Privacy Policy

1. Identity of Data Fiduciary & Scope

This Privacy Policy explains how Kalidas Aneesh operating professionally as KALIUM ("Data Fiduciary", "we", "us") collects, processes, stores, and protects personal data from visitors and registered users of kalium.space, its associated Sound Vault, and digital services.

We are committed to operating in full compliance with the Digital Personal Data Protection Act, 2023 (DPDP Act, India), the General Data Protection Regulation (EU GDPR), and the California Consumer Privacy Act (CCPA/CPRA).

2. Categories of Personal Data Collected

We collect only the minimal data strictly necessary to provide our audio products and member services:

• Account & Identity Data: When you register for the Customer Vault or join our newsletter, we collect your name, email address, password hash (or passkey token), account role, and join date.
• Transaction & Order Data: When you purchase sound packs, reserve upcoming merchandise drops, or tip via Pay What You Want, transaction records (order IDs, currency amounts, timestamps, claimed download tokens) are stored. Payment card details and UPI PINs are processed directly by our payment partner Razorpay; we never store your payment card numbers or bank credentials.
• Technical & Telemetry Data: Standard server logs containing masked IP addresses, browser user-agent strings, referring URLs, and device types, collected by our CDN partner Cloudflare for cybersecurity, bot mitigation, and performance acceleration.
• Local Storage & Cookies: We utilize client-side localStorage to persist your active login session, claimed download history, audio player volume/scrub state, and audio audition preferences on your local browser.

3. Purpose & Lawful Grounds for Processing

We process your personal data under the following recognized legal bases:

• Performance of a Contract: To authenticate your account, maintain your Sound Vault access, generate secure file download links, and fulfill digital orders or merchandise reservations.
• Explicit Consent: To send you studio drops, new remix alerts, or newsletters when you explicitly opt in. You may withdraw consent at any time via the unsubscribe link or account settings.
• Legitimate Interests & Security: To prevent fraud, protect website infrastructure against DDoS attacks, and enforce our Terms of Service.
• Compliance with Legal Obligations: To retain tax and invoicing records required under Indian financial and commercial regulations.

4. Third-Party Processors & Data Security

We do not sell, rent, or trade your personal data to data brokers or advertising networks. We share data only with trusted infrastructure providers bound by strict confidentiality and data protection agreements:

• Razorpay Software Private Limited: RBI-licensed payment gateway handling card and UPI processing in compliance with PCI-DSS Level 1.
• Cloudflare, Inc.: Global CDN and DDoS security proxy safeguarding site traffic and providing encrypted HTTPS delivery.
• Cloudflare R2 / Backblaze B2: Secure cloud storage hosting 24-bit lossless WAV audio masters and deliverable download archives.

5. Your Rights as a Data Principal / Subject

Depending on your jurisdiction, you possess statutory legal rights concerning your personal data:

• Right to Access & Summary: You may request a summary of the personal data we hold about you.
• Right to Correction & Rectification: You may correct inaccurate or incomplete data directly in your Profile settings or by contacting us.
• Right to Erasure ("Right to Be Forgotten"): You may request complete deletion of your account and personal data from our servers.
• Right to Grievance Redressal (India DPDP Act): You have the right to register a grievance with our designated Grievance Officer, who is mandated to acknowledge and address your request.
• California CCPA Notice: We do NOT sell or share your personal information with third parties for cross-context behavioral advertising.

6. Children's Privacy (COPPA & DPDP Act)

Our website, digital storefront, and Sound Vault are designed for persons aged 18 and older. We do not knowingly collect or process personal data from children under the age of 18 without verifiable parental consent. If we discover that personal data of a minor has been collected without requisite authorization, we will expeditiously purge such information from our records.

7. Designated Grievance Officer & Contact

In accordance with the Indian Information Technology Act, 2000 and the DPDP Act, 2023, the details of our designated Grievance Officer are: