Privacy Policy

Yours First Step Foundation ("we", "us", or "our") operates this website and the services available through it, including internship applications, certificate verification, contact enquiries, newsletter subscriptions, and Razorpay-hosted donations.

This Privacy Policy explains what personal information we collect, why we process it, when we share it, how long we retain it, and the choices available to you. By using the website or submitting information, you acknowledge this policy.

We collect information you provide directly, information received from service providers, and limited technical information needed to operate and secure the website.

• Internship applications: applicant type, full name, father's name, email address, phone number, and, where applicable, college or university, course, semester, and roll number. Applicants upload a resume, letter of recommendation, or both as PDF documents.
• Internship administration: application reference, review status, internal notes, confirmed internship dates, offer number, certificate number, and records showing when documents were issued.
• Contact form submissions: name, email address, optional phone number, subject, and message.
• Newsletter subscriptions: email address, subscription date, and subscription source.
• Donations: Razorpay processes checkout information. For successful captured donations, we may receive and store the Razorpay payment identifier, amount, currency, date, and donor name or email when Razorpay provides them. We do not collect or store full card, bank-account, or UPI credentials.
• Certificate recovery: the email address entered when requesting a certificate resend, used only to compare with the application record and process the request.
• Administration and security: administrator account and session information, request metadata, and operational logs generated by our hosting, authentication, storage, email, and security infrastructure.
• We do not create student accounts and do not use advertising or cross-site tracking cookies.

We process personal information to provide requested services, administer our programs, maintain records, communicate with you, comply with applicable obligations, and protect the website.

• Review applications and manage the internship lifecycle.
• Send application confirmations, offer letters, rejection notices, certificates, and certificate-resend emails.
• Generate offer letters and certificates, maintain issuance records, and provide public certificate verification.
• Respond to enquiries and notify our administrator of new contact submissions.
• Record newsletter subscriptions and send the initial welcome email.
• Record successful donations reported by Razorpay for operational and financial record-keeping.
• Prevent duplicate or invalid submissions, troubleshoot failures, enforce our terms, and protect the security and integrity of the website and admin dashboard.
• Comply with legal, accounting, regulatory, and dispute-resolution obligations.

Our certificate verification page allows anyone with a certificate number (or QR code from a certificate PDF) to look up limited metadata about an issued certificate.

Valid lookups display the student name, internship title, department, internship dates, issue date, certificate number, and organization name. Unknown or invalid numbers return a generic not-found message with no partial data.

Verification does not provide access to the certificate PDF. Because verification metadata is public to anyone who has the certificate number, certificate recipients should share that number and its QR code carefully.

We do not sell personal information. We share information only as needed to operate the services, comply with law, protect rights and safety, or complete a transaction you request.

• Vercel hosts the website and server-side application.
• Neon provides the PostgreSQL database used for operational records.
• Cloudflare R2 stores application uploads and generated documents. Application documents, offer letters, and certificates are stored as private objects.
• Resend delivers transactional and newsletter welcome emails.
• Razorpay hosts donation checkout and sends verified successful-donation events to us.
• Better Auth supports administrator authentication and session management.
• Professional advisers, authorities, or other parties may receive information where reasonably necessary to comply with law, investigate misuse, establish or defend legal claims, or protect people and property.

We do not use advertising or analytics cookies. The admin dashboard uses authentication cookies so that the authorized administrator can sign in and maintain a secure session.

Third-party services opened from the website, including Razorpay-hosted checkout, may use their own cookies and process information under their own privacy notices.

We use access controls, private object storage, authenticated administrator routes, input validation, and other reasonable safeguards designed to protect personal information. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Our service providers may process or store information in India or other countries where they operate. Where applicable, we rely on provider safeguards and contractual arrangements appropriate to the services they supply.

We retain personal information only for as long as reasonably needed for the purposes described in this policy, including administering internships, preserving certificate and donation records, communicating with you, maintaining security, complying with applicable legal or accounting obligations, and resolving disputes.

Retention periods vary by record type and operational need. When information is no longer required, we take reasonable steps to delete, anonymize, or securely dispose of it, subject to technical backup cycles and lawful retention requirements.

Subject to applicable Indian law, you may ask us for information about our processing, request correction or deletion of personal information, withdraw consent where processing relies on consent, or raise a grievance.

Newsletter subscribers may ask us to remove their email address because the current website does not provide an automated unsubscribe flow.

Some requests may be limited where retention or processing is required by law, needed to protect legal rights, or necessary to preserve the integrity of issued certificates and financial records. We may need to verify your identity before acting on a request.

Our internship services are not designed to collect information from a child without involvement of a parent or lawful guardian where consent is required by applicable law.

If you believe a child has provided personal information without appropriate authorization, contact us so that we can review the circumstances and take suitable action.

We may update this Privacy Policy to reflect changes in our services, providers, practices, or legal obligations. The "Last updated" date indicates the most recent revision.

Material changes may also be highlighted on the website where appropriate.

For privacy questions, rights requests, or grievances, email info@yourfirststepngo.org or use the contact form on our website.

You may also write to Yours First Step Foundation at H. No. 4, Near School No. 4, Railway Station Road, Chomu, Jaipur, Rajasthan, 303702.

This policy is intended to describe the current product accurately but should be reviewed by qualified legal counsel for compliance with all laws applicable to the organization and its activities.