Privacy Policy & Personal Data Notice

1. Introduction & Scope

Welcome to Athulya Model (accessible at https://athulyamodel.in/). We respect your personal privacy and are committed to safeguarding the digital personal data of all visitors, clients, and partners.

This Privacy Policy explains how we collect, process, store, protect, and delete personal data in strict alignment with India's Digital Personal Data Protection Act, 2023 (DPDP Act) and applicable rules issued thereunder.

2. Data Fiduciary Identity & Contact

For the purposes of the DPDP Act 2023, the Data Fiduciary determining the purpose and means of processing personal data on this website is:

• Name / Professional Identity: Athulya (Freelance Fashion Model, Video Editor & Graphic Designer)
• Principal Place of Practice: Kozhikode (Calicut), Kerala, India
• Designated Privacy Contact: athulyaweb@gmail.com
• Official Website: https://athulyamodel.in/

3. Personal Data Collected

In adherence to the principle of Data Minimization (Section 6(1) of the DPDP Act), we only collect the minimum personal data strictly necessary to fulfill your requested creative, modeling, video editing, or graphic design bookings.

We do not collect sensitive biometric data, financial bank card numbers, or passwords from general website visitors.

4. How Data is Collected

We collect personal data directly from you through the following touchpoints:

• Direct Website Booking Modal: When you complete and submit our "Book a Service" enquiry form.
• Interactive Assistant ("Rukku"): When you voluntarily share your contact and project details to request a booking via the automated chat interface.
• Direct Inquiries: When you email us directly at our official email address.

5. Lawful Purpose of Processing

Under Section 4 and Section 6 of the DPDP Act 2023, personal data is processed solely for specified, lawful purposes for which you have provided explicit consent:

• Responding to your project queries, quotation requests, and commercial inquiries.
• Scheduling, coordinating, and executing modeling photoshoots, video post-production, or graphic design projects.
• Sending transactional booking status notifications (approvals, schedules, rejections).
• Complying with applicable legal, accounting, and tax obligations under Indian law.

6. Explicit Consent & Consent Recording

In compliance with Section 6 of the DPDP Act 2023:

• Affirmative Action Required: Our booking form requires an active, unchecked consent checkbox before any form submission can proceed. We never use pre-ticked consent boxes.
• Itemized Notice: Prior to consenting, you are presented with a clear notice of the data collected, purpose, and a direct link to this Privacy Policy.
• Consent Logging: When a booking is submitted, our server automatically records the exact server timestamp (`consent_timestamp`), affirmative status (`consent_given = 1`), and the specific Privacy Policy version (`1.0-2026-09`) to maintain an immutable record of consent.

7. Booking & Enquiry Workflow

Booking submissions are stored securely in our encrypted Cloudflare D1 SQLite database located in secure edge data centers. Submissions trigger an encrypted administrative alert via our transactional email processor (Brevo) so we can respond promptly to your request.

8. Interactive AI Assistant ("Rukku") Privacy

Our website features an interactive assistant ("Rukku") designed to help answer basic queries regarding services, pricing estimates, and portfolio links.

• Ephemeral In-Memory Processing: Chat inquiries are processed in temporary Worker memory. We do not persist general conversation chat logs into the database.
• No Model Retraining: Inquiries are not used to train public generative foundation models.
• Booking Flow: Only when you explicitly complete a booking through the assistant are the final booking fields submitted to our database.
• Notice: Visitors are reminded not to share sensitive personal secrets, medical, or financial details in the chat window.

9. Cookies & Tracking Technologies

We believe in privacy by default. We do not use invasive third-party advertising cookies, behavioral tracker scripts, Google Tag Manager, or Meta Pixels on this website.

• No Advertising Cookies: We do not track you across other websites or display targeted cross-site advertisements.
• Essential Admin Session Cookies: We only use an encrypted, secure session cookie for authorized administrative logins to `admin.html`. General visitors do not receive this cookie.
• Local Storage: Browser `localStorage` is used solely to cache public non-personal content (such as blog summaries and public social links) to reduce server requests and improve page loading performance.
• Cloudflare Web Analytics: We utilize Cloudflare's privacy-first web analytics, which measures high-level aggregate traffic metrics (e.g., page views, country distribution) without using client cookies or fingerprinting individual visitors.

10. Third-Party Data Processors

To deliver our website and services, we engage reputable technical service providers acting under strict confidentiality and security standards:

• Cloudflare Inc. (USA / Global Edge): Web hosting, content delivery network (CDN), serverless edge compute (Cloudflare Workers), and D1 database storage. Data transmitted via HTTPS with TLS 1.3 encryption.
• Brevo (Sendinblue SAS, France): Transactional email delivery service used to transmit booking confirmation notifications and privacy request alerts.
• Google Fonts (Google LLC): Static font file delivery (`fonts.gstatic.com`) for typography rendering.
• YouTube (Google LLC): Embedded video player for showcasing portfolio reels. Subject to YouTube's standard privacy terms.

