Privacy Policy

mycommunitycircle.app (“Community Circle”, “we”, “our”, or “us”) is operated by Star Group Enterprises, the parent company, and provides community management software for member registers, family profiles, finances, events, donations, and related services.

Star Group Enterprises is a company registered in India. We are not a UK-registered company. We are committed to protecting your privacy and handling personal data in accordance with India’s Digital Personal Data Protection Act, 2023 (DPDP Act) and, where applicable, the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and other data protection laws that apply to our services.

This Privacy Policy explains what personal data we collect, why we collect it, how we use and share it, how long we keep it, and what rights you have. It applies when you use our website, mobile-friendly web app, treasurer accounts, member self-registration, donation portal, event booking pages, and related features.

1. Who is responsible for your data?

For the Community Circle platform and treasurer (community administrator) accounts, the data controller / data fiduciary is:

• Star Group Enterprises (parent company; trading as mycommunitycircle.app)
• Registered in: India
• Email: connect@boothwise.in

When a community treasurer adds member or family information to the platform, that treasurer’s organisation may also act as an independent controller (or data fiduciary) for that member data. In those cases, the treasurer is responsible for ensuring they have a lawful basis to collect and share member details with us, and for responding to member requests relating to their community register.

1A. Does UK GDPR apply to Star Group Enterprises?

Yes — UK GDPR can still apply even though Star Group Enterprises is registered in India, not in the United Kingdom.

Under the extraterritorial scope of UK GDPR (Article 3), UK data protection law may apply to organisations outside the UK where they:

• offer goods or services to individuals in the UK; or
• monitor the behaviour of individuals in the UK.

Because Community Circle is offered to community groups and members in the UK (as well as India and elsewhere), we treat UK GDPR as applicable to personal data of individuals in the UK that we process through this platform. Separately, we also comply with India’s DPDP Act for processing that falls under Indian law.

This section is an explanatory statement of our compliance approach and is not legal advice. Formal legal advice should be obtained for registration, representative, or transfer requirements that may apply to your specific circumstances.

1B. India’s Digital Personal Data Protection Act, 2023 (DPDP Act)

Star Group Enterprises processes digital personal data in accordance with the Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023), enacted by the Parliament of India on 11 August 2023. The official text is published by the Ministry of Electronics and Information Technology (MeitY) and is available at: meity.gov.in – DPDP Act, 2023 (PDF).

The Act provides for the processing of digital personal data in a manner that recognises both the right of individuals to protect their personal data and the need to process such personal data for lawful purposes.

1B.1 Application of the Act (Section 3)

Subject to its provisions, the DPDP Act applies to:

• processing of digital personal data within the territory of India, where the personal data is collected in digital form, or in non-digital form and digitised subsequently; and
• processing of digital personal data outside India, if such processing is in connection with any activity related to offering of goods or services to Data Principals within the territory of India.

The Act does not apply to personal data processed by an individual for any personal or domestic purpose, or to personal data that is made publicly available by the Data Principal or by a person under a legal obligation to make it publicly available.

1B.2 Key definitions used in this policy (Section 2)

• Personal data — any data about an individual who is identifiable by or in relation to such data.
• Digital personal data — personal data in digital form.
• Data Principal — the individual to whom the personal data relates (and, for a child, includes the parents or lawful guardian; for a person with disability, includes the lawful guardian acting on their behalf).
• Data Fiduciary — any person who alone or in conjunction with others determines the purpose and means of processing of personal data. For the Community Circle platform, Star Group Enterprises acts as a Data Fiduciary.
• Data Processor — any person who processes personal data on behalf of a Data Fiduciary (for example hosting, payment, messaging, or AI providers engaged by us under contract).
• Processing — wholly or partly automated operations on digital personal data, including collection, storage, use, sharing, disclosure, restriction, erasure or destruction.
• Child — an individual who has not completed the age of eighteen years.
• Personal data breach — any unauthorised processing of personal data or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access that compromises confidentiality, integrity or availability of personal data.
• Board — the Data Protection Board of India established under Section 18 of the Act.

1B.3 Grounds for processing (Section 4)

Under the DPDP Act, we may process your personal data only for a lawful purpose (any purpose not expressly forbidden by law), and only:

• where you (the Data Principal) have given your consent; or
• for certain legitimate uses listed in Section 7 of the Act.

