Privacy Policy

AUX STUDIO ("we", "us", "our") is an independent digital technology and software engineering studio established in Alipurduar, West Bengal, India. We engineer bespoke web applications, enterprise business systems, custom invoicing solutions, and tailored artificial intelligence integrations.

This Privacy Policy applies to personal data and technical information collected through:

• Our website located at aux-studio.vercel.app and associated digital properties;
• Inquiries submitted through our project request, quotation, and contact forms;
• Our client appointment scheduling and consultation systems;
• Recruitment and talent application forms;
• Our public engineering blog and client review platforms;
• Client portals, staging environments, and custom software systems developed by AUX STUDIO.

By visiting our website or submitting your information to us, you acknowledge that your data will be handled in accordance with the terms set forth in this policy.

We process personal data only where a lawful basis exists under India's Digital Personal Data Protection Act, 2023 (DPDP Act) and the EU GDPR.

Consent Your agreement, given when you submit an inquiry, comment on a post, or opt in to updates.

Contractual Necessity Processing required to deliver a service you have engaged us for, or to take steps toward an agreement you have requested.

Legitimate Interests Our legitimate interest in operating a secure, functional business, balanced against your rights and expectations.

Legal Obligations Compliance with laws that require us to retain or disclose certain records, including tax and accounting rules.

We collect information in three ways: directly from you, automatically through your device, and via authorized third-party tools.

A. Information You Provide Voluntarily - Project Inquiries: Name, professional email address, phone number, organization name, requested service, estimated budget, timeline, and architectural requirements. - Appointment Bookings: Name, email address, chosen meeting date and time slot for Google Meet consultations. - Client Invoicing & Billing: Business legal name, GSTIN (for Indian clients), billing address, and authorized contact information. We do not store full credit card numbers; payment processing is handled through secure regulated gateways. - Job Applications: Name, contact details, curriculum vitae (CV), portfolio links, and employment background. - Blog Comments & Reviews: Author display name, rating, and written testimonial. We do not require or publish your email address when posting a blog comment.

B. Automatically Collected Technical Information When you browse our platform, our edge servers and diagnostic infrastructure automatically record: - Truncated or anonymized IP address; - Device classification, operating system, and browser version; - Referring URL and navigation paths on our site; - Timestamp of requests and basic performance latency metrics; - Error logs and crash diagnostic reports.

AUX STUDIO integrates advanced Large Language Models (LLMs) and automated workflows for client systems. We strictly enforce zero-retention and non-training policies across all commercial AI integrations.

When you utilize our AI solutions or when we build custom intelligence into your applications: - No Training on Your Proprietary Data: We do not submit confidential client data, source codebases, or customer personally identifiable information (PII) to train public foundational models. - Enterprise API Configurations: Production AI integrations are routed through enterprise-grade endpoints with zero-retention data processing agreements wherever available. - Tenant-Isolated Vector Stores: Where we build retrieval-augmented generation (RAG) features, embeddings and indexes are provisioned in isolated database instances dedicated to your project. - Human Oversight: Automated outputs are treated as drafts subject to human review before anything material is executed or published.

We process collected data exclusively for explicit, legitimate business operations: - Providing our services: designing, building and supporting the software and systems you engage us for. - Communication: responding to inquiries, scheduling calls, and sending service-related notices. - Billing & Compliance: issuing invoices, processing payments, and meeting tax and accounting obligations. - Security & Fraud Prevention: protecting against abuse, spam and unauthorized access. - Service Improvement: understanding aggregate usage to improve reliability and performance. - Legal Obligations: complying with lawful requests and applicable regulations. - Marketing (with consent): sending updates you have opted in to, which you may withdraw at any time.

We use a small number of cookies and similar storage technologies. Strictly necessary cookies support authentication and security. Preference storage remembers interface choices such as theme. Pseudonymous tokens support blog interactions without identifying you.

Analytics and advertising cookies, where present, are configured to minimize data collection and are described in our Cookie Policy. You can control or disable cookies through your browser settings.

We rely on vetted service providers to operate our platform, including cloud hosting, database, authentication, email delivery and payment processing providers. These processors act on our instructions and are bound by their own data processing terms.

