Privacy & Election Integrity Policy

AnchorBallot acts solely as a neutral technology and interface provider for the conduct of an election configured and administered by the client running it (the “Institution”): an association, society, university, college, housing society, corporate board, union, or other authorized entity.

AnchorBallot does not act as an election authority, election commissioner, or returning officer, candidate representative, voter representative, election observer, adjudicator of election disputes, campaign consultant, decision-maker regarding voter eligibility, decision-maker regarding candidate eligibility, or authority responsible for certifying the legal validity of an election.

The Institution remains responsible for the governance, rules, eligibility criteria, candidate approvals, voter roll, election timetable, dispute procedure, and final certification or declaration of the election.

AnchorBallot provides the technological infrastructure through which the Institution may configure, administer, monitor, conduct, tally, and review its election.

All substantive election information originates from or is approved by the Institution. This includes voter lists, electoral rolls, voter categories, constituencies, candidate information, positions being contested, election dates, voting rules, ranking methodology, abstention options, eligibility conditions, and result-publication parameters.

AnchorBallot does not independently add, remove, approve, reject, or modify any voter, candidate, position, election rule, or eligibility requirement.

Once the initial election configuration is complete, the election is handed over to the Institution's designated Election Super Administrator or other authorized election administrator, who exercises administrative control through the authorized administrative interface from that point on.

Administrative interface: used by authorized institutional administrators for election configuration, voter-roll management, candidate configuration, election opening and closure, monitoring turnout and system status, authorized complaint management, and post-election results.

Voter interface: used exclusively by eligible voters to authenticate or obtain voting authorization and cast their ballot. The voter interface does not expose administrative functions, other voters' information, interim vote totals, or information capable of revealing another voter's electoral choice.

From the start of an election engagement until completion of the election and the applicable retention period, AnchorBallot maintains strict institutional neutrality.

AnchorBallot personnel do not communicate with candidates, campaign representatives, voters, political groups, society members, election contestants, or other stakeholders regarding candidate strategy, voting preference, expected outcome, voter targeting, candidate eligibility, voter eligibility disputes, election campaigning, individual ballots, interim candidate performance, election challenges, or alteration of election results.

Any such communication received by AnchorBallot is ordinarily redirected to the Institution's designated Election Super Administrator.

This restriction does not prevent AnchorBallot from providing neutral technical assistance expressly authorized by the Institution, issuing essential system notifications, responding to cybersecurity incidents, or complying with applicable law or a binding lawful direction.

To the extent applicable under data-protection law, the Institution determines the purpose for which election personal data is collected and processed, and acts as the relevant Data Fiduciary or equivalent data controller.

AnchorBallot processes such election personal data on behalf of and pursuant to documented instructions from the Institution, ordinarily acting as the Data Processor or technology service provider in relation to that information.

AnchorBallot does not independently use election personal data for advertising, voter profiling, political profiling, solicitation, marketing, sale of data, candidate targeting, or any purpose unrelated to the provision, security, and maintenance of the election service.

Only information reasonably necessary to establish voter eligibility, administer the election, prevent duplicate voting, operate the voting process, calculate the result, and provide appropriate auditability is collected.

Where the Institution can conduct an election using a roll number, institutional identifier, anonymous voter identifier, or equivalent limited identifier, unnecessary personal information is not collected.

AnchorBallot encourages every Institution to follow the principle of minimum necessary data collection.

A fundamental privacy principle of the platform is the separation of voter identity from electoral choice.

The platform is designed so that the ballot record does not contain a direct field or database relationship mapping an identifiable voter to the vote cast by that voter.

Voter eligibility or voting-authorization records and ballot records are maintained as logically and technically separate data domains wherever practicable.

The voting-authorization mechanism establishes that an eligible voter has exercised the right to vote without creating a persistent record identifying which candidate or preference that voter selected.

Accordingly, neither an administrator nor AnchorBallot is given an ordinary application-level function capable of querying how a particular voter voted. The platform is designed specifically to avoid maintaining such a direct voter-to-ballot relationship.