1B.4 Notice (Section 5)

Before or at the time we request your consent, we provide (or make available) a notice informing you of:

• the personal data proposed to be processed and the purpose of such processing;
• the manner in which you may withdraw consent and exercise your rights under the Act (including grievance redressal under Section 13); and
• the manner in which you may make a complaint to the Data Protection Board of India, as may be prescribed.

This Privacy Policy, together with in-app notices and consent checkboxes (for example on self-registration), constitutes such notice. Where reasonably practicable, notice content may be made available in English or other languages specified in the Eighth Schedule to the Constitution of India.

1B.5 Consent (Section 6)

Where consent is the basis of processing, your consent must be:

• free, specific, informed, unconditional and unambiguous, given by a clear affirmative action;
• limited to the specified purpose and only to such personal data as is necessary for that purpose;
• requested in clear and plain language, with contact details of a person authorised to respond to your communications about your rights.

You have the right to withdraw consent at any time, with ease comparable to giving consent. Withdrawal does not affect the legality of processing done before withdrawal. Upon withdrawal, we will, within a reasonable time, cease processing (and cause our Data Processors to cease) unless continued processing is required or authorised under the Act, its rules, or any other law for the time being in force in India. Consequences of withdrawal (for example inability to use certain features) are borne by the Data Principal, as contemplated by the Act.

Any part of consent that waives your right to complain to the Data Protection Board of India, or that otherwise infringes the Act, is invalid to that extent.

1B.6 Certain legitimate uses (Section 7)

In addition to consent, we may process personal data for certain legitimate uses under Section 7, including where relevant to Community Circle:

• for the specified purpose for which you have voluntarily provided personal data and have not indicated that you do not consent to such use (for example completing registration, requesting an OTP, or making a payment);
• for compliance with any judgment, decree or order under Indian law, or certain contractual/civil claims under foreign law;
• for fulfilling legal obligations to disclose information to the State or its instrumentalities where required by law;
• for responding to a medical emergency involving a threat to life or immediate threat to health;
• for employment-related purposes where applicable to our staff.

1B.7 Our obligations as Data Fiduciary (Section 8)

As a Data Fiduciary, Star Group Enterprises is responsible for complying with the Act in respect of processing undertaken by us or on our behalf by Data Processors. In particular, we:

• engage Data Processors only under a valid contract for activities related to offering our services;
• endeavour to ensure completeness, accuracy and consistency of personal data where it is likely to be used to make a decision affecting you or disclosed to another Data Fiduciary;
• implement appropriate technical and organisational measures to observe the Act;
• take reasonable security safeguards to protect personal data and prevent personal data breach;
• in the event of a personal data breach, give intimation to the Board and each affected Data Principal in such form and manner as may be prescribed;
• unless retention is necessary for compliance with any law for the time being in force, erase personal data upon withdrawal of consent or as soon as it is reasonable to assume that the specified purpose is no longer being served, and cause Data Processors to erase data made available to them;
• publish business contact information of a person able to answer questions about processing of your personal data; and
• establish an effective mechanism to redress grievances of Data Principals.

1B.8 Children’s data (Section 9)

Before processing personal data of a child (under 18 years) or of a person with disability who has a lawful guardian, we (and community treasurers using our platform) must obtain verifiable consent of the parent or lawful guardian, in such manner as may be prescribed.

We shall not undertake processing of personal data that is likely to cause any detrimental effect on the well-being of a child, and we shall not undertake tracking or behavioural monitoring of children or targeted advertising directed at children.

1B.9 Rights of the Data Principal (Sections 11–14)

Under the DPDP Act, you have the following rights (exercisable in the manner that may be prescribed):

• Right to access information about personal data (Section 11) — to obtain a summary of personal data being processed and processing activities; the identities of other Data Fiduciaries and Data Processors with whom the data has been shared, with a description of data shared; and other prescribed information related to your personal data and its processing.
• Right to correction, completion, updating and erasure (Section 12) — to request correction of inaccurate or misleading data, completion of incomplete data, updating of personal data, and erasure of personal data (unless retention is necessary for the specified purpose or for compliance with any law for the time being in force).
• Right of grievance redressal (Section 13) — to have readily available means of grievance redressal from us. We will respond within such period as may be prescribed. You should exhaust this opportunity before approaching the Data Protection Board of India.
• Right to nominate (Section 14) — to nominate another individual who may, in the event of your death or incapacity, exercise your rights under the Act.

