GrowthScript Blog operates a publishing and discovery platform for readers, publishers and organizations. For privacy requests, contact neotia.hiten@gmail.com.

We process personal data for specified platform purposes such as account creation, email confirmation, administrator verification review, fraud/security controls, publishing, support, compliance, analytics and service communications. The DPDPA requires lawful processing and, where consent is the basis, a notice describing the personal data and purpose and mechanisms for rights/grievances.

GrowthScript Blog never stores the raw Aadhaar number. The 12-digit value is used during registration for identity review and duplicate-account protection. Only a protected HMAC hash is retained for uniqueness checking. No Aadhaar verification API is used. No Aadhaar last-four value is retained.

LinkedIn is collected only as professional/social proof. The applicant supplies a public LinkedIn profile URL at account creation and an administrator manually reviews it. LinkedIn is not identity verification and is not an alternative login.

We may use service providers for hosting, email delivery, security and analytics. No external Aadhaar, GST, MSME or SMS verification provider is used in this baseline. Contracts and processor instructions should limit processing to the documented purpose and appropriate safeguards.

GrowthScript Blog should maintain a documented retention schedule by data category. Account, publication and compliance records may need to be retained for operational, contractual or legal reasons; unnecessary KYC material should not be retained indefinitely. The final schedule must be approved for the actual business model.

Subject to applicable law and the platform’s legal obligations, provide mechanisms to access information, correct inaccuracies, request erasure where permitted, withdraw consent where consent is the basis, and raise grievances. The DPDPA expressly provides rights and requires mechanisms for complaints and consent management.

Use least privilege, HTTPS, secure secrets, hashed verification tokens/OTPs, audit logging, access controls, backups and incident response. The final security controls should be documented and tested.

The policy version and effective date should be updated whenever material processing changes. The current implementation records a policy version of 14 September 2026.

Privacy Policy · Collection Notice · Data Collection Review · Consent Notice · Cookie Notice

Publisher KYC Policy · LinkedIn professional/social proof · Email and mobile verification.

Shipping · Delivery · Refunds · Cancellation

The detailed RoPA-Lite register is maintained as an internal administrator record.

The Digital Personal Data Protection Act, 2023 and Digital Personal Data Protection Rules, 2025 provide the current Indian framework for digital personal data protection. The Rules were notified on 13 November 2025 with phased commencement provisions. GrowthScript Blog should maintain a dated compliance plan aligned to the provisions as they become applicable.

Required: email address, username and password. Purpose: create and secure your GrowthScript Blog account and communicate account events.

Required for platform accounts: country calling code and mobile number. Purpose: account contact, duplicate-account prevention and administrator review. Mobile verification is manual in this baseline.

Required for Publisher status: Aadhaar input for identity review; Individual Publishers provide Udyam/MSME; Organization Publishers provide GSTIN. Purpose: publisher trust and platform safety. Full Aadhaar is never stored.

Publisher applicants may provide a LinkedIn profile URL. Purpose: professional/social proof. The URL is manually reviewed by an administrator and is not identity verification.

Information deliberately placed in a public profile or published article may be visible to readers, search engines and AI-assisted discovery systems. Users should not publish sensitive personal data in public content.

Where processing relies on consent, the user can withdraw consent using the platform’s available mechanism. Withdrawal does not invalidate processing already carried out lawfully before withdrawal and may affect services that require the data.

Email, username and credential material are required to operate an account. Passwords are handled by WordPress authentication and are not stored by the GrowthScript Blog plugin as plaintext.

Country calling code and 10-digit mobile number are collected for OTP verification. Verification matching uses a hash; a display-safe mobile value may remain in user metadata for account support.

Aadhaar is mandatory for Publisher KYC. Raw Aadhaar is never stored by GrowthScript Blog; only a salted one-way hash is retained for duplicate-account prevention. Individual Publishers additionally provide Udyam/MSME; Organization Publishers additionally provide GSTIN.

LinkedIn OIDC is used for Publisher professional/social proof. The plugin stores a hash of the LinkedIn subject identifier plus limited profile data. LinkedIn is not treated as government identity verification.

Author profiles and published articles are intentionally public. Users are instructed not to place sensitive personal data in public content.

Registration and Publisher KYC consent events are versioned and stored with privacy-preserving hashes rather than raw connection identifiers.

Maintain a vendor inventory, processor agreements, retention schedule, access review, incident-response procedure, data-subject request process and periodic policy review. Confirm the actual processing against the final production configuration before launch.

Document lawful purposes, provide clear notices, collect consent where required, maintain appropriate security, enable applicable data-principal rights, manage grievances, control processors and keep evidence of consent where consent is the processing basis.

This release adds collection notices, consent versioning, privacy-preserving consent logs, KYC minimization, publisher verification controls, cookie preference UI, policy pages and an administrative RoPA-Lite.

Appoint a privacy owner, approve a retention schedule, maintain a processor/vendor register, document cross-border/data-location considerations, conduct access reviews, test backups and incident response, and maintain a change log for material processing changes.

The Digital Personal Data Protection Rules, 2025 contain phased commencement provisions. Engineering should track the notified commencement dates and complete controls before each applicable provision takes effect.

Counsel should validate the final policy language, consent wording, grievance mechanism, KYC basis, retention periods, vendor contracts, international transfers, child-data handling and any obligations applicable to the actual business model.

Registration requires acknowledgement of the Terms of Service and Privacy/Collection Notice. These records are versioned.

Publisher applicants must acknowledge the purpose of identity/business review and administrator verification before submitting registration information.

Marketing/newsletter consent should be separate from account/service consent. Do not make optional marketing consent a condition of account creation.

The platform records consent type, policy version, decision, source and privacy-preserving hashes of connection metadata. Raw IP addresses are not stored in the consent log.

WordPress authentication, security, session and preference cookies may be required for login, forms, CSRF protection and site operation.

If GrowthScript Blog enables analytics, advertising, personalization or other non-essential technologies, the implementation should obtain the required consent before placing them where applicable and document the provider, purpose, duration and data sharing.

Users can also manage cookies through their browser. Disabling essential cookies can prevent login or form functionality.

This plugin does not intentionally add third-party advertising cookies. The banner is designed as a preference notice and can be extended when optional analytics/marketing providers are enabled.

Required: email confirmation, mobile review, Aadhaar review, Udyam/MSME review and optional LinkedIn manual review.

Required: email confirmation, mobile review, Aadhaar review, GSTIN review and optional LinkedIn manual review.

Required: email confirmation, mobile review, Aadhaar review, Udyam/MSME review and optional LinkedIn manual review.

The platform performs local format checks only. Final verification is a manual administrator decision.

Raw Aadhaar is never stored by GrowthScript Blog. A salted one-way hash is retained only for duplicate-account prevention. GSTIN/Udyam may be retained for administrator review and account operations.

Google and other social sign-up providers are not offered. LinkedIn is only a manually reviewed professional/social proof link and does not replace identity/business review.

Account access, publishing tools, verification workflows and reports are delivered electronically through the platform.

If a future product includes physical delivery, the applicable product page will specify delivery territory, carrier, charges and estimated delivery time.

Where a manual onboarding/KYC support service is offered, the current estimated processing timeline is 7–10 working days, subject to complete information and third-party verification dependencies.

Account activation, notifications, reports and publishing outputs are delivered through the registered email address and/or the user dashboard.

Manual review or verification support is targeted for completion within 7–10 working days after receipt of complete information, but third-party provider delays can extend this estimate.

If a notification cannot be delivered, the platform may retry or display the status in the user dashboard. Users should keep their email and mobile details current.

Refund eligibility depends on the specific paid plan or service terms shown at checkout.

Because ordinary GrowthScript Blog publishing access is digital, there is generally no shipping return process.

Third-party KYC/verification fees, if separately charged and already consumed, may be non-refundable unless the checkout terms or applicable law provide otherwise.

Refund requests should include the order/reference number and reason and be submitted through the support/contact channel.

Users may request account closure. Certain records may be retained where required for legal, security, fraud-prevention or dispute purposes.

Paid subscriptions can be cancelled according to the plan terms. Cancellation normally stops future renewals and does not automatically create a refund for a period already consumed unless the applicable terms say otherwise.

A publisher can stop future article scheduling; existing published content may remain public subject to platform policy and lawful removal requests.

Manual cancellation/refund/support requests are targeted for response or processing within 7–10 working days where manual review is required.