Privacy Policy

1. Information We Collect

1.1 Personal Information

• Name, email address, phone number
• Address and postal code
• Payment information (processed via Razorpay — see Section 3)
• For contributors: bank account details, tax identification numbers

1.2 Image Metadata (EXIF)

When you upload images, we extract and store EXIF metadata including:

• Camera model, lens information
• GPS coordinates (if present — contributors can remove this)
• ISO, aperture, shutter speed, focal length
• Date and time image was taken

EXIF data is visible to buyers and aids in search indexing. You may request removal of specific EXIF tags.

1.3 Payment Information

Payment details (credit card, UPI, bank transfer) are processed directly by Razorpay. We do not store full payment card details. Sensitive financial information stored in our database (such as encrypted payout account numbers) is encrypted using AES-256-GCM.

1.4 Usage Data

• Download history and license type purchased
• Search queries and browse history
• Device type, browser, IP address
• Page access times and duration

2. How We Use Your Data

• Account Management: Create and manage your account, send transactional emails
• Payment Processing: Process credit purchases and payouts
• Service Improvement: Analyze usage patterns to improve the Platform
• Legal Compliance: Comply with tax obligations and law enforcement requests
• Moderation: Review uploaded images for compliance with acceptable use policy
• Marketing: Send optional newsletters and promotional updates (with your consent)

3. Razorpay as Payment Processor

Razorpay Payments India Pvt Ltd is our primary payment processor. Your payment information is subject to Razorpay's Privacy Policy. We do not store full card details or UPI identifiers.

4. Data Encryption

Sensitive financial data stored in our database (contributor payout account numbers, PAN numbers) is encrypted using AES-256-GCM encryption with a cryptographically random 32-byte key. Encryption keys are stored separately in secure environment variables and never committed to version control.

5. Data Retention

We retain your data for as long as necessary to provide services and comply with legal obligations:

• Account data: Retained for 3 years after account deletion (for tax/audit purposes)
• Payment records: Retained for 7 years (GST compliance, India)
• Download logs: Retained for 1 year (license re-download verification)
• Uploaded images: Retained until withdrawn by contributor or Platform removal

6. Your Rights Under PDPB (India)

If you are an Indian resident, you have the following rights under the Digital Personal Data Protection Act:

• Right to Access: Request a copy of your personal data
• Right to Correction: Request correction of inaccurate data
• Right to Erasure: Request deletion of your data (subject to legal retention requirements)
• Right to Data Portability: Request your data in a structured, portable format
• Right to Grievance Redressal: File a complaint with our Data Protection Officer

Submit requests to legal@rewaimages.com with "Data Request" in the subject line. We will respond within 30 days.

7. Your Rights Under GDPR (EU Residents)

If you are located in the European Union, you have rights including:

• Right to access, rectify, erase personal data
• Right to data portability and withdrawal of consent
• Right to lodge a complaint with your local data protection authority

8. Cookies and Tracking

We use cookies and similar tracking technologies to:

• Maintain session state and authentication
• Remember your cart contents
• Analyze Platform usage (optional analytics — you may opt out)

You may disable cookies in your browser settings. However, some Platform features may not function properly without them.

9. Third-Party Services

The Platform integrates with:

• Razorpay: Payment processing
• Cloudflare R2: Image storage and CDN
• Typesense: Search functionality

Each service has its own privacy policy. We only share the minimum data required for their services.

10. Security

We implement industry-standard security measures:

• HTTPS/TLS encryption for all data in transit
• AES-256-GCM encryption for sensitive data at rest
• Secure authentication using OTP-based login (no passwords stored)
• Regular security audits and vulnerability assessments
• Restricted access to sensitive data (least privilege principle)

However, no security system is 100% secure. Please report any security vulnerabilities to legal@rewaimages.com.

11. Children's Privacy

The Platform is not intended for users under 18 years of age. We do not knowingly collect data from minors. If we become aware of such collection, we will delete the data immediately.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email or by posting the updated policy on the Platform with a new "last updated" date.

13. Contact Us

For privacy questions, data subject requests, or to report a privacy violation:

Data Protection Officer / Privacy Contact:
Email: legal@rewaimages.com
Address: A 171, Shivalik A Block, New Delhi 110016, India

Legal Entity

Company: Artivism Collaborations Pvt Ltd
Director: Joe Thomas Athialy