Privacy policy

Scope and operator

This policy describes the Chitragupta identity service provided by the organization operating this deployment (the operator). Applications connected to Chitragupta are separately operated and may have their own privacy notices and data practices.

For privacy questions or requests, use the project or administrator contact channels provided by the operator. You can also manage supported account and connection settings in your profile.

Information the service handles

The service handles account information such as your name, email address, password verification data, profile image if supplied, account and project memberships, authentication factors and recovery information. It also maintains sessions, authorization grants, security events and audit records to provide and protect the service.

When email delivery is configured, the service sends account messages such as verification, password reset and recovery messages through the configured email provider. Session and sign-in cookies support authentication and authorization.

Google connections and data

Google sign-in uses identity information such as your Google account identifier, email and profile information. Connecting Google services requires your authorization. Available permissions depend on the project, the provider and the permissions you grant in Google; an existing account is linked explicitly.

With the relevant permissions and project consent, connected applications can request named operations through Chitragupta. Depending on the permission granted, these include:

• Contacts: read contact names, email addresses and phone numbers.
• Calendar: list calendars, read and change calendar properties, and read, create, update or delete events, including attendee notifications when requested.
• Drive: list, read, download, export, upload, copy, rename, move, trash or restore files and create folders.
• Gmail: list and read messages and attachments, send messages, manage labels, and move messages to or restore them from trash.

How Google data is used and shared

The service uses Google data to perform the features requested through an authorized connected project. Google API responses are returned to that project, which is responsible for its own handling of the data. Chitragupta stores Google connection credentials and account information encrypted on the server; Google access and refresh tokens are not returned to connected applications.

The operator must not sell Google user data, use it for advertising, or use it to train general-purpose artificial intelligence or machine learning models. Use and transfer of information received from Google APIs must adhere to the Google API Services User Data Policy, including the Limited Use requirements: Google API Services User Data Policy.

Storage and security

The identity service stores account, membership, authorization and audit records in its configured database. Profile information and Google credentials are encrypted; passwords are stored as password hashes. Profile images, when enabled, use the configured avatar storage. The operator controls the hosting, database, storage, email providers and any backups for this deployment.

The service records security and administrative events. The operator should explain its actual hosting, backup, access and retention practices through its own contact channels.

Your controls and deletion

You can update supported profile information, manage sessions and disconnect Google access through your account. Disconnecting a project removes that project’s local consent. Disconnecting a Google connection disables local access; if Google revocation is not confirmed, remove access in your Google account settings as well.

Eligible non-administrator accounts can request deletion from an ordinary central session using the current password. Access is blocked immediately, while cleanup, including Google revocation and avatar removal, may be retried. The service retains limited security and revocation markers and audit records to prevent stale access and support security. Account deletion does not delete data or independent sessions held by connected applications; contact those applications separately.

For other access, correction or deletion requests, contact the operator through the project or administrator channels.

Changes to this policy

The operator may update this policy as the service or its practices change. Changes to Google data use require appropriate notice and consent before the new use, as required by Google policy and applicable law.