AnchorBallot takes reasonable technical measures to ensure that indirect technical information does not unnecessarily recreate the voter-to-ballot relationship the architecture is designed to prevent.

Ballot-level records avoid storing unnecessary identifying information, such as full voter identity, institutional identity number, email address, telephone number, precise device identifiers, unnecessary network identifiers, or other metadata capable of directly identifying the voter, wherever technically appropriate.

Security logging is architecturally separated from ballot content wherever reasonably practicable.

Where one-time voting credentials, booth codes, tokens, or similar authorization mechanisms are used, they are designed for one-time use.

Once validly consumed, such authorization is not ordinarily capable of being replayed to cast another ballot.

The purpose of the authorization layer is to establish eligibility to participate and prevent duplicate voting; it is not to create a persistent link between voter identity and ballot selection.

Ballot information is protected through appropriate technical and organizational safeguards.

Where encryption is implemented, ballot information remains encrypted at rest and is not exposed in decrypted form through an ordinary administrative interface.

Decryption required for tallying occurs only through the authorized tallying process, in accordance with the configured election rules.

AnchorBallot personnel do not inspect, extract, or disclose individual ballot content, except where technically unavoidable for an authorized security investigation and legally permissible, and only where such access does not compromise ballot secrecy.

Where blockchain, cryptographic anchoring, hash chaining, Merkle proofs, or equivalent technologies are used, their purpose is to provide tamper evidence and independently verifiable integrity of election records.

AnchorBallot does not represent blockchain technology as independently establishing the legal validity of an election or the underlying eligibility of a voter or candidate. Blockchain or cryptographic anchoring can demonstrate that recorded information has not subsequently been altered without detection; the accuracy of information originally supplied by the Institution remains the Institution's responsibility.

No directly identifiable voter information is written to an immutable public blockchain. Where public or immutable anchoring is used, AnchorBallot anchors only non-personal cryptographic commitments, hashes, Merkle roots, or equivalent proofs that cannot reasonably disclose the underlying voter identity or ballot.

Before voting begins, the Institution approves and freezes the material election configuration, including, where applicable, the voter universe, candidate list, positions, constituency mapping, election opening and closing time, ranking methodology, abstention/rejection mechanism, and tallying methodology.

The Institution's authorized representative expressly approves this configuration.

Material changes after voting has commenced are prohibited except through a documented emergency change procedure authorized by designated institutional officials. Any such change is recorded in the audit trail.

AnchorBallot does not unilaterally change the configuration of an active election for the purpose of influencing its outcome.

During an active election, administrative monitoring may display neutral operational information, such as turnout, number of voters checked in, number of ballots cast, system availability, booth activity, and technical health.

Unless expressly required by the Institution's governing election rules, candidate-wise vote totals, rankings, preference distributions, or projected winners are not made available while voting remains open, so interim voting information cannot influence subsequent voters or election administrators.

Election results are generated by the platform according to the voting and tallying methodology approved before the election began.

AnchorBallot has no authority to manually increase, decrease, substitute, or otherwise alter votes for any candidate.

Where a result must be recomputed for technical verification, the recomputation uses the same valid ballot dataset, approved election configuration, and applicable tallying methodology, and the recomputation is logged.

The platform calculates and displays results, but the Institution remains responsible for formally accepting, certifying, announcing, or publishing the result. AnchorBallot does not determine the winner independently of the platform's configured calculation rules.

Access to identifiable election data is governed by role-based access controls and the principle of least privilege.

Election data exports are ordinarily made available only to the Institution's designated Election Super Administrator or another person formally authorized through the agreed institutional escalation procedure.

AnchorBallot does not disclose such information merely because a candidate, voter, faculty member, committee member, society member, or other stakeholder requests it. Requests are referred to the Institution's authorized Election Super Administrator.

Disclosure may nevertheless occur where required under applicable law, judicial order, governmental direction, or other binding legal obligation.

AnchorBallot personnel do not maintain unrestricted standing access to confidential election information.

Where technical intervention is required during an election, access is, where practicable, purpose-specific, limited in duration, limited to authorized personnel, logged, attributable, and restricted to information necessary to resolve the technical issue.