1B.10 Duties of the Data Principal (Section 15)

While exercising rights under the Act, you must:

• comply with all applicable laws;
• not impersonate another person while providing personal data;
• not suppress material information while providing personal data for any State-issued identity or address proof;
• not register a false or frivolous grievance or complaint with us or the Board; and
• furnish only verifiably authentic information while exercising the right to correction or erasure.

1B.11 Transfer of personal data outside India (Section 16)

The Central Government may, by notification, restrict the transfer of personal data by a Data Fiduciary for processing to such country or territory outside India as may be so notified. Nothing in Section 16 restricts any Indian law that provides a higher degree of protection or restriction on such transfers. We will comply with any applicable restriction notifications and with other Indian laws that impose higher standards.

1B.12 Data Protection Board of India & penalties

The Data Protection Board of India is established under Chapter V of the Act to inquire into breaches and non-compliance and to impose penalties as provided in the Schedule to the Act. After exhausting grievance redressal with us, you may approach the Board in the manner that may be prescribed. Appeals from Board orders lie to the Appellate Tribunal as provided in the Act.

Rules under the DPDP Act (including timelines, forms, and certain procedures) may be notified by the Central Government from time to time. Where this policy refers to matters “as may be prescribed”, we will follow the applicable rules once they are in force.

2. Information we collect

Depending on how you use Community Circle, we may collect the following categories of personal data:

2.1 Community treasurer & account holder data

• Full name, email address, and password (stored in encrypted form)
• WhatsApp / phone number used for login verification and account recovery
• Community or organisation name, branding, logo, and portal settings
• Subscription status, billing history, and payment references
• Account creation date, login activity, and role assignments

2.2 Member & family profile data

Collected through treasurer entry, self-registration, self-update links, event booking, or donation flows:

• Name, registration or passbook number, permanent membership number
• Address, area or locality, gender, date of birth, and age
• WhatsApp / phone number
• Blood group, occupation, visa or passport status (where provided)
• Profile photograph (where uploaded)
• Membership status, opening balance, dues, and expiry information
• Family member details (name, relationship, contact, and similar profile fields)
• Office bearer role and tenure (where applicable)

2.3 Payment & donation data

• Payment amount, currency, purpose, status, and transaction references
• Order, session, or payment identifiers from Razorpay or Stripe
• Receipt notes and error messages related to failed payments

We do not store full card numbers, CVV codes, or complete bank account details. Card and banking data is processed directly by our payment providers.

2.4 Communications data

• WhatsApp phone numbers and message delivery metadata
• One-time passcodes (OTPs) sent for login, donations, or event booking verification
• Content of transactional messages (for example payment confirmations, booking confirmations, and renewal reminders)

2.5 Event & booking data

• Event details you create or view (title, date, venue, descriptions, images)
• Booking selections, seat counts, and attendee names and ages

2.6 Financial & transaction records

• Income and expense entries, categories, notes, dates, and amounts
• Links between transactions and members or funds (cash or bank)

2.7 AI assistant interactions (where enabled)

• Questions you submit to the AI Treasurer feature
• Receipt images or voice recordings you upload for processing
• Aggregated financial summaries and community context used to generate responses
• Interaction logs (feature used, truncated prompts/responses, token usage, errors)

2.8 Technical & usage data

• IP address, browser type, device information, and general usage logs
• Authentication cookies and anti-forgery tokens
• Encrypted access tokens used for member self-registration, self-update, donation, and portal links

3. How we use your information

We use personal data for the following purposes:

• Creating and managing treasurer accounts and subscriptions
• Operating community member registers and family profiles
• Processing membership dues, donations, and community payments
• Sending OTPs and transactional WhatsApp notifications
• Managing events, food-slot bookings, and attendee records
• Recording income, expenses, and fund balances
• Providing optional AI-powered insights, receipt scanning, and drafting assistance
• Displaying public community portal pages configured by treasurers
• Securing the platform, preventing fraud, and troubleshooting errors
• Meeting legal, tax, and accounting obligations
• Improving our services, support, and user experience

4. Legal bases for processing

4.1 Under India’s DPDP Act, 2023

Where the DPDP Act applies, we process personal data only for a lawful purpose based on:

• Consent (Section 6) — free, specific, informed, unconditional and unambiguous affirmative consent for the specified purpose; or
• Certain legitimate uses (Section 7) — including voluntary provision of data for a specified purpose, compliance with law or court orders, and other uses listed in Section 7 of the Act.

