1. Who we are
This website (form.masaforum.com) is operated by MASA Forum ("MASA", "we", "us"). We can be reached at bdm@tufwud.in for any privacy-related question.
2. What we collect
To deliver the MASA Business MRI™ report, we collect:
- Contact details you provide: full name, email address, phone/WhatsApp number, and company name.
- Diagnostic answers: your 1–5 self-scores and the free-text evidence notes for all 50 questions.
- Payment metadata: Razorpay order ID, payment ID, timestamp, and amount. We do not receive or store your card, UPI, or bank credentials — those live inside Razorpay.
- Minimal technical data: your IP address and browser user-agent may be present in server access logs for a limited period, purely for security and abuse prevention.
3. Why we collect it
- To prepare and deliver your personalised MRI report and any follow-up recommendations.
- To process your payment and issue receipts/invoices where required.
- To contact you about your submission or a related MASA program if you request it.
- To comply with statutory record-keeping and taxation requirements applicable to us in India.
4. How we use it
Your answers are reviewed by MASA consultants under confidentiality. We do not sell your data to third parties. We may share it only with:
- Razorpay — for payment processing (they act as data processor under their own privacy policy).
- Google Workspace — where we host our Sheets and email (data processor).
- Our hosting provider — Hostinger, purely for server operation.
- Statutory authorities — only where we are legally compelled to do so.
5. How we protect it
- Payment verification uses HMAC-SHA256 signatures — we never trust client-side "payment succeeded" claims.
- The Razorpay checkout page runs over TLS on Razorpay's own domain.
- Server-side files containing submissions live outside the web root or are protected with directory-level access rules.
- Access to raw submissions is limited to MASA team members who need it to prepare your report.
6. How long we keep it
We retain paid submissions for as long as necessary to service you, plus a reasonable period for statutory audit trails. If you request deletion, we will remove your personal data within 30 days, retaining only what we are legally required to keep (for example, tax invoices).
7. Your rights
You can, at any time:
- Ask us for a copy of the personal data we hold about you.
- Ask us to correct anything that's inaccurate.
- Ask us to delete your data (subject to statutory retention).
- Withdraw consent for further communications.
Write to bdm@tufwud.in and we'll respond within 7 business days.
8. Cookies
This site uses a small amount of localStorage on your browser to save your form progress so you can resume where you left off. We do not use third-party advertising or tracking cookies on this page.
9. Changes to this policy
We may update this policy from time to time. The "Last updated" date at the top will reflect the most recent change. Material changes will be communicated via email to any active users.
10. Contact
For any question, request, or complaint related to your privacy, please email bdm@tufwud.in.