1. Scope and Controller

This Policy applies to information processed through Universal Spirituality websites and related digital services, including public content pages, account features, learning tools, community forums, contact forms, notifications, email campaigns, donation flows, and administrative operations.

For purposes of this Policy, “Universal Spirituality,” “we,” “us,” and “our” refer to the operator of the Universal Spirituality platform. “You” refers to visitors, registered users, donors, subscribers, community participants, and administrators using the services.

Contact: contact@universal-spirituality.org

2. Information We Collect

We collect information directly from you, automatically from your device, from authentication providers, from payment partners, and from our service providers as described below.

3. How We Use Information

• Provide, operate, maintain, secure, and improve the Universal Spirituality platform.
• Create and manage accounts, verify email addresses, authenticate users, support Google OAuth, reset passwords, enforce account status, and prevent unauthorized access.
• Deliver personalized spiritual learning features, including progress tracking, bookmarks, favorites, notes, reading lists, dashboards, recommendations, streaks, and content settings.
• Enable community participation, forum moderation, thread subscriptions, notifications, flags, and user-to-content references.
• Respond to contact requests, feedback, support inquiries, account deletion requests, and administrative communications.
• Send transactional emails, verification codes, password reset messages, account activity notices, content updates, newsletters, campaign emails, and unsubscribe confirmations.
• Process voluntary donations, create payment orders or checkout sessions, verify payment outcomes, and detect payment abuse or fraud.
• Analyze security events, rate limits, operational metrics, delivery logs, and aggregated usage patterns to protect and improve the service.
• Comply with legal obligations, enforce our Terms of Service, preserve records, and protect the rights, safety, and integrity of users, administrators, and the platform.

4. Legal Bases Where Applicable

Where privacy laws require a legal basis, we rely on one or more of the following:

• Contract and service necessity: to provide accounts, authentication, personalization, donations, community features, and requested services.
• Consent: for optional communications, certain cookies or tracking technologies where required, Google OAuth authorization, and voluntary submitted content.
• Legitimate interests: to secure the platform, prevent abuse, improve services, maintain audit logs, moderate community areas, and understand service performance.
• Legal compliance: to meet accounting, tax, fraud prevention, law enforcement, dispute, and regulatory obligations.
• Vital or public interest where recognized: to protect users, administrators, or the platform from credible threats or misuse.

5. Cookies, Local Storage, and Similar Technologies

We use browser storage and similar technologies for essential service operation and user experience. Examples include keeping you signed in, preserving theme and reading preferences, storing audio queue state, remembering pending actions, supporting security protections, and enabling payment, OAuth, and reCAPTCHA flows.

Third-party services such as Google, Stripe, Razorpay, Supabase, Vercel, or email providers may set their own cookies or collect technical information when their services are used. You can control cookies through your browser settings, but disabling essential technologies may limit account, payment, security, or personalization features.

6. Email Communications and Tracking

We send transactional emails needed for service operation, including verification, welcome, password reset, password changed, account activity, donation, and support messages. We may also send newsletters, spiritual content updates, campaign emails, or notifications when permitted by your settings or consent.

Campaign emails may include standard delivery analytics such as open pixels, click tracking, delivery, bounce, and unsubscribe records. These help us maintain list hygiene, understand whether messages are useful, and comply with email regulations. You can unsubscribe from marketing or campaign emails using the unsubscribe link in the email or by contacting us.

7. How We Share Information

We do not sell personal information. We share information only as needed for the purposes described in this Policy:

• Infrastructure and database providers: including Supabase and hosting/CDN providers used to store, secure, and deliver the platform.
• Authentication and security providers: including Google OAuth, reCAPTCHA, email verification, rate limiting, and fraud prevention services.
• Email and communications providers: such as Gmail SMTP, Resend, and notification delivery systems.
• Payment processors: including Stripe and Razorpay for voluntary donations and related payment verification.
• Administrative users: authorized administrators may access user, content, donation, feedback, forum, audit, and operational records only for legitimate platform purposes.
• Legal, safety, and compliance recipients: where required by law, court order, governmental request, tax/accounting obligations, or to protect rights, safety, and service integrity.
• Business continuity: in connection with a restructuring, migration, merger, transfer, or similar event involving the platform, subject to appropriate safeguards.

8. Public and Community Areas

Content you post in public or community areas, such as forum threads, comments, profile display names, content references, votes, or replies, may be visible to other users or visitors depending on the feature. Please avoid posting private, sensitive, confidential, or third-party information in public areas.

We may moderate, remove, restrict, or preserve community content to enforce our Terms, comply with law, protect users, investigate abuse, or maintain the spiritual and respectful nature of the platform.

9. International Processing

Universal Spirituality is available globally. Your information may be processed in India, the United States, the European Economic Area, or other locations where we or our service providers operate. These countries may have data protection laws different from those in your jurisdiction.

Where required, we use appropriate safeguards for cross-border processing, such as contractual protections, service provider security commitments, access controls, and data minimization.

10. Data Retention

We retain information for as long as reasonably necessary to provide the services, fulfill the purposes described in this Policy, resolve disputes, enforce agreements, comply with legal obligations, and maintain security.

• Account and profile records are generally retained while your account remains active.
• Learning progress, preferences, favorites, bookmarks, reading lists, notes, and settings are retained while your account exists unless deleted or reset.
• Security logs, rate-limit records, verification tokens, password reset tokens, and audit logs are retained for limited periods appropriate to security, legal, and operational needs.
• Donation records may be retained for payment verification, accounting, tax, anti-fraud, and legal compliance.
• Contact, feedback, mailing, unsubscribe, and campaign records are retained as needed to respond, honor preferences, and comply with communication laws.
• Public forum or community content may remain visible after account changes unless removed by you or by administrators, subject to moderation, safety, backup, and legal requirements.

11. Security

We use technical and organizational safeguards designed to protect personal information, including Supabase row-level security, service-role isolation for sensitive operations, hashed verification and reset tokens, database-backed rate limiting, input validation, sanitized HTML rendering, secure authentication flows, protected admin routes, audit logging, and content security controls.

No online service can guarantee absolute security. You are responsible for using a strong password, keeping credentials confidential, signing out of shared devices, and promptly notifying us if you suspect unauthorized access.

12. Your Privacy Choices and Rights

Depending on your jurisdiction, you may have rights to access, correct, delete, export, restrict, object to, or withdraw consent for certain processing of your personal information.

• You can update profile details, password, avatar, notification settings, and reading preferences from account pages where available.
• You can unsubscribe from marketing or campaign emails using the unsubscribe link provided in those messages.
• You can request account deletion through available profile controls or by contacting us.
• You can request access, correction, deletion, portability, or restriction by emailing us with sufficient information to verify your identity and locate your account.
• You may control cookies and local storage through your browser, recognizing that some features may stop working correctly.

We may retain information where required for legal compliance, security, fraud prevention, dispute resolution, accounting, backups, or legitimate platform operations.

13. Children’s Privacy

The platform is intended for general audiences and spiritual seekers. It is not directed to children under the age at which parental consent is required in their jurisdiction. If you believe a child provided personal information without appropriate consent, please contact us so we can take appropriate action.

14. Third-Party Links and Services

The platform may link to third-party websites, original source materials, payment processors, video or streaming services, social login providers, or other external resources. Their privacy practices are governed by their own policies. We are not responsible for the privacy, security, or content practices of third-party services not controlled by us.

15. Changes to This Policy

We may update this Privacy Policy from time to time. The “Last updated” date will reflect the latest version. If changes are material, we may provide additional notice through the website, email, account notifications, or other reasonable means.