Privacy Policy

1. Scope

This Privacy Policy explains how Wildlife Rescue ("we", "us", "our") collects, uses, stores, and shares personal information when you visit raptorrescue.org or interact with us through our forms, donation channels, AI assistant (Wingman), email, phone, or WhatsApp.

We comply with the Digital Personal Data Protection Act, 2023 (India) and the EU General Data Protection Regulation (GDPR) where applicable to visitors from the European Economic Area and the United Kingdom.

2. Who we are

The data controller responsible for your information is:

• Wildlife Rescue, a charitable trust registered under the Indian Trusts Act (March 2010), with FCRA registration (2020) and 80(G) tax exemption (Reg. No. AAATW2352B25DL02).
• Operating address: C-6/1, Rehmani Chowk, Street No. 9, Wazirabad Village, Delhi - 110084, India
• Registered address: 2970, Shah Ganj, Ajmeri Gate, Delhi - 110006, India
• Email: nadeem@raptorrescue.org
• Phone: +91 98100 29698

For donations from US donors processed by our fiscal sponsor Raptor Rescue and Research Inc. (EIN: 87-3289299), their privacy practices apply to that processing.

3. Information we collect

3.1 Information you give us directly

• Contact form: name, email, phone (optional), subject, and message.
• Newsletter signup: email address.
• Tagged-bird reports: your name and contact details, the tag number, sighting details (location, date, condition of the bird), and any photos you upload.
• Wingman chat:the messages you type into our AI assistant. Messages are sent to OpenAI to generate a reply and are not used to train OpenAI's models.
• Donations: payment information is collected and processed entirely by Razorpay, GoFundMe, or Raptor Rescue and Research Inc. (R3). We do not see, store, or have access to your card or bank details.

3.2 Information collected automatically

• Server logs: IP address, user-agent, requested URL, timestamp, and referrer. Used for security, abuse prevention, and rate-limiting (stored briefly in Upstash Redis).
• Analytics (only with your consent): if you accept analytics cookies, Google Analytics 4 collects pseudonymous usage information — pages viewed, session duration, approximate location (city-level), device and browser type. IP addresses are anonymised. We do not collect advertising identifiers.

4. How we use your information

• To respond to your enquiries, donations, and tagged-bird reports.
• To send you the rescue updates you have subscribed to (you can unsubscribe at any time).
• To process and acknowledge donations and provide tax receipts.
• To operate, secure, and improve the website.
• To comply with our legal and regulatory obligations (FCRA, 80(G), tax reporting).

We do not sell, rent, or trade your personal information. We do not use your data for targeted advertising.

5. Legal basis for processing

For visitors covered by the GDPR, our legal bases are:

• Consent — for analytics cookies and the newsletter.
• Performance of a task in the public interest and our legitimate interests as a charitable organisation — for responding to enquiries, processing donations, and operating the site securely.
• Legal obligation — for retaining donation and FCRA records.

6. Cookies and analytics

We use a small number of cookies and similar technologies. We classify them as either essential or optional.

6.1 Essential cookies

These keep the site working and remember your privacy choice. They cannot be turned off. The only essential cookie we set is the one that records your decision on this banner so we don't ask again on every page.

6.2 Optional analytics cookies

We use Google Analytics 4 with IP anonymisation and Google Consent Mode v2. Analytics cookies are denied by defaultand are only set if you click "Accept all" on our cookie banner. You can change your decision at any time by clearing your browser's site data for this domain — the banner will reappear on your next visit.

7. Third-party services

The following processors handle data on our behalf or directly with you:

• Vercel (hosting, USA) — serves the website and stores short-lived request logs.
• Google Analytics 4 (Google LLC, USA) — only with your consent.
• Razorpay (India) — processes INR donations. Their privacy policy applies to payment data.
• GoFundMe (USA) — for one route of US donations.
• Raptor Rescue and Research Inc. (R3) (USA) — our 501(c)(3) fiscal sponsor for tax-deductible US donations.
• OpenAI(USA) — generates Wingman's responses. Per OpenAI's API terms, prompts and completions sent through the API are not used to train their models.
• Upstash (USA/EU) — stores rate-limit counters and queued submissions.
• Sanity (Norway/EU) — content management system for our blog.
• YouTube and Google Maps (Google LLC, USA) — embedded videos and maps.

8. Sharing your information

We share personal information only with the processors listed above, and otherwise only when required by law (for example, in response to a valid court order, regulatory request, or to protect the safety of a person or animal). We never share donor or subscriber lists with other charities or commercial partners.

9. Data retention

• Contact form messages — retained for up to 24 months, then deleted.
• Newsletter subscribers — retained until you unsubscribe.
• Tagged-bird reports — retained as part of our scientific records.
• Donation records — retained for the period required by Indian tax law and FCRA reporting (currently 7 years).
• Server logs and rate-limit counters — typically retained for 30 days or less.
• Analytics data — retained by Google for the period configured in our GA4 property (default 14 months).

10. Your rights

Subject to applicable law, you have the right to:

• Access the personal information we hold about you.
• Ask us to correct inaccurate information.
• Ask us to erase your information (subject to legal retention obligations).
• Withdraw your consent at any time, including for analytics and the newsletter.
• Object to or restrict processing in certain circumstances.
• Lodge a complaint with the Data Protection Board of India or, for EEA/UK residents, your local supervisory authority.

To exercise any of these rights, email us at nadeem@raptorrescue.org. We aim to respond within 30 days.

11. Security

We use HTTPS across the entire site, a strict Content Security Policy, modern security headers (HSTS, X-Frame-Options, Permissions-Policy), origin-checked CSRF protection on form endpoints, and per-IP rate limiting. Donation payment data is handled entirely by PCI-DSS-compliant processors (Razorpay, GoFundMe, R3) and never touches our servers.

12. International transfers

Some of our processors are based outside India (notably Vercel, Google, OpenAI, GoFundMe, and Sanity). Where personal information is transferred outside your country of residence, those transfers are protected by standard contractual clauses and the processors' own compliance frameworks.

13. Children's privacy

Our website is not directed at children under 13, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it.

14. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top of this page indicates when it was last revised. Material changes will be announced on the homepage or by email to subscribers.

15. Contact us

For privacy questions, complaints, or to exercise your rights, contact us at:

• Email: nadeem@raptorrescue.org
• Phone: +91 98100 29698
• Post: C-6/1, Rehmani Chowk, Street No. 9, Wazirabad Village, Delhi - 110084, India