Privacy Policy

Last updated: 19 August 2026

1. Introduction

cStudios ("Company", "we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, share and protect your information when you use our website, APIs and related services ("Services").

This policy is compliant with the Digital Personal Data Protection Act, 2023 (DPDPA), the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.

2. Information We Collect

a) Information You Provide

  • Name, email address and phone number (when requesting an API key)
  • Business name and use-case description (when requesting enterprise plans)
  • Payment information (processed by third-party payment gateways)

b) Information Collected Automatically

  • API usage data — request timestamps, endpoints called, query parameters, response codes and response times
  • Website analytics — IP address, browser type, device type, pages visited and referral source
  • Server logs — technical data necessary for security monitoring and debugging

c) Data Processed Via APIs

When you make API requests, you send us query parameters (e.g., vehicle numbers, UPI IDs, PAN numbers, GSTIN, phone numbers). We process these parameters solely to fetch data from upstream sources and return the result to you. We do not store the query parameters or response data beyond what is necessary for request logging (typically 30 days) for debugging and abuse prevention.

3. How We Use Your Information

  • To provide, maintain and improve the Services
  • To process payments and manage your subscription
  • To communicate with you about your account, API key or support requests
  • To monitor API usage for rate limiting, quota enforcement and abuse prevention
  • To comply with legal obligations under Indian law
  • To detect and prevent fraud, security incidents and illegal activity

4. Data Sharing & Disclosure

We do not sell your personal data to third parties. We may share data only in these circumstances:

  • Payment processors: Payment data is shared with third-party gateways (e.g., Razorpay, Stripe) solely for transaction processing. We do not store your card details.
  • Legal compliance: We may disclose information if required by law, court order, government authority or to protect our rights or safety.
  • Service providers: Trusted hosting and infrastructure providers (e.g., cloud hosting, CDN) that process data on our behalf under strict confidentiality agreements.

5. Data Retention

  • Account information is retained for as long as your account is active, plus 12 months after deletion for legal and compliance purposes.
  • API request logs (query parameters, response metadata) are retained for up to 30 days and then permanently deleted.
  • Payment records are retained for 7 years as required by Indian tax and accounting regulations.

6. Data Security

We implement reasonable security practices and procedures as required under the IT Act, 2000, including:

  • HTTPS/TLS encryption for all API and website traffic
  • API key authentication on all endpoints
  • Regular security audits and vulnerability assessments
  • Access controls limiting employee access to personal data

While we take reasonable precautions, no method of transmission or storage is 100% secure. We cannot guarantee absolute security.

7. Your Rights (Under DPDPA 2023)

As a data principal under the Digital Personal Data Protection Act, 2023, you have the right to:

  • Access: Request a summary of your personal data being processed
  • Correction: Request correction of inaccurate or incomplete personal data
  • Erasure: Request deletion of your personal data (subject to legal retention requirements)
  • Grievance redressal: File a complaint with our Grievance Officer or with the Data Protection Board of India

To exercise any of these rights, contact us at contact@cstudio.sbs. We will respond within 30 days.

8. Cookies & Tracking

Our website may use essential cookies for session management. We do not use third-party advertising trackers. If we use analytics services (e.g., Google Analytics), data is anonymised and used solely for improving the user experience.

9. Children's Privacy

Our Services are not intended for individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor has provided us with data, contact us immediately.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. Continued use of the Services after changes constitutes acceptance.

11. Grievance Officer

In accordance with the IT Act 2000 and DPDPA 2023, you may contact our Grievance Officer for any privacy-related concerns:

We will acknowledge your grievance within 48 hours and resolve it within 30 days.