Privacy Policy

• We do not track you. No analytics, no advertising, no social media tracking. A visitor who does not fill in a form gives us no personal information at all.
• We only hold what you send us through a form, and use it only for the reason you sent it.
• Nobody else uses it. We do not sell, rent or share it with any other organisation. The few services that store and deliver it for us are named below.
• It is deleted on a fixed schedule, automatically, and you can ask for it to be deleted sooner.
• Every optional use is a separate choice, unticked until you tick it, and you can change your mind at any time.

Circular Journey is an independent research and knowledge-exchange initiative founded by Vivek Kumar and Prashant Gautam, based in Bihar, India. In this policy, “Circular Journey”, “we” and “us” mean the initiative and its founders, who decide why and how personal information is used on this website and are responsible for it.

Website

CircularJourney.org

Responsible for your information

Vivek Kumar and Prashant Gautam, co-founders

Contact for privacy questions

[email protected]

Based in

Bihar, India

Questions and requests about personal information are answered by the co-founders themselves. The law does not require an organisation of our size and kind to appoint a Data Protection Officer, and we have not appointed one; the co-founders named above are the people who read and answer your message.

We collect information only when you give it to us through one of the forms below. Fields marked optional on a form can be left empty with no effect on your request.

Technical information. Like every website, ours receives your IP address and basic details about your browser with each request, because that is how a page reaches you. The website itself does not keep a record of visitors. To stop automated abuse of the forms and the administrator sign-in, it holds a one-way, scrambled version of your IP address in the server’s memory for up to fifteen minutes, and the same for the email address a confirmation is sent to, so that no one can use the forms to flood someone’s inbox. Neither is ever written to disk, and neither can be turned back into the original.

On your own device. If you choose the dark theme or a motion setting, your browser remembers that choice. It stays on your device and is never sent to us. The Cookie Policy lists every item.

• No analytics or visitor measurement of any kind.
• No advertising, retargeting or marketing pixels.
• No social media tracking. Links to our social media accounts are ordinary links.
• No location data beyond the country and city you choose to type into a form.
• No accounts, passwords or profiles for visitors.
• No payment information. Nothing on this website takes payment.
• No identity documents. We do not ask for them, including when you make a privacy request.
• No sensitive personal information such as health, financial or biometric data. Please do not include any in a message.

Each use has a reason, and each reason has a basis in law. Where the basis is your consent, it is always a separate choice that you can withdraw.

We do not use your information for any other purpose, and we do not make automated decisions about you.

Where we rely on your consent, it is asked for separately, with nothing ticked in advance, and in plain words that say what it is for. Agreeing to one thing never means agreeing to another: subscribing to the Brief is not agreeing to be photographed, and being interviewed is not agreeing to be filmed.

We do not ask you to “consent” to being replied to. Replying is the reason you wrote, so a required consent box would be consent in name only.

You can withdraw any consent at any time, as easily as you gave it: through Your Privacy Rights, or by email to [email protected]. Withdrawing does not make anything we did before it unlawful, but we stop from that point.

The Brief is an occasional email sent when there is new research worth reading. You receive it only if you asked for it, either by signing up or by ticking the separate box on a form. Writing to us is never treated as a request to receive it.

When you subscribe we record the time, where on the website you did so and the version of this policy in force, so that we can show you asked. You can unsubscribe at any time from Your Privacy Rights; it takes effect immediately and removes your address from the list. It is intended for readers aged 18 and over.

We keep messages about something you asked us for, such as a reply to your enquiry, separate from the Brief. Unsubscribing from the Brief does not stop us replying to you.

A confirmation to you. When you send a form, we email you from [email protected] with your reference number and, for an enquiry or application, when to expect a reply: within 2 to 30 days. It greets you by the name you gave but does not repeat what you wrote, so that no one can use our forms to send a message to someone else in our name. After the consent form, the email is your copy of the permissions you gave and refused.

A notification to us. Everything you entered is emailed to our own mailbox at [email protected] and to a co-founder’s mailbox, so that nothing waits for someone to open the administration console. Replying to it writes to you directly.

We send nothing else because you used a form. None of our emails contains a tracking pixel, a rewritten link or a remote image, so we cannot tell whether or when you open one. At most three confirmations go to one address in fifteen minutes.

Only the co-founders. Submissions are stored on the server that runs this website, read through an administration console protected by a password, and reach the co-founders’ mailboxes as the notifications described above. We do not sell, rent, trade or give your information to anyone.

We would disclose information only if the law required it, for example in response to a valid order from a court or authority, and then only what the order requires.

We have kept this list deliberately short. There is no analytics service, email marketing platform, customer database, content delivery network, font service (our fonts are served from our own server), maps provider, CAPTCHA or payment processor.

YouTube and Vimeo are responsible for what they collect once a video is playing, under their own policies. That is why the player names the service before you press play, and loads nothing from it until you do.