For highly sensitive administrative actions, AnchorBallot may implement a break-glass access procedure requiring institutional approval before privileged access is granted. Emergency access and any actions taken through it are preserved in the audit record.

AnchorBallot does not adjudicate the substantive merits of an election complaint.

Complaints concerning candidate eligibility, voter eligibility, campaign conduct, election rules, disqualification, procedural fairness, or declaration of winners are determined by the Institution in accordance with its constitution, regulations, bylaws, election rules, or other governing framework.

AnchorBallot may provide relevant technical records to the authorized Election Super Administrator to assist an institutional investigation, including, where technically feasible, appropriate system-event logs, configuration history, tallying reports, cryptographic verification records, and other non-voter-linking audit evidence.

AnchorBallot does not reconstruct or attempt to reconstruct an individual voter's electoral preference merely to resolve a complaint.

Unless another period is agreed in writing, AnchorBallot applies a standard operational election-data retention period of 30 days following the formal closure or certification of the election.

This period exists primarily to allow the Institution to identify and address legitimate technical questions, recount requirements, grievances, or challenges relating to the election.

During this period, access remains subject to the access restrictions described throughout this policy.

If, before expiry of the applicable deletion period, AnchorBallot receives written notice from the authorized Election Super Administrator that an election is subject to a legitimate complaint, investigation, litigation, regulatory requirement, or formal dispute, deletion of the specifically relevant information may be temporarily suspended.

The affected information is placed under restricted legal hold and is not used for any unrelated purpose.

Retention continues only for the period reasonably necessary to satisfy the relevant legal, contractual, or dispute-resolution requirement.

Upon expiry of the applicable operational retention period, AnchorBallot securely erases or renders irrecoverable the election personal data no longer lawfully or operationally required.

Subject to applicable law and technical architecture, this may include voter rolls, candidate personal information, voter identifiers, eligibility records, election configuration data, booth-level operational information, ballots, and other client-specific election records.

Where encrypted backup copies cannot immediately be physically overwritten due to a backup lifecycle, access to such backups remains restricted, and they expire according to the applicable secure backup-rotation procedure.

Where technically implemented, cryptographic key destruction may be used to render retained encrypted copies permanently unreadable.

The 30-day operational deletion policy does not require AnchorBallot to destroy cybersecurity logs, compliance records, or other information legally required to be retained for a longer period.

Any information retained solely because of an applicable statutory or regulatory requirement remains segregated where reasonably practicable, is not used for election campaigning, voter analysis, or commercial profiling, remains subject to appropriate access restrictions, and is deleted when the applicable statutory retention requirement expires.

In short: 30-day deletion means deletion of ordinary client election operational data, subject always to legally mandatory retention requirements.

If the platform uses a non-personal cryptographic hash, Merkle root, blockchain anchor, or equivalent integrity proof, that proof may remain after deletion of the underlying election dataset, provided it does not contain personal data and cannot reasonably be reversed to reveal a voter's identity or electoral choice.

The purpose of retaining such proof is solely to establish the integrity or authenticity of the historical election record, not to retain the underlying personal data.

AnchorBallot does not sell, license, or commercially exploit client election data.

Election data is not used to create political profiles; identify political preferences; target advertisements; develop candidate databases; market to voters; sell institutional-member lists; conduct political sentiment analysis; or train general-purpose artificial-intelligence models.

Non-identifiable operational telemetry required to maintain, secure, and improve the technical service may be processed only where it cannot reasonably identify a voter, reveal a vote, or reconstruct an Institution's confidential election outcome, and where permitted under the applicable agreement.

AnchorBallot maintains reasonable technical and organizational safeguards appropriate to the nature and sensitivity of the election information processed.

These include, as applicable, encryption, multi-factor authentication for privileged accounts, role-based access control, least-privilege access, tenant isolation, cryptographic integrity controls, secure credential management, vulnerability management, audit logging, backup controls, monitoring, and incident-response procedures.

No technology platform can represent that cybersecurity risk has been eliminated entirely. AnchorBallot's obligation is to maintain reasonable and appropriate safeguards designed to preserve the confidentiality, integrity, and availability of the platform and the information processed through it.

