Privacy Policy

StudioWunder Technologies ("StudioWunder", "we", "us"), a business based in India, runs the StudioWunder photography marketplace. For the purposes of the Digital Personal Data Protection Act, 2023 ("DPDP Act"), we are the Data Fiduciary for the personal data described in this policy.

This policy also follows the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.

We process personal data only for clear, lawful purposes:

• To provide the service: creating and securing your account, processing orders, verifying payments, delivering downloads, and issuing licences and invoices.
• To pay photographers: calculating earnings, making payouts to your bank account or UPI ID, and deducting and reporting TDS.
• For safety and fraud prevention: spotting forged receipts, duplicate accounts, unauthorised downloads, chargeback abuse and security threats.
• To communicate with you: order and payment status updates, security alerts, support replies and important policy changes.
• To meet legal obligations: tax, accounting, anti-money-laundering, and responding to lawful requests from authorities.
• To improve the Platform: using aggregated and de-identified usage data to fix bugs and improve features.
• Marketing: only with your separate consent. You can unsubscribe at any time.

We do not sell your personal data, and we do not use it to make automated decisions that legally affect you.

We process your data based on your consent, which you give when you register or submit information, and on legitimate uses allowed under Section 7 of the DPDP Act. These include fulfilling a transaction you asked for and meeting legal obligations. You can withdraw consent at any time by contacting our support team. Withdrawal does not affect processing already carried out. We may need to close your account if we can no longer provide the service without the data.

We share personal data only as needed, and only with:

• Photographers: when you buy a photo, the photographer sees that a sale happened. They do not get your email, phone or payment details.
• Payment partners: our bank and any payment gateway, to process, verify and refund payments.
• Service providers: cloud hosting, file storage, email delivery and security providers. They act as Data Processors under written contracts that require confidentiality and security.
• Authorities: government, tax or law-enforcement agencies, when required by law or a valid legal process.
• Business transfers: a successor entity in a merger or acquisition, which must follow this policy.

Some providers may store data on servers outside India. Where this happens, we transfer data only to countries not restricted by the Government of India, and with appropriate safeguards.

We use industry-standard technical and organisational safeguards, including:

• HTTPS/TLS encryption for all data sent between your browser and our servers.
• Passwords stored only as salted one-way hashes. We cannot see your password.
• Short-lived access tokens with automatic refresh, and immediate sign-out of the session if a token is found to be invalid.
• Bank account numbers masked in the interface, and access to financial data and receipts limited to authorised staff on a need-to-know basis.
• Original, full-resolution photos stored privately and served only through time-limited, signed download links to verified buyers. Public previews are watermarked.
• Role-based access control, audit logging of admin actions, and regular security reviews.

No system is completely secure. If a personal data breach occurs, we will notify affected users and the Data Protection Board of India as required by the DPDP Act. Please use a strong, unique password and never share OTPs or login details with anyone, including people claiming to be from StudioWunder.

We use your browser's local storage to keep you signed in, by storing authentication tokens. We also use essential technical cookies needed for the site to work. These are strictly necessary and cannot be switched off. We do not currently use third-party advertising or cross-site tracking cookies. If we introduce analytics or marketing cookies in the future, we will update this policy and ask for your consent where required. Signing out clears your session tokens from the browser.

• Account data: while your account is active, and deleted or anonymised within 90 days after you close it, except as below.
• Orders, invoices, payment and payout records: up to 8 years, as required by Indian tax and accounting laws (including the Companies Act, 2013 and the GST Act).
• Payment receipts: for as long as the order and related tax records are kept, or as long as needed to settle a dispute.
• Licence records: kept for the life of the licence so we can confirm your right to use a photo if it is ever questioned.
• Security logs: at least 180 days, as required by CERT-In directions.

Under the DPDP Act you have the right to:

• Access: get a summary of the personal data we hold about you and how we process it.
• Correction and completion: fix inaccurate or incomplete data. You can update most details yourself on your Profile page.
• Erasure: ask us to delete your data, subject to the legal retention periods above.
• Withdraw consent at any time.
• Grievance redressal: raise a complaint with our Grievance Officer, and then with the Data Protection Board of India if it is not resolved.
• Nominate someone to exercise these rights for you in the event of your death or incapacity.

To use any of these rights, contact our support team from your registered email address. We may need to verify your identity first, and we will respond within 30 days.

The Platform is not meant for anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

We may update this policy as our services or the law change. We will post the updated version here with a new "Last updated" date. For material changes, we will notify you by email or in-app notice before they take effect.

As required by the IT Act, 2000 and the DPDP Act, 2023, StudioWunder Technologies has a designated Grievance Officer for privacy questions and complaints. Contact our support team, and your request will be passed to the Grievance Officer.

We acknowledge complaints within 48 hours and aim to resolve them within one month.