We do not sell your personal data. We share it only as necessary to deliver our services, comply with the law, or protect our rights.

We implement robust technical and organizational safeguards designed to protect personal data against accidental loss, unauthorized access, destruction, or disclosure: - Cryptographic Standards: Transport Layer Security (TLS 1.3) with HSTS for all web traffic; AES-256 encryption at rest for databases and storage buckets; - Principle of Least Privilege: Administrative access to production databases and CRM systems is restricted to authorized studio personnel via multi-factor authentication (MFA); - Continuous Dependency Auditing: Automated vulnerability scanning of software dependencies via automated CI pipelines; - Backup Resiliency: Point-in-time recovery (PITR) and encrypted off-site replication to prevent data loss.

While AUX STUDIO is based in India, our cloud infrastructure relies on globally distributed networks (such as Vercel Edge points of presence and Neon cloud regions in the United States, Europe, and Asia).

Where personal data is transferred internationally, we verify that appropriate cross-border transfer mechanisms are in effect, including Standard Contractual Clauses (SCCs) approved by the European Commission, and adherence to the cross-border guidelines established under the Indian DPDP Act.

We store personal data only as long as necessary to satisfy the purposes for which it was gathered: - Contact Inquiries: Retained in our CRM for up to 24 months to facilitate follow-up discussions, after which they are purged unless converted into an ongoing client agreement. - Active Client Records & Invoices: Retained for the duration of the engagement plus 7 years to satisfy Indian tax, accounting, and GST statutory compliance. - Blog Visitor Identifiers: The pseudonymous identifier cookie automatically expires after 12 months unless renewed by return visits. - Recruitment Submissions: Retained for 12 months for prospective staffing opportunities, unless the applicant requests prompt deletion.

Regardless of your jurisdiction, AUX STUDIO guarantees you comprehensive rights over your personal data:

Right to Access & Confirmation Request a complete summary of the personal information AUX STUDIO holds about you and details of how it has been processed.

Right to Correction & Updating Request correction or completion of inaccurate, outdated, or incomplete personal data without undue delay.

Right to Erasure ("Right to be Forgotten") Request permanent deletion of your data when it is no longer necessary for the purpose it was gathered, subject to statutory retention laws.

Right of Grievance Redressal & Nomination Under the Indian DPDP Act, nominate an individual to exercise your rights in case of death or incapacity, and access our Grievance Officer.

AUX STUDIO provides professional commercial web development and software engineering services. Our services are directed strictly to businesses and adults aged eighteen (18) and older.

We do not knowingly solicit or collect personal information from individuals under the age of 18. If you believe that a minor has provided us with personal information, please contact us immediately so we can promptly delete the data from our databases.

Our public engineering blog is designed to be readable without tracking you as an individual. When you interact with a post: - A pseudonymous, randomly generated identifier may be stored in a secure cookie to prevent duplicate view or like counts. - The identifier is not linked to your name, email address, or any account. - Analytics are aggregated and used only to understand which posts are read. Clearing your browser cookies resets the identifier.

In the course of delivering custom software, AI integrations, or invoice management systems, clients often share proprietary business data, API tokens, staging credentials, and trade secrets with AUX STUDIO.

We treat all such client materials under strict non-disclosure standards. Proprietary client source code and databases are maintained in isolated repositories, encrypted environments, and are never disclosed, sublicensed, or utilized for unauthorized third-party projects.

In accordance with India's Information Technology Act, 2000, the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, and the Digital Personal Data Protection Act, 2023, the details of our designated Grievance Officer are provided below:

• Designated Entity: AUX STUDIO (Data Protection & Grievance Desk)
• Attn: Data Protection & Grievance Officer
• Acknowledgment is issued within 48 business hours; formal redressal is completed within 30 days of receipt.

As digital technologies, regulatory mandates, and our studio services evolve, we may revise this Privacy Policy.

Any revisions will be immediately posted on this page with an updated "Last Updated" timestamp. For material adjustments impacting how client data is handled, we will provide prominent notification on our website or communicate directly via email with registered clients.