Privacy Policy

Welcome to Ritva Living ("we," "our," or "us"). We operate https://ritvaliving.com as an independent digital lifestyle publication developed from India and read by a global community. We are dedicated to respecting and safeguarding the personal privacy of our visitors and community members.

This Privacy Policy explains what information we collect, why we collect it, how it is stored and processed, the lawful grounds under which we operate, and the statutory rights you hold regarding your personal data. Our practices align with applicable data protection legislation, including India's Digital Personal Data Protection Act, 2023 (DPDPA), the General Data Protection Regulation (GDPR / UK GDPR) for European and British readers, and global data privacy standards.

We only collect personal information that you voluntarily provide to us or that is automatically generated during your visit to our website:

• Newsletter Subscriptions: When you subscribe to our editorial newsletter, we collect and securely store your email address to deliver curated stories, seasonal edits, and updates.
• Contact Inquiries: When you submit an inquiry through our contact form, we collect your name, email address, subject, and message content to respond to your request.
• Contributor Pitches: When applying via our Write For Us form, we collect your full name, email, biography, portfolio links, and article proposal text.
• Administrative Authentication: For authorized editors and administrators, authentication credentials and session tokens are processed securely via Better Auth.
• Technical Telemetry & Log Hygiene: Standard server access logs and application operational diagnostics. All application logging automatically applies cryptographic masking and data minimization—visitor IP addresses are truncated (e.g., 192.168.xxx.xxx), customer emails and names are masked, and private inquiry message bodies are never written to unencrypted server console logs or log stores.
• Abuse Prevention & Anti-Bot Verification: When you interact with our forms, non-intrusive challenge tokens are verified via Cloudflare Turnstile to distinguish genuine human visitors from automated botnets without deploying cross-site tracking cookies.

We minimize data collection and do not use invasive cross-site tracking cookies. We utilize browser storage technologies exclusively to deliver functional features:

• Functional Bookmarks: Your saved articles are stored locally in your browser's localStorage under the key 'publish-engine:bookmarks'. This data resides exclusively on your device and is never uploaded to our servers.
• Theme Preference: Your dark/light theme preference is retained in browser storage to maintain consistent visual presentation across page transitions.
• Session Cookies: Strictly necessary HTTP-only authentication cookies ('better-auth.session_token') used exclusively for authenticated editorial and administrative access to manage publications. These cookies are secure, SameSite-protected, and required for administrative portal defense.
• Rate Limiting & Abuse Defense: Short-lived client-side cooldown timestamps may be held in browser memory or local storage to prevent accidental double-submissions and protect form endpoints against spam floods.

Under India's Digital Personal Data Protection Act (DPDPA 2023), the European Union / UK General Data Protection Regulation (GDPR), and equivalent international privacy frameworks, we collect and process personal data exclusively under legitimate, transparent legal grounds:

• Affirmative Consent (DPDPA §6 / GDPR Art. 6(1)(a)): When you voluntarily subscribe to our editorial newsletter or submit an article pitch, you give explicit consent for us to process your email and communication details. You can easily revoke this consent at any time.
• Legitimate Interests & Uses (DPDPA §4 / GDPR Art. 6(1)(f)): Processing necessary for our legitimate activities in maintaining website availability, defending against automated spam or DDoS attacks (through privacy-preserving rate limiting and anti-bot verification), and responding to inquiries you initiate.
• Contractual Necessity (GDPR Art. 6(1)(b)): Processing required to evaluate contributor pitches or collaborate on editorial submissions.

We never sell, rent, or trade your personal data to third parties for commercial or marketing purposes.

We work with trusted infrastructure providers (sub-processors) under strict confidentiality agreements to host and deliver our publication:

• Edge Network & Anti-Bot Defense: Cloudflare, Inc. (global edge caching, anycast DNS, and Turnstile anti-bot verification for automated abuse protection without tracking readers across the web).
• Media Asset Storage: Cloudflare R2 (secure, encrypted object storage for editorial images and article assets).
• Database Infrastructure: Neon Inc. (managed PostgreSQL database hosting with encryption at rest and in transit).
• Hosting & Compute: Modern cloud VPS / edge infrastructure for global content delivery and secure server execution.
• Transactional Communications: Resend / enterprise email delivery providers to distribute newsletters, confirmation receipts, and administrative notifications.
• Operational Notifications: Discord Inc. (internal operational alert webhooks for editorial staff). All transmitted notification payloads undergo automated PII masking, truncate message previews, omit visitor IP addresses, and provide authenticated dashboard routing rather than storing customer data in unencrypted chat channels.

We retain personal data only for as long as necessary to fulfill the purposes for which it was gathered:

Newsletter subscriber records are retained until you elect to unsubscribe. Every email sent includes a compliant one-click unsubscribe mechanism (RFC 8058 List-Unsubscribe standard) powered by cryptographic HMAC-SHA256 signatures, ensuring immediate, friction-free opt-out without requiring you to log in or enter personal details. General contact form inquiries are retained for up to 12 months for administrative reference before being permanently purged.

Regardless of where you reside, we respect your statutory rights over your personal data under applicable privacy laws (including India's DPDPA 2023, the GDPR, and CCPA/CPRA):

• Right of Access & Summary: Request confirmation and a summary of the personal information we hold about you and how it is processed.
• Right to Correction & Rectification: Request correction or updating of inaccurate, outdated, or incomplete records.
• Right to Erasure ('Right to be Forgotten'): Request the permanent deletion of your personal data from our active databases and subscriber lists.
• Right to Withdraw Consent: Revoke consent at any time as easily as it was given, such as through the one-click unsubscribe mechanism in every email.
• Right to Opt Out of Sale/Sharing (CCPA/CPRA): We do not sell or share personal information for monetary or other valuable consideration, nor do we engage in cross-context behavioral advertising. You can exercise full control over your email communications via our one-click opt-out mechanisms.
• Right to Nominate (DPDPA): In accordance with Indian data protection law, the right to nominate another individual to exercise privacy rights on your behalf in the event of incapacity.
• Right to Grievance Redressal: The right to lodge a grievance with our designated privacy desk and escalate unresolved concerns to the Data Protection Board of India (DPBI) or relevant supervisory authority.
• Right to Non-Discrimination: We will never deny services, alter quality, or discriminate against you for exercising your privacy rights.

We employ industry-standard technical and organizational security measures to protect your personal data, including HTTPS/TLS encryption across all routes, encrypted database connections, parameterized queries, and strict access control protocols.

While no method of electronic storage or transmission is 100% immune from compromise, we continually audit and update our defensive posture to protect against unauthorized access, disclosure, or alteration.

If you have questions about this Privacy Policy, wish to exercise any of your data rights, or need to lodge a privacy inquiry or complaint, please contact our designated Privacy & Grievance desk by email at hello@ritvaliving.com.

In accordance with applicable digital intermediary and data protection rules, we acknowledge all formal grievances within 48 hours and aim to resolve them within 15 calendar days of receipt.

Because Ritva Living is an independent publication developed and managed electronically, all user communications and privacy requests are managed directly through our digital grievance desk at hello@ritvaliving.com. Physical correspondence arrangements can be facilitated upon request for verified legal notices.

If an issue remains unresolved after contacting our grievance desk, you have the right to register a complaint with the Data Protection Board of India (DPBI) or the competent data protection authority in your jurisdiction.