Privacy Policy

Last updated: October 2026

This Privacy Policy explains how Firuz Al Amin Gafarullah, professionally known as "Romen" and trading as CultureVault ("we", "us"), collects and uses personal data. We process personal data in accordance with the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000.

1. DATA WE COLLECT

- Purchase details: full legal name, artist name, email address, the item and licence type purchased, price, receipt number and Razorpay payment and order identifiers.

- Consent record: the time, IP address, device and browser information, and the version of the documents you accepted.

- Activity on Private Links: when a link is opened, which Beats are played, checkout attempts, payment outcomes and downloads, with IP address and device information.

- Administrator account data for the site owner only.

We do not collect or store your card, UPI or bank details. Those are handled by Razorpay.

2. WHY WE USE IT

- To process your payment, issue your receipt and Lease Agreement and deliver your files.

- To keep a legal record that you accepted the agreements.

- To protect unreleased work: activity on a Private Link is tied to the recipient it was issued to so that leaks can be investigated.

- To prevent fraud and misuse, and to meet our legal and accounting obligations.

We process this data on the basis of your consent and, where the law permits, for these legitimate purposes.

3. WHO WE SHARE IT WITH

We use these service providers to run CultureVault, and they process data only for that purpose: Razorpay (payments), Resend (email delivery), Cloudflare R2 (file storage) and MongoDB (database hosting). We do not sell your personal data. We disclose data where required by law or a competent authority.

4. HOW LONG WE KEEP IT

We keep purchase, consent and licence records for as long as needed to enforce your Licence and to meet accounting and legal requirements. Activity logs are kept for as long as needed to investigate misuse. Afterwards the data is deleted or anonymised.

5. SECURITY

Files are stored in a private bucket and are never exposed by public URL. Access uses short-lived signed tokens, administrator access is protected by hashed credentials and rate limiting, and traffic is encrypted in transit. No system is completely secure, but we take reasonable safeguards.

6. COOKIES AND LOCAL STORAGE

We use only essential storage: a theme preference in your browser and, for administrators, a secure session cookie. We do not use advertising or tracking cookies.

7. YOUR RIGHTS

You may ask us to give you a summary of the personal data we hold, to correct inaccurate data, to erase data that we are not required to keep, and to withdraw consent. Withdrawing consent does not affect processing that already took place and may mean we cannot continue a Licence that depends on that data. You may also nominate another person to exercise your rights if you die or become incapacitated.

8. CHILDREN

CultureVault is not intended for anyone under 18. We do not knowingly collect data from children.

9. GRIEVANCES

To exercise a right or raise a concern, reply to the email that carried your receipt. We will acknowledge your request promptly and aim to resolve it within 30 days. If you are not satisfied you may approach the Data Protection Board of India.

10. CHANGES

We may update this policy and will show the date of the latest update at the top.