Privacy Policy

This Privacy Policy is published in accordance with the Digital Personal Data Protection Act, 2023 (DPDP Act), the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (SPDI Rules).

1. Data Fiduciary

SabilTech (Sole Proprietorship), India. Contact: privacy@sabilcorp.com.

2. Personal data we collect

• Photograph (selfie): uploaded by you to generate the passport photo. Treated as sensitive personal data.
• Email address: to send your download link and tax invoice.
• Payment metadata: Razorpay order ID, payment ID, amount, status. We never see or store your card / UPI credentials.

3. Purpose & legal basis

We process your data only to (a) generate the passport photo you requested, (b) collect payment, and (c) comply with tax law. Legal basis under the DPDP Act is your explicit consent, captured via the consent checkbox before upload.

4. Data retention & deletion

We follow a strict minimal-retention policy. All image data is ephemeral and only transaction metadata is kept for legal compliance.

4.1 Uploaded photographs

Your original selfie / upload is held in temporary memory only while the passport photo is being generated. It is permanently deleted immediately after processing — typically within seconds, and never retained beyond the active session.

4.2 Derived outputs (HD renders / prints)

The generated passport photo and print-ready file are stored in a private, access-controlled bucket solely so you can download them. They are automatically and irreversibly deleted within 10 minutes of generation, regardless of whether you downloaded them. If you need the file again, you must re-upload and regenerate.

4.3 Order & billing records

Non-image metadata — Razorpay order ID, payment ID, amount, email address, consent timestamp and tax invoice details — is retained for 8 years as required under the Central Goods and Services Tax (CGST) Rules, 2017. This record contains no photograph bytes.

4.4 Consent evidence

A timestamped log of your explicit consent (the exact moment you ticked the consent checkbox) is stored alongside your order record as proof of lawful processing under the DPDP Act. No image data is included in this log.

4.5 AI model training

We do not use your photograph or derived output to train, fine-tune, or improve any AI model. Images are processed solely for your single requested generation.

5. Data processors / third parties

• Razorpay Software Pvt Ltd (India) — payment processing.
• Lovable Cloud — application hosting and ephemeral storage.
• Lovable AI Gateway / Google Gemini — image editing inference. Image is processed in transit and not retained by the provider for training.

6. Your rights under the DPDP Act

You have the right to access, correct, update or erase your personal data, withdraw consent, nominate a person to exercise your rights, and to grievance redressal. Submit a request via our Data Rights Request form or email privacy@sabilcorp.com. We respond within 30 days.

We store a timestamped record of your consent (the moment you ticked the consent box before upload) as evidence of lawful processing under the DPDP Act. No image bytes are kept — only the consent timestamp and order metadata.

7. Security measures

We implement technical and organisational safeguards to protect your personal data in line with the SPDI Rules and the DPDP Act.

7.1 Encryption in transit

All data — including your photograph upload, payment session, and download — is transmitted over HTTPS using TLS 1.2 or higher. This prevents interception while data moves between your device and our servers.

7.2 Encryption at rest

Generated HD renders are stored in a private, encrypted object-storage bucket (server-side encryption). Access is restricted to authenticated service credentials only. Original uploads never touch durable storage.

7.3 Access controls

We enforce strict need-to-know access:

• Image data: No human operator can browse uploaded photographs or outputs. Processing is fully automated.
• Order records: Access to billing metadata is limited to the sole proprietor and is used only for tax compliance and customer support.
• Infrastructure: Cloud hosting credentials and API keys are stored as encrypted secrets, not in source code.

7.4 Retention limits

We retain image data for the shortest time technically necessary. Uploaded photographs are deleted immediately after processing; outputs are auto-purged within 10 minutes. Only non-image order and billing metadata is retained long-term (8 years for GST compliance). See section 4 for full retention details.

7.5 Payment data

We do not collect or store your card numbers, UPI PINs, or net-banking credentials. Payment data is handled directly by Razorpay under PCI-DSS compliant infrastructure. We receive only an anonymised order ID, payment ID, amount, and status.

8. Data breach notification

In the unlikely event of a personal data breach, we will notify the Data Protection Board of Indiaand affected users as required under the DPDP Act, 2023.

• Timeline: The Board is notified without delay and no later than the statutory deadline. Affected users are notified as soon as practicable thereafter.
• How you are notified: We will contact you at the email address associated with your order.
• What we tell you: The nature of the breach, the personal data involved, the likely consequences, and the measures we have taken or plan to take to mitigate harm.
• No image exposure risk: Because your uploaded photograph is deleted immediately after processing and the output is auto-purged within 10 minutes, image data is not present in our systems for a prolonged period and therefore is at negligible risk of exposure in a breach.

9. Children

Our service is intended for users aged 18 and above. We do not knowingly process the personal data of children without verifiable parental consent.

10. Grievance Officer (DPDP Act & SPDI Rules)

Name: Abdul Wazeed
Email: privacy@sabilcorp.com
Phone: +91-7981261228
Response SLA: acknowledgement within 48 hours, resolution within 30 days.

11. Changes

We may update this policy. Material changes will be highlighted on this page with a new "Last updated" date.