()initio.studio

// legal & compliance

Privacy Policy

Compliant with the India Digital Personal Data Protection Act (DPDP Act 2023), GDPR, and global data privacy standards.

Effective: October 11, 2026Last Updated: October 11, 2026Status: Active & Binding
Terms of ServicePrivacy PolicyAcceptable UseRefund & Cancellation
Our Privacy Commitment: InitioStudio designs software with security and privacy by design. We never sell, rent, or monetize personal data or student records for behavioral advertising.

1. Data Controller vs. Data Processor Roles

To understand your rights and our obligations, note our legal role based on how you interact with us:

We Act as Data Controller

When you interact with us directly: visitors to initiostudio.in, prospective clients submitting technical briefs, corporate contacts, billing entities, and registered direct account holders.

We Act as Data Processor

When processing data inside multi-tenant SaaS platforms (SAISYNC, student portals): our institutional client is the Data Controller. We process student records and portal data strictly on our client's legal instructions.

2. Categories of Data We Process

  • Direct Commercial Contacts: Name, work email, phone number, organization name, technical scoping briefs, and billing invoices.
  • Authentication & Security: Usernames, cryptographically salted password hashes (bcrypt/Argon2), and signed JWT access tokens.
  • Academic & Student Data (Tenant Systems): Student roll numbers, hall ticket codes, examination marks, analytical report grades, and watermarked PDF download stamps.
  • Mobile Client Telemetry (SaiSync): Device operating system, app version, network diagnostic logs, and Firebase Cloud Messaging (FCM) push registration tokens.
  • Messaging & Bot Metadata: Telegram chat identifiers (chat_id), notification timestamps, and message delivery statuses.

3. Educational Records & Document Watermarking

For academic portals utilizing our automated report engines and dynamic watermarking:

  • Watermarking Purpose: Dynamic document watermarks (containing roll numbers, download IP, and timestamps) are applied strictly for document authentication and fraud prevention.
  • Informational Status: Results displayed through our platforms are for immediate reference. Official university gazettes constitute the sole legal source of academic certification.
  • Zero Student Profiling: We never build advertising profiles or sell academic records to commercial data brokers.

4. Authorized Sub-Processors & Infrastructure

We work with trusted enterprise infrastructure providers to deliver our services:

Sub-ProcessorPurposeLocationSafeguard
Cloudflare, Inc.Edge CDN, DNS, DDoS DefenseGlobal / USASOC 2 Type II, SCCs
Google FirebasePush Notifications (FCM)USA / IndiaISO 27001, SOC 2
Hostinger / LiteSpeedProduction Server & DatabaseIndia / GlobalTier-III Data Centers
Telegram MessengerAlert Bot IntegrationGlobalTLS Transit Encryption

5. Information Security Architecture

Transit & Rest

Enforced HTTPS / TLS 1.3 across all endpoints. Salted password hashing for credentials.

SQLite WAL Mode

Write-Ahead Logging with strict file permissions (chmod 600) and automated backups.

Code Hardening

Directory traversal validation, XSS sanitization, and strict API token authorization.

6. Your Statutory Privacy Rights

Under the India DPDP Act 2023, GDPR, and applicable laws, you have the right to:

  • Right to Access: Request a copy of your personal data processed by us.
  • Right to Correction & Erasure: Request rectification of inaccurate data or deletion of records no longer required for legitimate business purposes.
  • Right of Grievance Redressal: Submit grievances directly to our Data Protection Officer.
Notice for Student End-Users: If your records are processed within an educational client portal, please submit your access or deletion request directly to your institution (the Data Controller). We will assist your institution in executing verified requests.

Legal & Regulatory Inquiries

For contract amendments, data processing addenda (DPA), grievance redressal under the India DPDP Act, or statutory notices, please contact our Legal Counsel at legal@initiostudio.in or reach our Data Protection Officer at dpo@initiostudio.in.

INITIO Studio · Hyderabad, Telangana, India · Standard Response SLA: 48 business hours