Collect less. Explain why. Protect what families share.

Effective: September 10, 2026 · Pre-launch policy draft: must be reconciled with the final deployed providers and reviewed by the site owner/counsel before launch.

Privacy by design

YourVedicPriest.com is designed to collect only information reasonably needed to answer an enquiry, plan a requested ceremony, communicate with the family and manage a confirmed engagement. The production architecture intentionally avoids advertising profiles and does not require an account for public visitors.

Information a family may provide

The ceremony-request workflow may collect a name, preferred contact method, email address and/or telephone number, ceremony or occasion, city and state, preferred date range, language preference and optional notes. The first enquiry intentionally does not ask for detailed birth data, gotra, medical information, financial information or a complete home address. If additional ceremonial information is genuinely needed later, Shri Venugopal Shastry should request only what is necessary for that specific purpose.

What the prepared production form does

The current production production architecture is designed for a same-origin server-side form endpoint. When deployed and configured, the server validates the submitted fields, verifies the anti-bot token, applies rate limits, creates a non-sequential request reference, stores the request in the configured database and can send transactional notifications. A request remains pending until it is personally confirmed.

Bot and abuse protection

The prepared deployment uses Cloudflare Turnstile only when configured. Turnstile validation is performed on the server, not trusted merely because a widget appeared in the browser. The server also uses an invisible honeypot, elapsed-time checks, duplicate/idempotency controls and privacy-hashed rate-limit identifiers. Normal technical information, including an IP address, may be processed transiently for abuse prevention; the design stores a salted hash rather than a raw IP address for its application-level rate-limit record.

Panchangam and geolocation

The Panchangam works with a city selected by the visitor. If a visitor explicitly chooses Use my location, the browser asks for permission. The coordinates are used in the browser for the calculation and are not intentionally submitted to the ceremony-request database by the Panchangam interface. The current astronomical engine is a version-pinned open-source dependency loaded from jsDelivr; self-hosting the reviewed copy is a recommended production-hardening step.

Transactional email

The prepared backend can use Resend for request acknowledgements and operational notifications when the owner configures an account and authenticated sending domain. Email delivery necessarily sends the recipient address and message contents to that provider. Production policy language must identify the actual provider used at launch; this draft does not claim that Resend is already activated.

Testimonials

A testimonial may be submitted voluntarily. It is stored as pending, is never auto-published and requires explicit permission to publish the testimonial text. Separate controls allow the contributor to decide whether a name and city/state may be displayed. A contributor may request later removal by contacting the site.

Calendars

After a ceremony is confirmed, the private confirmation experience can offer Google, Outlook/Microsoft 365, Yahoo and standards-based ICS calendar options. Calendar links contain only the minimum confirmed event information needed for scheduling and intentionally omit private family, birth or ritual notes. Choosing a third-party calendar sends the information in that link to the selected calendar provider under that provider's privacy practices.

Cookies, analytics and advertising

The current production package does not install advertising pixels, cross-site behavioral profiling or marketing cookies. If analytics are added, the production implementation should collect only high-level interaction events, exclude personal ceremony details from event payloads and update this notice before collection begins. Consent controls should be introduced only where the deployed technologies and applicable law require them.

How information may be used

Information may be used to respond to the request, review availability, discuss the ceremony, arrange travel, provide preparation guidance, confirm or reschedule an engagement, send transactional communications, prevent abuse and maintain necessary service records. It should not be sold or repurposed for unrelated advertising.

Retention and deletion

Retention must be finalized by the owner and qualified counsel. The engineering package includes a proposed operational cleanup for old unconfirmed requests and expired rate-limit records, but that proposal is not a legal retention determination. Confirmed/completed engagement records should be retained only for a legitimate operational, accounting or legal reason and then securely deleted according to the adopted policy.

Children

The site contains family education but is not designed to collect information directly from children. Parents or guardians should submit requests involving minors.

Security

The prepared architecture applies data minimization, same-origin form handling, server-side validation, anti-bot verification, rate limiting, parameterized database statements, non-public secrets and restrictive production headers. No website can truthfully promise absolute security. Operational security still depends on correct deployment, provider configuration, account protection, patching and monitoring.

Contact and privacy requests

Before launch, establish a domain-based address such as privacy@yourvedicpriest.com. Until then, questions can be directed to venusaroja@yahoo.com. Identity may need to be reasonably verified before fulfilling an access/deletion request.