Privacy Policy

This Privacy Policy explains how Arkya Srijan (“Arkya Srijan”, “we”, “us” or “our”), a sole proprietorship based in Bhubaneswar, Odisha, India, collects, uses, shares and protects personal data.

It is a common policy for Arkya Srijan and every business that operates under it. It applies to:

• the Arkya Srijan website at arkya.in;
• Arkya Tech, the technology division of Arkya Srijan, and its websites and services;
• Shilpa Sutra and any other present or future venture of Arkya Srijan;
• every mobile app, web app and other software that Arkya Srijan or Arkya Tech publishes under its own name, on any platform, including Google Play and the Apple App Store (together, the “Apps”);
• our emails, messages, customer support and other dealings with you.

We call all of these our “Services”. For personal data processed through the Services, Arkya Srijan is the Data Fiduciary under India’s Digital Personal Data Protection Act, 2023 — the organisation that decides why and how your data is processed.

Some Apps may offer features this policy does not describe in detail. Where that happens, the App will tell you before it collects anything new — in the app-store listing, inside the App or in a short supplementary notice. That notice forms part of this policy.

Arkya Tech also designs and builds websites and apps for client businesses. When an app is published under a client’s name, the client decides how its users’ data is used and the client’s own privacy policy applies. In that case we act only on the client’s instructions as their service provider (a “Data Processor”), and you should contact the client about your data.

This policy covers the personal data of our clients’ staff and contacts that we handle to run our business relationship with them.

What we collect depends on which Services you use. It falls into these categories:

Account information

When you create an account: your name, email address and/or mobile number, a password (stored only in encrypted, hashed form), and your profile details and preferences. If you sign in with Google, Apple or another provider, we receive the basic profile details you allow that provider to share — usually your name, email address and profile picture — but never your password for that service.

Verification information

One-time passwords (OTPs) and similar codes we send to confirm that an email address or phone number belongs to you.

Transaction information

When you buy something or make a payment: what you bought, the amount, date and time, order and transaction IDs, payment status, billing name and address, and GST details if you give them. Limited payment details (such as the payment method type or the last four digits of a card) may be shared with us by the payment provider.

Content you provide

Anything you submit through the Services, such as orders, messages, feedback, files or support requests.

Communications

Emails, calls and messages you exchange with us, including through the contact form on our website.

Technical and usage information

Information our servers and Apps record automatically to keep the Services working and secure: IP address, device type and model, operating system, app version, browser type, date and time of access, and error and security logs.

Device permissions

Some App features may ask to use your camera, photos, location, contacts or notifications. We ask for permission first, use it only for the feature you are using, and you can turn it off at any time in your device settings.

We do not knowingly collect sensitive data such as health, biometric, financial account passwords, caste, religion or sexual orientation information. If a future feature truly needs it, we will ask for your explicit consent first.

The Arkya Srijan website (arkya.in) does not use cookies, analytics trackers or advertising tags, and it loads no fonts or scripts from third-party sites.

The contact form does not store anything on our servers. It opens your own email app with your message addressed to arkya.office@gmail.com, and you choose whether to send it. We receive only what you send.

Like every website, our hosting provider automatically records basic server logs (such as IP address, browser type, pages requested and time of access) to deliver the site and protect it from misuse.

If any of our websites or Apps start using cookies or analytics in future, we will update this policy and ask for your consent where the law requires it.

We use personal data only for clear, specific purposes:

• to create and manage your account, verify your identity and let you sign in;
• to provide the Services you ask for — including processing orders and payments, and sending receipts and invoices;
• to reply to your questions, requests and complaints, and provide customer support;
• to send service messages, such as OTPs, security alerts, order updates and changes to our terms or this policy;
• to keep the Services safe — preventing fraud, abuse, unauthorised access and security incidents;
• to fix problems and improve the Services;
• to meet our legal obligations, including tax, accounting and record-keeping requirements, and lawful requests from authorities;
• with your separate consent, to send you news and offers. You can unsubscribe from these at any time.

We do not sell your personal data, rent it, or use it for profiling or targeted advertising by third parties.

Under Indian law, we process your personal data:

• with your consent, which you give when you create an account, make a purchase, contact us or turn on a feature — after seeing a notice that explains what we collect and why; or
• for certain legitimate uses the law allows without separate consent — for example, when you voluntarily give us data for a specific purpose (such as your email address so we can reply to you), or when we must comply with a law, court order or government request.

You may withdraw your consent at any time (see “Your rights” below). Withdrawing it does not affect processing done before you withdrew it, but it may mean we can no longer provide some Services to you.

Payments in our Services are handled by trusted third-party payment providers — such as payment gateways (for example, Razorpay), UPI apps, banks and the in-app billing systems of Google Play and the Apple App Store.

You enter your card, UPI or banking details directly with these providers. We never see or store your full card number, CVV, UPI PIN or net-banking password. The providers process your payment under their own privacy policies and security standards, and tell us only whether the payment succeeded along with the limited transaction details described above.

We keep transaction records for as long as tax and accounting laws require.

