
4.1 Other sign-in options
You can also sign in with email and password, with your mobile number and a one-time password (OTP), with Sign in with Apple (iOS), or with Facebook (website only). For Apple and Facebook we receive only your name, email address (Apple may give a private relay address) and account ID, and we use them only to sign you in.
5. How we use your data
- To provide the Service: accounts, streaming, downloads, playlists, live sessions and notifications.
- To process subscriptions and payments, and issue invoices.
- To answer your questions and support requests.
- To recommend content based on what you watch, listen to and search for.
- To keep the Service secure and prevent fraud and misuse.
- To understand overall usage and improve the Service.
- To meet legal, tax and accounting obligations.
We process your data on the basis of the consent you give when you create an account, and for legitimate uses the law allows, such as meeting legal obligations. We do not use your data for any purpose not listed here without asking you first.
6. Payments
Payments are handled by Razorpay (one-time and recurring), PayPal, Google Play Billing and Apple in-app purchase, and also through offline/counter payments and coupon or prepaid codes. Your card, UPI and bank details go directly to these providers and are handled under their own privacy policies. We never receive or store card numbers, CVVs, UPI PINs or banking passwords.
We keep your plan, amount, currency, date, payment status, payment method type (for example “card” or “UPI”), transaction and order IDs, coupon or prepaid codes and renewal status. For recurring Razorpay payments we also keep a token reference issued by Razorpay, which is not your card details. Payment providers may use their own fraud-prevention tools.
7. Who we share data with
We share personal data only with service providers that process it on our behalf, under contract and only for the purposes below:
| Provider | Purpose | Data involved |
|---|---|---|
| Amazon Web Services (India) | Hosting, database, storage, content delivery | All data described in this policy |
| Google Firebase (Analytics, Crashlytics, Cloud Messaging) and Google Analytics | Usage statistics, crash reports, push notifications | Customer ID, device and usage data, crash logs (no name or email) |
| Meta (Facebook SDK, website only) | Facebook sign-in and sharing to Facebook | Device and browser data the SDK reads when the website loads; name, email and Facebook ID if you sign in with Facebook |
| Google, Apple | Sign-in, app-store purchases | As described in sections 4 and 6 |
| Razorpay, PayPal, Google Play, Apple App Store | Payments and subscriptions | Payment and subscription details |
| OpenAI, Google Gemini, Anthropic, Pinecone, Cohere | Search and answering questions | Only the text of your search or question. No name, email or account details are sent. |
| Mailgun | Account and service emails | Email address, name, message content |
| MSG91 | One-time passwords (OTP) by SMS | Mobile number, the OTP message |
| AiSensy, delivered through WhatsApp (Meta) | WhatsApp messages about your account, subscription and service updates | Mobile number, name, message content |
| Zoom | Live sessions | Whatever you share when joining a session, under Zoom’s privacy policy |
| DoveRunner (PallyCon) | Protecting content (DRM) | Device and licence data |
| Vimeo, YouTube, Airtime.pro | Video and radio streaming | Device and browser data needed to play the stream, under their own policies |
We may also disclose data when required by law, court order or a government authority, or to protect the rights, safety and property of our users or the public.
We do not sell personal data, share it with anyone for their own marketing, or show third-party advertisements.
8. Where your data is stored
Your data is stored in India (AWS Mumbai region). Some of the providers in section 7 (for example Google, Meta, OpenAI and Zoom) may process data outside India. Where they do, we rely on their contractual safeguards, as the DPDP Act allows.
9. How long we keep data
| Data | Kept for |
|---|---|
| Account and profile data | While your account is active; deleted or anonymised within 30 days of a verified deletion request |
| One-time passwords (OTP) | Valid for 10 minutes and usable once; deleted within 24 hours |
| Questions asked in the Q&A feature | 12 months |
| Support requests | 2 years after the request is closed |
| Payment, invoice and transaction records (including GST invoice details) | 8 years from the end of the financial year of the transaction, as required by Indian tax and accounting laws, even after account deletion |
| Database backups | Overwritten after 15 days |
10. Your rights and choices
Under the DPDP Act and other applicable law, you have the right to:
- Access: get a summary of the personal data we hold about you and who we have shared it with;
- Correction: correct or update inaccurate or incomplete data (you can edit most of it yourself in your profile);
- Deletion: have your account and personal data deleted;
- Withdraw consent: withdraw your consent at any time. This does not affect processing already done, but we may no longer be able to provide the Service;
- Grievance redressal: complain to our Grievance Officer (section 14);
- Nomination: nominate another person to exercise these rights for you in the event of your death or incapacity;
- Complaint: if you are not satisfied with our response, complain to the Data Protection Board of India.
To use any of these rights, write to the Grievance Officer in section 14 from the email address registered with your account.
10.1 Deleting your account
To protect your account, deletion is requested by the signed-in account holder. You can ask us to delete your account in any of these ways:
- on the website: sign in and go to Profile → Delete Account (the steps are also explained at kripalunidhi.org/delete-account);
- in the app, under Profile → Delete Account;
- if you cannot sign in, by email to [[M-2: support email]] from the email address registered with your account.
Our team reviews the request, then deletes or anonymises your account and personal data within 30 days and confirms by email. We keep only the financial records the law requires (section 9). Deleting your account ends any active subscription; refunds are governed by our Terms and Conditions. Subscriptions bought through Google Play or the Apple App Store must also be cancelled in your store account.
11. Security
We protect your data with encrypted connections (HTTPS), encryption of our databases at rest, one-way hashing (bcrypt) of passwords, and access controls that limit staff access to what their role needs. No system is completely secure. If a personal data breach occurs, we will notify affected users and the Data Protection Board of India as the law requires.
12. Children
Accounts are intended for adults. If you are under 18, please use Kripalu Nidhi only with your parent’s or guardian’s consent and supervision. We do not knowingly create accounts for children without such consent, and we do not track children or target advertising at them. If you believe a child has given us personal data without consent, contact us and we will delete it.
13. Cookies and similar technologies (website)
The website uses browser storage to keep you signed in and to remember your language. It also uses Google Analytics for usage statistics and the Facebook SDK for Facebook sign-in and sharing. You can block or delete cookies in your browser settings. Some features, such as staying signed in, may then not work.
14. Contact and Grievance Officer
For questions, requests or complaints about your personal data, contact our Grievance Officer:
[[M-1: Name]], [[Designation]]
Radha Govind Prachar Samagri, G12, G14, Plot No 4, CSC, HAF, Sector 10, Dwarka, New Delhi 110075, India
Email: [[M-2: single support / privacy email]]
We will acknowledge your request promptly and respond within the time required by law.
15. Changes to this policy
We may update this policy, for example when we add a feature or a new service provider. We will post the new version on this page with a new effective date. If the changes are significant, we will also tell you in the app or by email before they take effect.