Jawafdehi Initiative Privacy Policy

1. Overview

This Privacy Policy explains how Jawafdehi Initiative Inc., a Michigan public benefit nonprofit corporation ("Jawafdehi", "we", "our", or "us"), collects, uses, shares, and protects information when you use the jawafdehi.org website and related services (the "Platform"). We believe in minimal data collection and maximum transparency — consistent with our mission as Nepal's open corruption accountability platform.

We are the data controller for personal information processed through the Platform. If you have questions or wish to exercise your privacy rights, contact us at privacy@jawafdehi.org.

2. Information We Collect

2.1 Information You Provide

When you submit feedback, report an allegation, or volunteer through our Platform, you may provide:

• Your name (optional)
• Email address (optional)
• Any information you choose to include in your submission

All submissions are voluntary. You may submit feedback or allegation reports anonymously.

2.2 Automatically Collected Information

When you visit jawafdehi.org, our infrastructure automatically collects standard server logs that may include:

• IP address (temporarily logged for security and debugging)
• Browser type and version
• Pages visited and time spent
• Referring URL

2.3 Analytics Data

With your consent, we use Google Analytics 4 to understand how visitors use the Platform — for example, which pages are viewed and what visitors search for in the public archive. When you run a search, the words you type into the archive search box are recorded as part of an analytics event, together with the number of results returned. Because our archive concerns public corruption records, a search may include a person's name; if you would rather not have your search terms recorded, decline analytics in the cookie banner, and if you are concerned about your safety avoid entering identifying details (see Section 7). Google Analytics sets cookies and processes usage data. Google Analytics 4 does not log or store full IP addresses, and we do not use Google Analytics for advertising or cross-context behavioral tracking. Analytics do not load and no analytics cookies are set unless you opt in through our cookie banner. You can decline analytics at any time without affecting your use of the Platform (see Section 4).

2.4 Error Monitoring

We use Sentry to detect and diagnose technical errors so we can keep the Platform working. Sentry captures error and diagnostic data when something goes wrong. We have configured Sentry to minimize personal data: we do not send IP addresses or other personal identifiers by default, text is masked, and media is blocked in any captured diagnostics. We rely on this strictly for reliability and security (our legitimate interest) and do not use it to profile or track you.

2.5 Social Media Account Integration

To publish Jawafdehi Initiative's own content, we connect our organization's own social media accounts (including TikTok) to a self-hosted social media scheduling tool. Through a platform's official API, and only for accounts we ourselves own and connect, we may access basic profile information (such as account ID, display name, and avatar), account statistics (such as follower, like, and video counts), and the list of our own published videos, and we may upload videos we create as drafts for further editing and publishing on the platform. We do not access, collect, or store information belonging to any other users of those platforms. Information obtained through these integrations is used solely to manage our own accounts and is also subject to the terms and privacy policies of the relevant platform, including those of TikTok.

3. Cookies

Jawafdehi.org uses the following cookies and similar technologies:

• Essential cookies: A language preference cookie (English or Nepali) and, if you access the caseworker portal, a session cookie for authentication. These are necessary for the site to function and are not used for tracking.
• Analytics cookies (optional): Set by Google Analytics only after you opt in. These help us understand site usage. They are never set if you decline.

We do not use advertising cookies or third-party advertising networks.

4. Your Consent Choices

When you first visit the Platform, we ask whether you consent to analytics cookies. You may accept or decline, and declining does not limit your access to the Platform. You can change your decision later by clearing your browser storage for jawafdehi.org, which will prompt the consent banner again. Essential cookies do not require consent because the site cannot function without them.

5. How We Use Information and Legal Bases

We use collected information to:

• Process feedback, allegation reports, and volunteer submissions, and respond to inquiries
• Operate, maintain, and improve the Platform
• Monitor security and prevent abuse
• Publish and maintain the public corruption case archive
• Understand site usage (analytics), where you have consented

For visitors in the European Economic Area, United Kingdom, and other regions with similar laws, our legal bases for processing are: your consent (analytics cookies); our legitimate interests (operating and securing the Platform, error monitoring, preventing abuse, and responding to submissions you send us); and the performance of tasks carried out in the public interest (documenting and archiving publicly available corruption records).

We never sell, rent, or share personal information with third parties for commercial purposes.

