Your information deserves care.

This notice covers the SEC community platform, public directories, membership applications, professional enquiries, events, and support requests. The legal operator, postal address, privacy contact, and effective date must be confirmed before public launch. The contact form is the interim route for privacy questions.

The local preview contains clearly labelled illustrative listings. It does not save sample submissions. When authentication and database services are connected, the information described below is processed to provide the features you choose to use.

Account sign-in uses your mobile number and a one-time verification code. Profile details such as your name, city, profession, and interests are optional after sign-in. Application forms collect the information labelled on the form, including contact details, business context, relevant experience, and your consent where requested.

Professional profiles, business requirements, submitted stories, portfolio links, and other content intended for publication are reviewed before publication. Booking requests, proposals, support cases, and supporting documents can include project or business information. Do not submit identity documents, payment-card details, confidential third-party data, or other sensitive information that is not necessary for your request.

Technical providers may process security logs, session information, IP addresses, and diagnostic data needed to authenticate users, protect the platform, and operate the service. The final notice must identify the configured providers and their relevant locations before launch.

Information is used to maintain your account, review applications, manage memberships, connect participants in requested collaborations, handle booking and event workflows, respond to support requests, moderate content, and deliver service notifications. Profile interests can personalise the member dashboard.

Public profile and story submissions require publication consent. Optional marketing, advertising, or third-party tracking is not part of this initial implementation. If those purposes are introduced, the notice and consent choices must be updated first. SEC does not collect service-provider payments in this version.

Approved professional profiles, approved business requirements, published stories, articles, communities, and events can be viewed by the public. Only publish details and media you are comfortable making public. Public content may be copied by viewers or indexed by search engines.

Applicants’ private email addresses, phone numbers, support documents, moderation notes, and private group invitations are not part of public directory responses. Applications are accessible to the applicant and authorised reviewers. Support information is accessible to the applicant, authorised administrators, and assigned mentors. Booking information is restricted to its participants and authorised administrators.

Direct booking contact details are shared only after both participants opt in. Community invitation links are restricted to approved members under the community’s access rules. Opening an external service such as WhatsApp is your choice and is subject to that service’s policies.

When configured, Supabase provides authentication, database, and storage services, and MSG91 processes mobile numbers and phone verification messages for sign-in. An optional email provider may deliver transactional notifications. Hosting and these providers may process data in the regions selected by the platform operator and their subprocessors. Before launch, the operator must document the actual hosting regions, processing arrangements, safeguards, and any applicable transfer restrictions.

The initial platform has no mechanism to sell personal information or accept service payments. Third-party sites linked in profiles, portfolios, maps, or stories are controlled by their respective operators.

The following is a proposed launch retention schedule, subject to legal review and the operator’s documented configuration: retain account and active membership information while the account remains active; review rejected or withdrawn applications, resolved contact enquiries, closed support cases, and completed booking records for deletion or anonymisation after 12 months; review closed support attachments, read notifications, and delivery queue metadata after 90 days; review security and audit records after 12 months; and review unused rate-limit records after 48 hours.

Information may need to be retained longer for a specific legal duty, an unresolved complaint, fraud prevention, or a documented dispute. In that case, restrict access and record the reason and review date. Public content withdrawn by its owner should be removed from SEC’s public view following identity and ownership checks; external copies and search caches may persist.

These review periods are policy drafts, not automated deletion promises. An administrator must process deletion requests, related storage objects, and any necessary provider retention review. A backup’s expiration depends on the configured provider settings and must be communicated when a request is processed.

You can update supported profile fields in account settings and choose whether to submit public content. To request access, correction, removal of published information, withdrawal of consent, or account deletion, use account settings or the contact form. Include enough context to locate your request, but do not send one-time sign-in codes or unnecessary identity documents.

A deletion request is recorded for authorised review; it is not an immediate automatic deletion. The team may need to verify account ownership. Withdrawal can affect features that depend on the information, and any legal retention exception must be explained when responding.

The final operator notice must explain the applicable access, correction, erasure, grievance, nomination, and escalation mechanisms under India’s data-protection framework as they become applicable. Response procedures and responsible contacts must be in place before production collection.

The application uses authenticated sessions, server-side permission checks, restricted database policies, and controlled uploads. No service can promise absolute security. If you believe an account or private information is exposed, report it through the contact form without including the exposed information in a public post.

Essential session cookies support sign-in. No optional advertising cookies are included in this initial build. If analytics or other optional tracking is added, provide the necessary notice and choices before it operates.

SEC’s initial membership policy is for adults aged 18 and over. Do not create an account for a child. If the platform later serves children, it must implement an appropriate verified-consent and safety process before doing so.

Material changes to purposes, recipients, or public visibility should be communicated before the change applies where required. A dated final notice must replace this launch draft.

India’s Digital Personal Data Protection Act, 2023 and the final Digital Personal Data Protection Rules, 2025 require review in light of their applicable commencement dates and the operator’s circumstances. The final Rules provide for phased commencement. This document does not claim legal compliance; qualified Indian legal review and operational implementation are required before launch.