1. Overview and Scope

Rotaract South Asia Multi-District Information Organisation (RSAMDIO) operates Rotaract Insights, encompassing the analytical web dashboard (insights.rsamdio.org), the public REST API (/api/v1/*), and the Model Context Protocol (MCP) server for AI assistants including OpenAI ChatGPT and Anthropic Claude.

This Privacy Policy describes how information is collected, processed, retained, and safeguarded when you access our dashboard, download public datasets, query our REST APIs, or interact with our MCP server through ChatGPT, Claude, or custom agentic workflows.

2. Categories of Personal Data Collected

We adhere strictly to the principle of data minimization. The categories of data handled differ depending on how you interface with our services:

• AI Assistant Connectors & MCP Servers (ChatGPT & Claude): Zero end-user personal data is collected. The MCP server accepts strictly analytical filter parameters (such as district numbers, club names, zone identifiers, or country names) necessary to fulfill your informational query. We do not require, request, or collect user account details, email addresses, names, or passwords.
• Prohibition of Restricted Data: We do not collect, solicit, or process any Restricted Data as defined by platform safety policies, including:
  • Payment Card Information (PCI DSS) or banking credentials.
  • Protected Health Information (PHI).
  • Government-issued identifiers (such as Social Security numbers, Aadhaar, or passport numbers).
  • User account passwords, API keys, or multi-factor authentication tokens.
• No Sensitive Personal Data: We do not collect or process special categories of sensitive personal data (such as biometric data, health records, religious beliefs, or political opinions).
• Web Portal Telemetry: For visitors accessing the web dashboard, anonymous telemetry (aggregate page views, browser type, referring domain, and anonymized IP addresses) is gathered via Google Analytics to assess platform performance.

3. Purposes of Use

Any technical or query data received is used solely for the following legitimate purposes:

• Fulfilling User Queries: Executing read-only analytical computations, searches, and leaderboard rankings requested interactively by the user.
• Platform Maintenance & Security: Monitoring service availability, preventing denial-of-service (DDoS) attacks, enforcing rate limits, and debugging server errors.
• Aggregate Reporting: Gauging aggregate community interest across regional zones and districts to optimize server caching and dataset updates.

Zero Commercial Exploitation & No AI Model Training: We never monetize, sell, license, or reuse user queries or analytics data for advertising, commercial marketing, or automated profiling. We never use user queries, prompts, or MCP tool execution parameters to train, fine-tune, or evaluate artificial intelligence or machine learning models.

4. Categories of Recipients and Third-Party Sharing

We do not sell, rent, trade, or transfer any user data to third parties. Information is only processed through essential, trusted infrastructure partners necessary to deliver the service:

• Cloudflare: Edge network proxy providing SSL/TLS termination, DDoS mitigation, and content delivery caching.
• Netlify: Cloud hosting infrastructure that hosts the Next.js application runtime and API serverless functions.
• OpenAI Platform: When you invoke the Rotaract Insights plugin via ChatGPT, communication between OpenAI and our MCP server is direct and governed by OpenAI's terms and privacy policies. No external third parties receive your queries.
• Anthropic Claude Platform: When you connect Rotaract Insights to Claude via the Model Context Protocol (Claude Connectors Directory, Claude Desktop, or Claude for Work), communication between Anthropic and our MCP server is direct, encrypted in transit via TLS, and governed by Anthropic's terms and data privacy standards. We do not receive Claude user account profiles or session credentials.
• Google Analytics: Provides aggregate, anonymized website traffic statistics for the browser interface (subject to Google's standard privacy safeguards with IP anonymization enabled).

5. Data Retention Timelines

We enforce strict data expiration and retention schedules:

• AI Connectors & MCP Query Data (Zero Retention): Query parameters sent to the MCP server from ChatGPT, Claude, or standalone MCP clients are processed entirely in-memory and discarded immediately upon generation of the response. We do not persist, log, or store chat messages, prompt texts, or query histories to any database or permanent storage.
• Server Operational Access Logs (14-30 Days): Standard HTTP access logs (containing anonymized IP addresses, endpoint paths, response codes, and timestamps) are kept in secure, access-controlled infrastructure for diagnostic and security auditing for a maximum rolling window of 14 to 30 days, after which they are automatically purged.
• Web Analytics Data (14 Months): Anonymized Google Analytics traffic metrics are retained for 14 months under standard Google Analytics data retention policies, with IP masking enabled.

6. User Controls and Privacy Rights

You retain full control over how you interact with Rotaract Insights:

• Connector & Plugin Controls: You can install, enable, disable, disconnect, or remove Rotaract Insights at any time directly through OpenAI ChatGPT Plugin and App settings or Anthropic Claude Connector settings.
• Cookie & Telemetry Opt-Out: You can block cookies or disable JavaScript tracking in your browser or through privacy extensions (such as uBlock Origin or Privacy Badger) without losing access to the web dashboard.
• Accountless Access: Because our services require no registration or user accounts, there are no personal user profiles, tracking histories, or stored credentials associated with your identity.
• Data Protection Inquiries: Under applicable data protection regulations (such as GDPR, CCPA, and the Digital Personal Data Protection Act), you have the right to inquire about our data practices or request information by contacting our privacy team.

7. Nature of Public Institutional Records Displayed

The data published by Rotaract Insights consists of institutional, non-confidential public service records relating to Rotaract and Rotary clubs across South Asia (RI Zones 4, 5, 6, and 7):

• Club Rosters: Official club names, charter IDs, district alignments, community or university classifications, and sponsoring Rotary clubs.
• Leadership Directories: Official public contact designations for District Governors (DG), District Rotaract Representatives (DRR), and District Rotaract Committee Chairs (DRCC).
• Compliance Indicators: Aggregate membership headcounts, semi-annual dues arrears balances, and officer reporting status as compiled by Rotary International.
• The Rotary Foundation (TRF): Voluntary club-level giving records to the Annual Fund and PolioPlus.

Notice: Individual Rotaract member personal data (such as personal phone numbers, home addresses, government identification, or personal emails) is never collected, processed, or displayed.

8. Data Security and Infrastructure Safeguards

All communications with insights.rsamdio.org are secured using modern technical standards:

• TLS 1.3 Encryption: All web, API, and SSE streams require modern TLS encryption in transit.
• Read-Only Architecture: All MCP tools and public endpoints are strictly read-only (readOnlyHint: true, destructiveHint: false, idempotentHint: true, x-openai-isConsequential: false). No user queries can modify master records.
• Edge CDN Protection: Distributed edge security with DDoS mitigation, automatic threat blocking, and strict Content Security Policies.

9. Contact Information and Privacy Inquiries

If you have questions, feedback, or compliance inquiries regarding this Privacy Policy or our analytical tools, please contact our team: