Privacy Policy

Who is responsible

Birgunj Youth Round Table 13 decides what is recorded about you and why, which makes the club responsible for it — the controller, in the language of data protection law. Ask the club's officers about anything on this page. They can be reached at byrt13@rtn.org.np. The club is at Birgunj.

Media Mitra Technologies builds and runs the software on the club's instructions — a processor. It does not decide what is recorded, does not use club or member data for its own purposes, and does not sell or share it. Contact: clubs@mymediamitra.com, Birgunj - 15, Nepal, 44300.

What is recorded, and why

• Name — To identify you on the roster, on your statement of account, and on vouchers recording money you paid or collected.
• Email address — To sign you in, to reset your password, and to match your registration to your roster record.
• Phone number (optional) — So officers can reach you about your dues or a reimbursement.
• Password — To sign you in. Stored only as a cryptographic hash, which cannot be reversed -- nobody, including the club's officers, can read your password.
• Your role in the club — To decide what you can see and do -- a treasurer can record entries, a member can see their own position.
• Financial records naming you — Membership fees billed and paid, money you spent for the club, money you collected on its behalf, and project contributions. This is the club's accounting record.
• A signature image, for officers who upload one (optional) — To print on vouchers and receipts, so they come out signed.
• A receipt you upload against a project contribution (optional) — As evidence of what was contributed. Kept in private storage and reachable only through a link that expires within the hour.
• A record of changes made in the app — Who changed which entry, and when. A treasury needs to be able to show that a figure was not altered quietly -- this is what makes the accounts auditable.

That is the whole list. The app records no date of birth, no postal address, no identity document, no location, and nothing about your device beyond what any web server sees in order to answer a request.

Why the club is allowed to hold it

Membership of a club carries obligations on both sides: you owe your fees, and the club owes you an account of what it did with them. Holding these records is necessary to run that relationship and to keep the accounts a members' organisation is expected to keep. Under the GDPR that is performance of a contract and the club's legitimate interests in administering itself — not consent, which is why you are not asked to tick a box to be on the roster. Withdrawing consent is therefore not the mechanism here; leaving the club is.

Who else sees it

Other members see what the club's own settings allow. Officers can see the roster and every member's position, because that is the job. Whether ordinary members can see each other's positions is a setting the club chooses.

These companies process data on the club's behalf:

• Supabase — Database, sign-in, and storage for uploaded logos and signatures. Mumbai, India (ap-south-1).
• Vercel — Hosting and content delivery. Served from the nearest edge location; data at rest stays with Supabase.

Nobody else. The app carries no analytics, no advertising and no tracking, and its fonts are served from the app itself rather than fetched from Google, so visiting it does not tell a third party who you are. Data is never sold.

Where it goes

The database is hosted in Mumbai, India. If your club is in the UK or the European Economic Area, that is a transfer outside it, made under the standard contractual clauses in Media Mitra Technologies's and Supabase's terms.

How long it is kept

Your roster record is kept while you are a member. The club's accounting records — what was billed, paid, spent and reimbursed — are kept as long as the club must keep its accounts, which is usually several years after the financial year closes and is set by the law where the club is.

This is the honest limit on erasure: a voucher recording that the club reimbursed you 6,200 is the club's own financial record, and removing it would falsify the accounts. What can be removed is your contact detail and your login. See below.

What you can ask for

• A copy of what is held about you. Your statement of account is in the app already, and officers can export the roster and transactions as CSV.
• A correction. Tell an officer; they can edit your name, phone and email directly.
• Deletion. Your login, email and phone can be removed, and your name replaced with a reference, so the ledger stays arithmetically intact while ceasing to identify you. Entries themselves are kept for as long as the accounting retention above requires. How to ask is on the delete your account page.
• To object, or to restrict what is done with it, where the law gives you that right.
• To complain. If your club is in the UK or the EEA you may complain to your national data protection authority. In Nepal, the National Information Commission oversees the Individual Privacy Act 2018.

Ask the club's officers at byrt13@rtn.org.np. They decide, since it is the club's record; Media Mitra Technologies will carry out what they instruct. Expect a reply within one month.

Security

Sign-in is handled by Supabase and passwords are stored only as hashes. Who may read or write each row is enforced by the database itself, not merely by the screens — so a member cannot reach another member's position by guessing a web address. Uploaded signature images are private and served through short-lived links.

Children

This app is for the members of a club whose membership is adults. It is not directed at children and no part of it asks for a child's data.

Changes

If this changes in substance, the date at the top of the page changes with it.

See also the cookie policy and the terms of service.