Privacy Policy.

This Privacy Policy (the “Notice”) is issued by [LEGAL NAME], trading as Tede Studio, GSTIN [GSTIN], registered office [REGISTERED ADDRESS] (“Tede Studio”, “we”, “us”). For personal data processed through tedestudio.com, our enquiry form and our client/partner portal (the “Portal”), we act as the Data Fiduciary under the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the rules made under it. We also follow the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI Rules”) to the extent they apply.

1. Personal data we collect

• Enquiries: name, company or brand, work email, your website or social profile (optional), country or time zone, the services and engagement you are interested in and your project description. We also store a one-way hash of your IP address to block spam.
• Portal accounts: name, business name, email, phone, city, GSTIN, your role (client, partner or founder) and the partner assigned to you.
• Project data: messages, notes, files, designs, invoices, contracts and e-signature records (name, time and IP address).
• Security data: sign-in events, IP address, device/browser information, two-step verification status and an audit log of changes.
• We do not ask for passwords to your other services, bank or card details, biometric or health data. Online payments, when enabled, are handled by a licensed payment gateway; we do not store card numbers.

2. Purposes and legal basis

We process personal data only for these purposes: replying to your enquiry; delivering the services you engage us for; billing and GST compliance; keeping the Portal secure; and meeting legal obligations. We rely on your consent (given when you submit the enquiry form or accept an invite) and on legitimate uses permitted by Section 7 of the DPDP Act (for example, where you voluntarily share data for a specified purpose, or to comply with law). We do not sell personal data or use it for third-party advertising.

3. Consent and withdrawal

You may withdraw consent at any time by writing to our Grievance Officer (section 9). Withdrawal is as easy as giving consent; it does not affect processing already done, and we may need to stop providing services that depend on it. Where a Consent Manager registered with the Data Protection Board of India is available, you may also use it.

4. Who can see your data

Inside Tede Studio: you, the one partner assigned to your account, and Tede Studio’s founders. This is enforced in the database itself (row-level security). Our Data Processors act only on our instructions under written contracts: Supabase (database, authentication and file storage), Vercel (website hosting), and our email provider (Resend) for transactional emails. We may disclose data where required by law, court order or a government authority.

5. Where your data is stored

The Portal database and files are hosted with Supabase in Mumbai, India (AWS ap-south-1). Website delivery (Vercel) and email delivery may process limited data on servers outside India. Any transfer outside India is made only to countries not restricted by the Central Government under Section 16 of the DPDP Act.

6. Security

We use reasonable security practices consistent with the SPDI Rules: encryption in transit (HTTPS/TLS), hashed passwords, mandatory two-step verification for staff, invite-only access, database row-level security, access and audit logs, and regular backups.

7. Personal data breach

If a personal data breach occurs, we will inform the Data Protection Board of India and each affected person without delay, in the form and time required by the DPDP Act and its rules, and report cyber incidents to CERT-In within the time required by its directions. We will tell you what happened, the likely impact and the steps you can take.

8. How long we keep data

• Enquiries that do not become projects: up to 12 months, then deleted.
• Account and project data: for the engagement, then deleted or anonymised once no longer needed, unless the law requires longer.
• Invoices, contracts and tax records: 8 years, as required by GST and tax law.
• Security and audit logs: up to 1 year (longer if needed for an investigation).

9. Your rights and our Grievance Officer

As a Data Principal you have the right to: obtain a summary of your personal data and how it is processed; correct, complete or update it; erase it (subject to legal retention); withdraw consent; nominate another person to exercise your rights in the event of death or incapacity; and have your grievance redressed. Please also keep your duties under Section 15 of the DPDP Act in mind (for example, do not give false information).

Grievance Officer: [GRIEVANCE OFFICER NAME], [GRIEVANCE OFFICER EMAIL], [REGISTERED ADDRESS]. We will acknowledge your request within 48 hours and resolve it within 30 days or the time prescribed by law. If you are not satisfied, you may complain to the Data Protection Board of India.

10. Children

Our services are for businesses and adults. We do not knowingly process personal data of children (under 18) without verifiable consent of a parent or lawful guardian.

11. Cookies

We use only essential cookies (to keep you signed in) and local storage to remember your light/dark mode and sound on/off choices. We do not use advertising or tracking cookies.

12. Changes

We will post updates here, change the “Last updated” date, and notify Portal users of material changes.

Red placeholders must be filled in, and this whole notice reviewed by a qualified Indian lawyer, before launch.