Your information is stored on the server that runs this website. Copies of what you send through a form reach our mailboxes by email, through the services listed above. Circular Journey works with people in many countries, so using this website can involve your information crossing a border to reach that server, and our replies crossing back.

We transfer personal information only as far as is needed to answer you and run the website, never to a country that India has restricted transfers to, and with the protections the law of your country requires. If you are in a country whose law gives you rights over international transfers, you can exercise them through Your Privacy Rights.

Each kind of record is deleted automatically when its period ends. The periods below are the same ones the website uses to delete records, not a separate description of them.

When a period ends the record is deleted, not archived. You can ask us to delete your information sooner. The only exception is where a law requires us to keep something for a set time, such as India’s requirement to keep certain records for one year to investigate unauthorised access; we then keep it for that purpose alone and delete it afterwards. Server logs kept by our hosting service follow the same rule.

Copies of a submission in our mailboxes are kept no longer than the record itself, and are deleted with it when you ask us to delete your information.

• The website is served only over encrypted HTTPS connections, and tells browsers never to connect to it any other way.
• The administration console is protected by a password that is never stored, only as a salted, one-way scrypt hash. Its session expires after eight hours.
• Email leaves our server only over an encrypted connection to our mail service. If the connection cannot be encrypted, the email is not sent.
• Repeated sign-in attempts and repeated form submissions from one connection are refused for a period.
• Every form is checked on the server as well as in your browser, so it accepts only the fields it is designed to.
• The website tells browsers to refuse to run scripts from other sites and refuses to be embedded in other websites.
• Nothing you send is published unless you gave a specific permission to publish it.
• We collect as little as we can. Information we never hold cannot be lost.

No system is perfectly secure. If a breach affects your personal information, we will tell you without delay, explain what happened and what we are doing about it, and report it to the authorities where the law requires.

Whichever country you are in, you can ask us to do any of the following, and we will do it unless a law requires us not to:

• See the information we hold about you, and receive a copy in a form you can take elsewhere.
• Correct or complete anything that is wrong, out of date or missing.
• Delete your information.
• Withdraw a consent you gave, including permission to publish an interview, photograph or recording.
• Object to, or ask us to restrict, a use of your information.
• Find out how your information is used and who else, if anyone, has received it.
• Complain, to us and to a regulator.

If you are in India, the Digital Personal Data Protection Act also lets you nominate another person to exercise these rights for you if you die or become unable to. If you are in the European Economic Area or the United Kingdom and the GDPR applies to our use of your information, you have the rights it gives you, including to data portability and to complain to your supervisory authority. Where applicable, additional rights and protections may apply under the laws of the country in which you are located.

Use Your Privacy Rights or email [email protected]. It is free. We reply within one month, and if a request is unusually complicated we will tell you within that month why it needs longer.

Confirming it is you. We reply to the email address you write from. If your request is about information linked to a different address, we will ask you to confirm from that address. We do not ask for identity documents. If we ever could not confirm who you are any other way, we would explain why before asking for anything, take the least possible, and delete it as soon as the request was answered.

Please tell us first, at [email protected] or through Your Privacy Rights. A complaint is answered by the co-founders within one month, and never later than the ninety days India’s rules allow.

If you are not satisfied, you can complain to the regulator where you live. In India that is the Data Protection Board of India. In the European Economic Area or the United Kingdom it is your national data protection authority.

This website is an educational resource that anyone may read, but its forms and the Brief are intended for adults aged 18 and over, and we do not knowingly collect personal information from anyone younger. If you believe a child has sent us their information, tell us and we will delete it.

Field research does not seek out interviews with children. Where a young person appears in research, their details are not published, and any interview, photograph or recording of them requires the prior written consent of a parent or guardian as well as their own agreement.

Field research involves interviews, photographs and filming. How that works — which permissions we ask for, how people are credited, how to withdraw — is set out in the Research, Interview and Media Notice.

We distinguish between an organisation’s public information and a person’s private information. An organisation’s published website, general office address or published contact email may be cited as a source. A person’s private mobile number, personal email or home address is never published, even if we learned it in the course of the research.

We are based in India, and this policy is designed around India’s Digital Personal Data Protection Act, 2023, the Digital Personal Data Protection Rules, 2025 and the Information Technology Act, 2000. The Act and Rules are being brought into force in stages, with most of their obligations applying from 14 May 2027; we follow them now rather than waiting for that date.

Because visitors come from many countries, the policy also reflects the principles of the European Union’s General Data Protection Regulation: lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, security and accountability. The GDPR applies to our use of your information only where its own rules say it does, and not simply because a person in Europe can visit this website.

When we change this policy we update the version and the date at the top, record the change in the version history below, and keep the previous wording available on request. If a change affects how we use information you have already given us, we will tell you before it takes effect and, where the change relies on consent, ask for it again.

For anything about this policy or your information, write to [email protected]. This policy is published in English, which is the version that applies.