6. Automated and AI Processing

To document and summarize corruption cases drawn from public records, we use third-party large language model services, including Anthropic's Claude. Published case data on the Platform is compiled from publicly available records and may be processed in this way.

We may also use AI services to help process and triage allegation reports that you submit. We do not send the content of general feedback submissions to AI services. Where we use Anthropic's Claude, submitted content is processed under Anthropic's commercial terms and is not used to train their models. Decisions that materially affect individuals are reviewed by humans; we do not rely solely on automated processing for such decisions.

7. Source and Whistleblower Protection

We recognize that people who report corruption may face risk. You may submit allegation reports anonymously, and we do not require you to provide your name or email. We minimize the personal data we collect, limit access to submissions to authorized personnel, and do not publish the identity of a source without their informed consent. Server logs that may contain IP addresses are retained only briefly for security purposes (see Section 9). If you are concerned about your safety, we encourage you to avoid including identifying details in your submission and to use privacy-protective tools (such as the Tor Browser) when accessing the Platform.

8. Data Storage, Security, and International Transfers

The Platform runs on self-hosted infrastructure operated across multiple cloud providers (see Section 10), located primarily in the United States, with error-monitoring data processed in the European Union. We take reasonable technical and organizational measures to protect data against unauthorized access, alteration, or destruction.

Because we and our service providers operate internationally, your information may be transferred to and processed in countries other than your own, including the United States. Where required, such transfers are carried out under appropriate safeguards, such as the European Commission's Standard Contractual Clauses.

9. Service Providers and Sub-Processors

We rely on the following service providers, which may process limited data on our behalf:

• Cloudflare: DNS, CDN, DDoS protection, and object storage.
• Oracle Cloud Infrastructure and Monal Cloud: compute hosting for the Platform.
• Amazon Web Services (AWS): transactional and newsletter email delivery.
• Google Cloud: supporting infrastructure services.
• Google Analytics: usage analytics (only with your consent).
• Sentry: error and performance monitoring (EU region).
• Anthropic: AI processing of public case data and, where applicable, allegation reports (not used to train models).
• UptimeRobot: external uptime monitoring.

Links to external websites (e.g., GitHub, social media, Let's Build Nepal) are governed by their respective privacy policies.

10. Data Retention

We retain information only as long as needed for the purposes described above:

• Edge and access logs: up to 30 days.
• Application and security logs: up to 90 days.
• Error-monitoring (Sentry) events: up to 90 days.
• Analytics data: up to 14 months.
• Feedback submissions: up to 24 months, then deleted unless tied to a published case.
• Allegation reports: retained for the life of any resulting public record; otherwise purged when closed without action.
• Volunteer applications: until no longer needed or upon your request to withdraw.
• Published case data: retained indefinitely as part of the permanent public-interest archive.
• Backups: deletions propagate as backups cycle out, within approximately 90 days.

11. Your Privacy Rights

Depending on where you live, you may have some or all of the following rights regarding your personal information:

• Access / know: the categories and specific pieces of personal information we hold about you and how we use it.
• Deletion: request that we delete your personal information.
• Correction: request that we correct inaccurate personal information.
• Portability: receive a copy of certain information in a portable format.
• Restriction / objection: restrict or object to certain processing.
• Withdraw consent: withdraw analytics consent at any time.
• Non-discrimination: we will not discriminate against you for exercising your rights.

California residents (CCPA/CPRA): As a nonprofit organization, we are generally not subject to the CCPA/CPRA, but we voluntarily extend these protections to California residents. We do not sell your personal information and do not share it for cross-context behavioral advertising. You may exercise the rights above, and you may use an authorized agent to do so.

EEA / UK residents (GDPR): In addition to the rights above, you have the right to lodge a complaint with your local data protection supervisory authority.

To exercise any of these rights, email privacy@jawafdehi.org or use our Feedback page. We will verify your request and respond within the timeframes required by applicable law.

12. Children's Privacy

The Platform is not directed at children under 16, and we do not knowingly collect personal information from them. If you believe a child has provided us with personal data, please contact us at privacy@jawafdehi.org and we will delete it.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. We encourage you to review this policy periodically.

14. Contact

For questions about this Privacy Policy or to exercise your rights, contact us at privacy@jawafdehi.org or through our Feedback page.