Privacy Policy

01. Definitions

• "Personal Data" means any data about an individual who is identifiable by or in relation to such data.
• "Data Fiduciary" means Glitch Galaxy, which determines the purpose and means of processing personal data.
• "Data Processor" means any person or entity (such as Supabase, Firebase, AWS, Cloudflare, or Vercel) who processes personal data on behalf of the Data Fiduciary.
• "Data Principal" refers to you, the individual to whom the personal data relates.

02. Information We Collect

We collect only the minimum information necessary to provide high-quality development services:

• Identity & Contact Data: Name, email address, phone number, and business designation.
• Account & Dashboard Telemetry: User account credentials, encrypted session tokens, login timestamps, and account preferences within the client portal. All your invoices, active subscription care plans, project orders, and support tickets are organized within your client dashboard (/dashboard), where clients can monitor records and real-time updates.
• Transaction & Billing Data: GST details (where applicable), billing address, payment order IDs, and payment history. (Note: Sensitive payment credentials such as card numbers or CVVs are never handled or stored by us; they are processed securely by Razorpay).
• Support & Communication Records: Support desk tickets, customer chat communications, project feedback, and file attachments (e.g., design assets, code files, requirements documents) uploaded via the client dashboard or support portal.
• Project Specific Data: Source code, assets, business logic, and requirements shared during the development lifecycle.
• Technical Data: IP address, browser type, device information, and site interaction logs collected via cookies for functional improvements.

03. Data Infrastructure & Outsourcing (Data Processors)

Glitch Galaxy does not maintain internal physical servers. We rely on world-class Data Processors to host, route, and secure your information.

• Primary Processors & Cloud Infrastructure: We utilize enterprise-grade platforms including Amazon Web Services (AWS), Cloudflare (for edge networks, CDN, and DDoS mitigation), Supabase, Firebase (Google Cloud), and Vercel.
• Scalability & Dynamic Processor Selection: The specific data processors and cloud infrastructure used may change, expand, adapt, or be custom configured upon request by the customer, depending on technical requirements, compliance needs, architecture, scale, and overall project value.
• Cross-Border Transfers: You acknowledge that these third-party providers may store data on servers located outside of India. We ensure that these transfers comply with the requirements of the DPDP Act 2023, ensuring the same level of protection is afforded to your data as under Indian law.
• Security Standards: Our processors maintain rigorous certifications (SOC2, ISO 27001), providing a level of security that exceeds standard internal server capabilities.

04. What We DO NOT Do (Data Integrity Guarantee)

We maintain a strict stance on data ethics:

• No Sale of Data: We never sell, rent, or trade your personal or project data to third-party marketers or data brokers.
• No Unauthorized Sharing: We do not disclose your data to any third party except as required to fulfill our service (e.g., hosting providers) or when legally mandated by Indian law enforcement.
• No Hidden Tracking: We do not engage in invasive behavioral tracking or profiling.

05. Use of Information & Legal Basis

We process your data under the following legal bases:

• Consent: When you voluntarily provide details for a quote or project.
• Contractual Necessity: To perform the development services you have hired us for.
• Legitimate Interest: To maintain the security of our platform and improve our service efficiency.

06. Data Retention

We retain your personal data only for as long as necessary to:

• Fulfill the purposes for which it was collected.
• Comply with statutory periods under Indian tax and corporate laws.
• Provide ongoing support for your developed projects.

Once the data is no longer required, we perform secure deletion from our cloud environments.

07. Your Rights as a Data Principal

Under the DPDP Act 2023, you have the following rights:

• Right to Access: Obtain a summary of your personal data being processed.
• Right to Correction: Update or complete any inaccurate or incomplete data.
• Right to Erasure: Request the deletion of your data once the purpose of processing is finished.
• Right to Grievance Redressal: The right to have your concerns addressed by our Grievance Officer.

08. Data Security

We implement "Reasonable Security Practices and Procedures" as defined under Section 43A of the IT Act. This includes:

• Encrypted communication (SSL/TLS).
• Strict access controls for project databases.
• Regular monitoring of our third-party infrastructure for vulnerabilities.

09. Payment Processing & Financial Data Security (PCI-DSS Compliance)

Glitch Galaxy takes payment security and customer financial privacy seriously:

• Authorized Payment Partner: Online transactions are handled through our payment gateway partner, Razorpay, an RBI-authorized payment aggregator complying with the highest PCI-DSS Level 1 standards.
• Zero Card Storage: Glitch Galaxy does not collect, receive, view, or store complete credit/debit card numbers, CVV codes, UPI PINs, or net banking credentials on its servers. All sensitive financial data is tokenized and processed directly by the gateway.
• Transaction Records: We only store transaction reference metadata (such as Razorpay Order ID, Payment ID, amount paid, and invoice status) necessary for tax compliance, accounting, and order fulfillment.

10. Website Maintenance, Server Credentials & Backup Telemetry

When clients subscribe to Website Care & Maintenance or request External Website Takeovers:

• Encrypted Credential Storage: Server access tokens, API keys, and repository credentials provided for maintenance audits are stored in encrypted vaults and used exclusively by authorized engineering personnel.
• Automated Backup Integrity: Scheduled database and asset backups generated under Care Plans are stored in isolated encrypted buckets and retained strictly during the active subscription lifecycle.
• Uptime Monitoring Telemetry: Performance and uptime telemetry logs collected for status reporting contain zero end-user personally identifiable information (PII).

11. Grievance Officer

To exercise your rights or report a concern, please contact our designated Grievance Officer in accordance with the IT Rules, 2021:

• Name: Bhuvan J G
• Designation: Grievance Officer
• Email: glitchgalaxy.in@outlook.com
• Address: Bengaluru, Karnataka, India

We will acknowledge your grievance within 24 hours and aim to provide a resolution within 15 days.

12. Updates to This Policy

We reserve the right to modify this policy to remain compliant with evolving Indian regulations. Significant changes will be notified via our website or email. Your continued use of our services constitutes acceptance of the updated policy.