We share personal data only when needed, and only with:

• service providers who help us run the Services — such as cloud hosting and storage, sign-in and authentication, email and SMS delivery, payment processing and customer support tools. They may use your data only to provide their service to us, under contracts that require them to keep it confidential and secure;
• Arkya Srijan’s own ventures and divisions (such as Arkya Tech) where needed to provide a Service you have asked for. All of them follow this policy;
• government authorities, courts and regulators when the law requires it, or to protect the rights, property or safety of our users, the public or Arkya Srijan;
• a buyer or successor, if all or part of a business or App is transferred, merged or reorganised. Your data will remain protected by this policy or one at least as protective, and we will tell you before that happens;
• anyone else, with your consent.

We are based in India. Some of our service providers (for example, cloud hosting providers) may store or process data on servers in other countries. When that happens, we make sure the transfer is allowed under Indian law and that your data stays protected to the standard described in this policy. We will not transfer personal data to any country the Government of India restricts.

We keep personal data only as long as we need it for the purpose it was collected, and then delete it, unless the law requires us to keep it longer. In general:

Account data

while your account is active. If you delete your account, we delete or anonymise this data within 30 days. If an account is unused for three years, we may delete it after giving you at least 48 hours’ notice.

Transaction records and invoices

for the period required by Indian tax, GST and accounting laws.

Support and contact messages

for up to three years after the matter is closed, so we can refer back to it if needed.

Server, security and access logs

for one year, as required by Indian law for preventing and investigating misuse, and then deleted unless needed for an ongoing investigation.

We use reasonable security safeguards to protect personal data, including:

• encryption of data in transit (HTTPS/TLS) and, where supported, at rest;
• hashing of passwords, so they are never stored in readable form;
• access controls, so only people who need the data to do their work can see it;
• keeping logs of access, so misuse can be detected and investigated;
• regular updates and backups, and choosing service providers with strong security practices.

No system is completely secure. If a personal data breach happens, we will act quickly to contain it, and we will inform affected users and the Data Protection Board of India as the law requires, explaining what happened, the likely impact, what we are doing about it and what you can do to protect yourself.

Under the Digital Personal Data Protection Act, 2023 you have the right to:

• access — get a summary of the personal data we hold about you and how we process it, and the identities of anyone we have shared it with;
• correct and update — have inaccurate or incomplete data corrected, completed or updated;
• erase — have your data deleted when it is no longer needed, or when you withdraw consent, unless the law requires us to keep it;
• withdraw consent — as easily as you gave it;
• grievance redressal — have your complaints about your data handled by us;
• nominate — name another person to exercise these rights on your behalf if you die or become unable to do so.

To use any of these rights, use the options in the relevant App or account settings where available, or write to arkya.office@gmail.com. We may need to verify your identity before acting on a request. We will respond as quickly as we can, and in any case within the time allowed by law.

You can delete your account and its associated data at any time:

• in the App — use the “Delete account” option in the account or settings screen, where the App offers it; or
• by email — write to arkya.office@gmail.com from the email address linked to your account (or include the phone number linked to it), with the subject “Account deletion request” and the name of the App.

We will confirm the request and delete or anonymise your account data within 30 days. We may keep certain records for longer where the law requires it — for example, invoices and transaction records under tax laws — and we will tell you what we keep and why. Uninstalling an App does not delete your account.

Under Indian law, anyone under 18 is a child. Our Services are not meant for children unless an App clearly says otherwise.

If an App is meant for children, we will obtain verifiable consent from a parent or lawful guardian before processing the child’s personal data, and we will not track, monitor the behaviour of, or target advertising at children.

If you believe a child has given us personal data without a parent’s or guardian’s consent, please contact us at arkya.office@gmail.com and we will delete it.

We send service messages — such as OTPs, receipts, security alerts and important changes — because they are needed to run the Services.

We send promotional messages only if you have agreed to receive them. Every promotional email has an unsubscribe link, and you can also opt out by writing to us. Turning off promotions does not stop service messages.

Our Services may link to, or let you sign in with, services run by others — such as Google, Apple, payment providers, maps or social media. Their own privacy policies apply to what they do with your data. Please read them; we are not responsible for their practices.

Our Services are run from India and this policy follows Indian law. If you use them from another country, you may have additional rights under your local data protection laws. Contact us and we will help you exercise them as far as we reasonably can.

If you have a question, request or complaint about your personal data or this policy, please contact our Grievance Officer:

Name

Swagat Baral

Organisation

Arkya Srijan

Email

arkya.office@gmail.com

Phone

+91 9776927945

Address

Bhubaneswar, Odisha, India

Please mention “Privacy” in the subject line and the name of the website or App your request is about. We will acknowledge your complaint promptly and aim to resolve it within 30 days — and in any case within the time limit set by law.

If you are not satisfied with our response, you may complain to the Data Protection Board of India under the Digital Personal Data Protection Act, 2023.

We may update this policy as our Services or the law change. The latest version will always be available at arkya.in/privacy-policy/, with its “Last updated” date. If we make significant changes, we will tell you through the App, by email or on our website before they take effect, and ask for your consent again where the law requires it.

This policy is governed by the laws of India, including the Digital Personal Data Protection Act, 2023, the Digital Personal Data Protection Rules, 2025, and the Information Technology Act, 2000 and the rules made under it.