You may withdraw consent at any time with comparable ease. Withdrawal does not affect processing that was lawful before withdrawal. After withdrawal, we cease processing within a reasonable time unless retention or further processing is required by law.

4.2 Where UK GDPR applies

Where UK GDPR applies, we also rely on one or more of the following legal bases:

• Contract: To provide the services you or your community have signed up for, including account access, member management, payments, and event booking.
• Consent: Where you tick acceptance boxes (for example during self-registration), opt in to optional communications, or upload data for optional AI features.
• Legitimate interests: To operate, secure, and improve the platform, prevent misuse, and support treasurers in managing their communities — balanced against your rights and freedoms.
• Legal obligation: Where we must retain or disclose information to comply with law, regulation, court order, or accounting requirements.

5. Data sharing & third-party processors

We do not sell, rent, or trade your personal data. We share data only where necessary and under appropriate safeguards with:

• Cloud hosting & database providers — to store and run the application securely
• Razorpay & Stripe — to process subscription and member payments
• Twilio — to deliver WhatsApp OTP and transactional messages
• OpenAI — to power optional AI Treasurer features when enabled
• Community treasurers & authorised office bearers — who manage member records within their organisation
• Professional advisers or authorities — where required by law or to protect legal rights

All service providers are required to process data only on our instructions, maintain appropriate security measures, and comply with applicable data protection law. Where personal data of UK individuals is transferred internationally (including processing in India or by overseas subprocessors), we rely on appropriate safeguards such as UK adequacy regulations, standard contractual clauses, or other lawful transfer mechanisms where required.

6. International data transfers

Star Group Enterprises is based in India. Some of our Data Processors (including payment, messaging, and AI providers) may also process data in other countries.

Under the DPDP Act (Section 16): personal data may be transferred outside India except to countries or territories that the Central Government may notify as restricted. We will honour any such restriction notifications and any Indian law that imposes a higher standard of protection or restriction.

Where UK GDPR applies to personal data of individuals in the UK, we take steps to ensure that data receives a level of protection essentially equivalent to that under UK GDPR, including contractual protections and provider security certifications where available.

7. Data retention

We retain personal data only for as long as necessary for the purposes described in this policy, including:

• Active treasurer accounts: For the duration of the subscription and a reasonable period thereafter for support, billing, and dispute resolution.
• Member & family records: While the community maintains an active register, unless deleted earlier by the treasurer or the member (where applicable).
• Payment records: As required for financial reporting, tax, and audit purposes (typically up to 6 years where applicable).
• OTPs & short-lived tokens: Only for a brief verification window (generally a few minutes) and then cleared or expired.
• Authentication cookies: Up to 14 days with sliding renewal when “Remember me” is used.
• AI interaction logs: Retained while the associated treasurer account exists, unless deleted earlier as part of account closure.

When data is no longer required, we securely delete or anonymise it, consistent with Section 8(7) of the DPDP Act (erase upon withdrawal of consent or when the specified purpose is no longer being served, unless retention is required by law). Treasurers may delete individual member records or request full account deletion through our support channels.

8. Data security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, loss, or destruction. These measures include:

• Encrypted passwords and secure authentication cookies (HttpOnly, Secure, SameSite)
• Encrypted URL tokens for member self-service links
• Role-based access controls for treasurer and admin functions
• Secure connections (HTTPS) for data in transit
• Restricted access to production systems and database credentials
• Payment card data handled exclusively by PCI-compliant payment providers

No method of transmission or storage is completely secure. In the event of a personal data breach, we will intimate the Data Protection Board of India and affected Data Principals in such form and manner as may be prescribed under Section 8(6) of the DPDP Act. If you believe your account or data has been compromised, please contact us immediately.