We never sell, rent, monetize, or trade your personal data to data brokers or advertising networks.

11. Data Retention & Automatic 30-Day Deletion

In accordance with Section 8(7) of the DPDP Act 2023, personal data must not be retained once the purpose for which it was collected has been served.

• Default 30-Day Retention Period: Personal booking data collected through enquiries is retained for a default period of thirty (30) days.
• Automated Server-Side Cleanup: We operate an automated scheduled cleanup job that executes once every 24 hours. The job automatically deletes personal data from bookings that are older than 30 days and have been resolved (completed, rejected, or expired).
• Retention Exceptions: Data may be retained beyond 30 days only where an active, documented legal exception applies — such as an ongoing multi-month client shoot contract, open invoicing/tax compliance requirement, or active dispute resolution. All exceptions are individually documented with a legitimate reason.
• Zero Personal Data in Cleanup Logs: Our system audit log records only the count of cleaned records and execution timestamp. No names, emails, or personal identifiers are retained in audit records.

12. Technical & Operational Security Measures

We implement comprehensive security safeguards aligned with Section 8(5) of the DPDP Act:

• Transport Layer Security: All data in transit is encrypted using modern TLS 1.3 / HTTPS encryption.
• SQL Injection Protection: All database queries utilize parameterized prepared statements, preventing SQL injection vulnerabilities.
• Strict Authentication: Administrative access is protected by cryptographically salted bcrypt password hashes and signed JWT session tokens with instant revocation capabilities.
• Defense Headers: Strict HTTP headers including `X-Content-Type-Options: nosniff`, `X-Frame-Options: SAMEORIGIN`, and restrictive referrer policies.

13. Children's Personal Data

In accordance with Section 9 of the DPDP Act 2023:

• This website and our commercial modeling, video editing, and graphic design services are directed to individuals who are at least 18 years of age (or the legal age of majority under Indian law).
• We do not knowingly collect personal data from children under the age of 18 without verifiable parental or legal guardian consent.
• If we learn that personal data of a minor has been submitted without verifiable guardian consent, we will promptly delete such information.

14. Your Rights as a Data Principal

Under Chapter III (Sections 11 to 14) of the DPDP Act 2023, you enjoy the following statutory rights:

• Right to Access Information (Section 11): Right to obtain a summary of personal data being processed, processing activities undertaken, and identities of data fiduciaries/processors with whom data has been shared.
• Right to Correction & Completion (Section 12): Right to request correction of inaccurate personal data, completion of incomplete data, and updating of records.
• Right to Erasure (Section 12): Right to request erasure of your personal data when it is no longer required for the purpose for which it was collected.
• Right of Grievance Redressal (Section 13): Right to have your privacy grievances readily redressed through an accessible grievance redressal mechanism.
• Right to Nominate (Section 14): Right to nominate another individual who shall exercise your rights in the event of death or incapacity.
• Right to Withdraw Consent (Section 6(4)): Right to withdraw consent at any time with the same ease as providing consent.

To exercise any of these rights, you may submit a request through our dedicated Privacy Requests Portal without creating an account.

15. Grievance Redressal Mechanism

If you have any questions, concerns, complaints, or grievances regarding the processing of your personal data or wish to exercise your statutory rights, please contact our designated Privacy & Grievance Redressal Officer:

• Designated Officer: Athulya (Privacy Officer)
• Email: athulyaweb@gmail.com
• Self-Service Request Portal: https://athulyamodel.in/privacy-requests
• Response Timeline: We strive to acknowledge privacy requests within 48 hours and resolve all verified requests within thirty (30) days in accordance with the DPDP Act.
• Escalation to DPBI: If you are not satisfied with the resolution of your grievance, you have the right to register a complaint with the Data Protection Board of India (DPBI) in the manner prescribed under the DPDP Act.

16. Changes to this Policy

We may update this Privacy Policy periodically to reflect changes in legal requirements, technology practices, or operational procedures. When updates occur, the "Effective Date" and "Version" at the top of this document will be updated accordingly. We encourage you to review this policy periodically.

17. Contact Information

For any queries regarding this Privacy Policy or our personal data practices, please reach out to us at:

Athulya Model & Creative Studio
Kozhikode (Calicut), Kerala, India
Email: athulyaweb@gmail.com
Instagram: @a.thu.lya