kriti. 2027 · LEGAL

Privacy Policy

EFFECTIVE 20 OCTOBER 2026

This policy explains what personal data the kriti. 2027 site collects, why, who handles it and what you can do about it. We have tried to keep it short and plain.

Who we are

This site is run for kriti. 2027, the medical research conference of Kakatiya Medical College, Warangal. For the purposes of India’s Digital Personal Data Protection Act, 2023 (DPDP Act), the Data Fiduciary is:

Kakatiya Medical College, Warangal (kriti. Organising Committee)
SVP Road, NH 563, Nizampura, Rangampet
Warangal, Telangana 506007, India

Privacy and grievance contact: kmckriti@gmail.com. In this policy, “we” and “us” mean the organisers.

What we collect

When you join the waitlist you give us:

your email address,
your college (if we already recognise your email as a kriti. 2026 delegate and have your college on file, you do not need to enter it again),
your name, only if we do not already recognise your email as a kriti. 2026 delegate (otherwise we use the first name from your 2026 registration).

We do not ask for your phone or WhatsApp number when you join the waitlist.

We also record:

the referral code of the invite link you came through, if any;
a campaign source tag, if the link you came from has one (for example an Instagram or email link), stored with your sign-up;
your own referral code, if you join the invite programme;
a hashed token that identifies your browser or device, so the site can recognise you on return (the raw token stays in your browser);
when you ask for an email code: a hash of the code and the change it protects (see section 4), kept for at most 10 minutes;
a salted hash of your IP address, used only for rate limiting. We do not store the IP address itself in the waitlist;
if you unsubscribe, your email address and the time you did it, kept on a suppression list so that we do not email you again, for the same period as the waitlist (see section 8);
analytics events: page views, and actions such as opening or submitting the join form, invite-link events and hero loading stalls.

We do not ask for payment details, government IDs or health information.

How we use it

We use your data to:

email you about kriti. 2027, including a welcome message when you join (with your invite link, if you have one), announcements and when registration opens. Every email has a one-click unsubscribe link, and you can also reply UNSUBSCRIBE or write to us at any time;
count invites made through referral links;
recognise returning delegates (see section 4);
prevent abuse, such as fake or repeated sign-ups;
improve how the site works.

We do not sell your data and we do not use it for advertising.

Returning delegates (welcome back)

When you type your email address into the join form, the page sends it to our server as you type, before you submit, to check it against a small lookup table made from the kriti. 2026 delegate records. The table holds only the normalised email address, the first name, the college you gave in 2026 and the events you registered for. Addresses checked this way are not stored unless you submit the form.

If the whole address matches exactly, we greet you by first name as a returning delegate and show the college you gave in 2026 (college names are public), so you can keep it or change it. The page never shows the events. If the address does not match, nothing about any past record is shown or revealed. The lookup is limited per network, is used only for this recognition, and is never done by part of an address.

Changing that college, or asking for your invite link when the address is already on the list, is protected by a 6-digit code we email to that address. The code works for 10 minutes and allows 5 attempts. We store only a salted hash of it, together with the pending change, and delete it as soon as it is used or has expired. The email also carries a one-tap link that holds the code in its address fragment, which is never sent in the page request and is removed from the address bar as soon as the page reads it.

We are preparing a kriti. WhatsApp number. You are never added to it automatically, and the waitlist does not collect your number. We will only reply on WhatsApp if you message that number first.

Replies come from a self-hosted gateway run for the organisers. Messages travel over WhatsApp, which is operated by Meta and has its own privacy policy. You can send STOP at any time and we will stop messaging you.

Who processes it

We use these service providers (data processors) to run the site on our behalf. They may handle your data only to provide their service to us:

AE Development: site development and maintenance;
Vercel: hosting, Vercel Analytics and Speed Insights;
Supabase: database for the waitlist, hosted in Mumbai, India;
Google Analytics: site usage analytics;
Resend: sends our emails to you, including the confirmation codes;
WhatsApp (Meta): only if you choose to message the kriti. WhatsApp number.

Some of these providers store or process data outside India. We do not share your data with anyone else except where the law requires it.

Cookies and local storage

The site stores two items in your browser’s local storage:

kriti-waitlist: a token that remembers that you have joined, so we can show your status when you return, and a masked form of your email address (for example a***@gmail.com), never the full address;
kriti-ref: the referral code from the invite link you arrived through.

Our analytics providers (Google Analytics, Vercel Analytics) may set their own cookies or use similar technology to measure usage. You can clear local storage and cookies in your browser settings at any time. Doing so will make the site forget you on that device.

Retention

We keep waitlist data until the end of kriti. 2027 plus 6 months. After that we delete or anonymise it, unless you agree to let us keep it.

Analytics data is kept for the standard periods set by each analytics provider. If you ask us to erase your data earlier, we will do so (see section 10).

Security

We use reasonable safeguards: encrypted connections, hashed identifiers, access limited to people who need it, and processors that run on well-known secure platforms. No system is perfectly secure. If a breach affecting your data occurs, we will act on it as the DPDP Act requires, including informing you and the Data Protection Board where required.

Your rights and how to exercise them

Under the DPDP Act, 2023 you may:

ask for a summary of the personal data we hold about you;
ask us to correct or complete it;
ask us to erase it;
withdraw your consent at any time, as easily as you gave it;
have your grievance addressed (see section 13);
nominate another person to exercise these rights if you die or become incapacitated.

To use any of these, email kmckriti@gmail.com from the address you used to join, or tell us that address so we can find your record. We may ask you to confirm it is you. You can also reply UNSUBSCRIBE to any of our emails, or send STOP on WhatsApp if you have messaged us there, to stop messages. Withdrawing consent does not affect what we did with your data before you withdrew.

Children

The waitlist is meant for medical students aged 18 or over. If you are under 18, you should join only with the consent of a parent or guardian, because the DPDP Act requires verifiable parental consent for anyone under 18.

If we learn that a person under 18 has joined without that consent, we will delete their data. Parents and guardians can contact us at kmckriti@gmail.com.

Changes

We may update this policy as the site and the event develop, for example when registration opens or the WhatsApp number goes live. The effective date at the top shows the latest version. If a change is significant, we will say so on the site.

Contact and grievances

For questions, requests or complaints about your data, write to the Grievance Officer, kriti. Organising Committee, at kmckriti@gmail.com. We will respond within 30 days.

If you are not satisfied with our response, you may complain to the Data Protection Board of India, as provided under the DPDP Act, 2023.