9. Your rights

Your rights depend on which law applies to the processing. A summary is below; Section 1B sets out DPDP rights in more detail.

9.1 Under India’s DPDP Act, 2023

• Right to access information about personal data being processed and with whom it has been shared (Section 11)
• Right to correction, completion, updating and erasure of personal data (Section 12)
• Right of grievance redressal (Section 13)
• Right to nominate another individual to exercise your rights in case of death or incapacity (Section 14)
• Right to withdraw consent (Section 6)

9.2 Where UK GDPR applies

• Right of access — to obtain a copy of personal data we hold about you
• Right to rectification — to correct inaccurate or incomplete data
• Right to erasure — to request deletion in certain circumstances
• Right to restrict processing — to limit how we use your data in certain cases
• Right to data portability — to receive your data in a structured, commonly used format
• Right to object — to processing based on legitimate interests or for direct marketing
• Right to withdraw consent — where processing is based on consent

To exercise any of these rights or raise a grievance, contact us at connect@boothwise.in. We may need to verify your identity before responding. Under the DPDP Act, you should exhaust grievance redressal with us before approaching the Data Protection Board of India. Where UK GDPR applies, we aim to respond within one month.

If you are a community member whose data is managed by a local treasurer, you may also contact your community organisation directly. Where we act only as a Data Processor on their behalf, we will forward your request to the relevant treasurer where appropriate.

Complaints: Under the DPDP Act, after exhausting our grievance process, you may approach the Data Protection Board of India. If you are in the UK (or UK GDPR otherwise applies to you), you may also lodge a complaint with the Information Commissioner’s Office (ICO): ico.org.uk/make-a-complaint.

10. Cookies & similar technologies

Community Circle uses a limited set of cookies and similar technologies:

• Essential authentication cookies — to keep treasurer users signed in securely
• Anti-forgery tokens — to protect forms against cross-site request forgery

We do not use third-party advertising or behavioural tracking cookies on the core application. Member portal, donation, and self-registration flows primarily use encrypted link tokens rather than persistent login cookies.

You can control cookies through your browser settings. Disabling essential cookies may prevent you from logging in or using certain features.

11. WhatsApp & electronic communications

By providing your WhatsApp number and requesting an OTP or using features that send notifications, you consent to receive transactional messages related to verification, payments, bookings, and membership reminders. These messages are service-related and not marketing unless you separately opt in.

Message delivery is handled by Twilio. Standard messaging rates from your mobile or data provider may apply.

12. AI processing

Where the AI Treasurer feature is enabled, prompts, uploaded receipts, voice input, and relevant financial summaries may be sent to OpenAI to generate responses. We log interactions for security, support, and quality purposes. Do not submit sensitive information you do not wish to be processed by AI providers. Treasurers are responsible for reviewing AI-generated output before relying on it for financial or legal decisions.

13. Children’s data

Under the DPDP Act, a child is an individual who has not completed the age of eighteen years. Community Circle is designed for use by community organisations and their authorised treasurers. Family member records may include information about children (for example name and age for event bookings or family registers).

Such data should only be provided with verifiable consent of the parent or lawful guardian (Section 9), and should not be processed in a manner likely to cause any detrimental effect on the well-being of a child. We do not undertake tracking or behavioural monitoring of children or targeted advertising directed at children. If you believe a child’s data has been submitted without proper authority, please contact us and we will take appropriate steps.

14. Sensitive personal data

Some fields in the member register (such as blood group, visa status, or date of birth) may constitute special category or sensitive personal data under data protection law. These fields are optional unless your community requires them for legitimate organisational purposes (for example welfare support or event safety). Treasurers should collect only what is necessary and inform members why it is needed.

15. External links

Our website and community portals may contain links to third-party websites (for example social media profiles or payment pages). We are not responsible for the privacy practices or content of those external sites. We encourage you to read their privacy policies before providing personal data.

16. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our services, legal requirements, or best practice. When we make material changes, we will update the “Last updated” date at the top of this page. Continued use of Community Circle after changes take effect constitutes acceptance of the updated policy, where permitted by law.

17. Contact us

If you have questions about this Privacy Policy or how we handle your personal data, please contact:

• Email: connect@boothwise.in
• Website: mycommunitycircle.app
• WhatsApp: +91 62383 95823