AnchorBallot maintains an incident-response process covering suspected unauthorized access, data breaches, system compromise, and material election-integrity incidents.

Where an incident materially affects an Institution's election or election data, AnchorBallot notifies the Institution's nominated security or administrative contact without undue delay and provides available information reasonably necessary for investigation and mitigation.

AnchorBallot may additionally make notifications to governmental, cybersecurity, regulatory, or other authorities where required by applicable law.

Where cloud infrastructure, hosting providers, or other technology sub-processors are used to operate the platform, AnchorBallot ensures that appropriate contractual security and confidentiality requirements apply to those providers.

Sub-processors do not acquire independent rights to use election data for advertising, profiling, marketing, or unrelated commercial purposes.

Where agreed with the Institution, AnchorBallot may maintain and provide a list of material sub-processors involved in processing institutional election information.

All AnchorBallot personnel who may obtain access to confidential election information are subject to appropriate confidentiality obligations.

Those confidentiality obligations survive termination of the client engagement and completion of the election.

Where an electoral roll contains persons under eighteen years of age, the Institution notifies AnchorBallot before the relevant information is uploaded.

The Institution is responsible for determining the lawful basis and institutional authority for processing the personal data of minors, and for obtaining any consent or authorization legally required.

AnchorBallot provides reasonable technical assistance necessary to implement the agreed privacy requirements applicable to such an election.

The Institution remains responsible for the accuracy and lawfulness of information supplied to AnchorBallot.

Without limiting the foregoing, AnchorBallot is not responsible for substantive errors arising solely because the Institution supplied an incorrect voter list, candidate name, candidate eligibility decision, constituency allocation, election rule, voting period, ranking methodology, or other election configuration.

AnchorBallot nevertheless remains responsible for performing its own contractual technology obligations, and does not rely on this provision to exclude responsibility for unauthorized alteration, negligence, security failures, or other acts attributable to AnchorBallot.

Before deployment, the Institution provides or approves the rules governing the relevant election.

Where election methodology varies between institutions, the platform is configured according to the agreed written election requirements.

AnchorBallot does not independently interpret an Institution's constitution, bylaws, regulations, or election code, except to the extent necessary to translate confirmed requirements into technical configuration. Any ambiguity regarding election rules is referred to the Institution for written determination.

The platform is designed to maintain two objectives simultaneously: election integrity (sufficient evidence that the authorized election configuration, ballot submissions, and tallying process have not been improperly altered) and ballot secrecy (the absence of a direct mechanism connecting an identifiable voter with that voter's final electoral choice).

An audit therefore establishes whether the election system operated correctly, without becoming a mechanism through which individual voting preferences can be discovered.

Unless expressly agreed following separate legal and regulatory assessment, the platform is intended for private, institutional, academic, association, society, corporate, club, committee, or similar elections.

Nothing in this policy represents that the platform has been approved, certified, or authorized by the Election Commission of India, a State Election Commission, or any other statutory election authority for use in governmental elections.

Use for a statutory public election requires separate legal, regulatory, technical, and contractual assessment.

AnchorBallot treats privacy and election secrecy as architectural characteristics of the platform, not merely contractual restrictions.

The design principle is: verify the right to vote, authorize one vote, sever identity from ballot, securely record the ballot, independently verify integrity, calculate the approved tally, then erase unnecessary personal data.

This architecture lets an Institution verify that an eligible person has exercised a vote, while preventing the platform from becoming a repository of identifiable political preferences.

AnchorBallot's role remains, at all times, that of a neutral technology provider. It provides the infrastructure for an Institution to conduct an election, but does not exercise control over the democratic choices made through that infrastructure.

AnchorBallot does not choose the candidates. It does not choose the voters. It does not campaign. It does not determine how an individual votes. It does not alter the vote after submission. It does not determine the political or institutional consequence of the result.

Its responsibility is to provide the agreed technical environment in which the Institution can conduct, verify, and audit its election, while preserving the confidentiality of individual electoral choice.