Privacy Policy & Data Protection Charter

1. Introduction & Data Fiduciary Notice

This Privacy Policy and Data Protection Charter governs the collection, processing, storage, and transfer of digital personal data across the Interiors Express platform (accessible via interiorsexpress.biz, its subdomains, Progressive Web App (PWA), and authenticated API / MCP endpoints).

For the purposes of the Digital Personal Data Protection Act, 2023 (DPDP Act 2023) and the Information Technology Act, 2000 (read with the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011), the entity determining the purpose and means of processing your personal data (the "Data Fiduciary") is:

2. Lawful Grounds of Processing (DPDP Act §6 & §7)

Interiors Express processes personal data strictly on lawful, transparent, and clearly defined grounds:

• Consent (Section 6, DPDP Act 2023): You provide clear, affirmative, specific, and informed consent at the time of registering an account, requesting a project Bill of Quantities (BoQ), booking a 4-hour city swatch sample box, or claiming an architect/vendor profile.
• Certain Legitimate Uses (Section 7, DPDP Act 2023): Processing necessary for fulfilling statutory compliance (GSTIN, Council of Architecture (COA) credentials, RERA verifications), preventing fraudulent transactions or bot attacks, executing voluntary contractual briefs, or complying with orders under Indian law.

3. Personal & Professional Data Collected

Because Interiors Express is a specialised B2B ecosystem for architecture, design, and interior infrastructure, data collection is limited to professional and operational necessity:

4. Specific Purposes of Data Processing

We process your personal and studio data solely for the following designated operational functions:

1. Administering the Unified Single Sign-On (SSO) Gate and managing multi-seat studio hierarchies (Principal Architect, BIM Manager, QS Drafter).
2. Enabling the Dual-Mode Switcher between Buyer / Specifier Mode and Supplier Mode without credential leakage.
3. Powering the deterministic KIRAN + Jev (SystemOne) Studio Concierge to calculate material square footage wastage and BoQ line items.
4. Coordinating 360° showroom walkthrough visits across 38 city clusters and dispatching verified 4-hour physical swatch boxes.
5. Processing tri-party milestone escrows and managing HP Z-Series workstation trial deployments.

5. Double-Blind PII Masking & Anti-Spam Guarantee

6. Data Storage, Vaults & Cross-Border Transfers

All structured platform databases (PostgreSQL / Supabase instances) and session states are hosted within sovereign or DPDP-compliant Tier-4 enterprise infrastructure.

High-resolution media, CAD shop drawings, and manufacturer PDF catalogues are preserved in Zero-Egress Private Cloudflare R2 Media Vaults. We do not transfer your personal data to foreign jurisdictions that have been restricted by the Central Government of India under Section 16 of the DPDP Act 2023.

7. Technical Security Safeguards (§8(5) DPDP Act)

Interiors Express implements rigorous administrative, physical, and technological safeguards:

• Zero Google Telemetry: All platform typography and web fonts are 100% self-hosted locally within the platform to prevent third-party telemetry harvesting.
• PostgreSQL Row-Level Security (RLS): Unauthenticated public crawlers can only query published directory listings. Private studio drafts and tax filings are shielded behind cryptographic JWT gates.
• Forensic Steganography: High-resolution drawings and preview visualizers are embedded with user-session watermarks to trace design theft.
• Client-Side Anti-Theft Shield: Right-click image saving, drag-to-desktop, and unauthorized iframe framing are blocked at the DOM layer via ie-security-shield.js.

8. Statutory Rights of the Data Principal

Under Chapter III of the DPDP Act, 2023, every registered user, architect, and vendor possesses the following enforceable statutory rights:

• Right to Access Information (Section 11): You may request a complete summary of your personal data processed by Interiors Express and the identities of any data processors involved.
• Right to Correction & Erasure (Section 12): You may request correction of inaccurate or misleading data, completion of incomplete data, or total erasure of data no longer necessary for the original purpose.
• Right of Grievance Redressal (Section 13): You have the right to accessible, transparent redressal of any privacy grievances within statutory timeframes.
• Right to Nominate (Section 14): You have the right to designate a nominee to exercise your data rights in the event of death or permanent incapacity.
• Right to Withdraw Consent: You may withdraw your consent at any time via your Studio Settings or by emailing support@interiorsexpress.biz.

9. Data Retention & Erasure Schedules

Personal data is retained only for the duration necessary to satisfy the operational purposes outlined herein:

• Active studio accounts and vendor listings are retained while the subscription or verified listing remains in good standing.
• Financial escrow records, tax invoices, and statutory transaction logs are retained for 8 (eight) years to comply with the Indian Goods and Services Tax (GST) Act and the Companies Act, 2013.
• Upon receipt of a verified erasure request or voluntary account deletion, personal identifiers are purged from active production caches within 30 days.

10. Breach Notification & Incident Protocols

In the event of any personal data security incident affecting user confidentiality, Interiors Express will promptly notify the Data Protection Board of India (DPBI) and affected Data Principals in the form and manner stipulated under Section 8(6) of the DPDP Act 2023.

11. Children & Age Restrictions (§9 DPDP Act)

Interiors Express is strictly a professional Business-to-Business (B2B) ecosystem for licensed architecture and design practitioners, registered vendors, and commercial contractors. We do not knowingly process personal data belonging to individuals under the age of 18 (eighteen) years, nor do we undertake behavioural tracking or targeted advertising directed at minors.

12. Statutory Grievance Redressal Officer

Pursuant to Section 13 of the DPDP Act 2023 and Rule 3(2) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, the designated officer responsible for privacy inquiries, consent withdrawals, and statutory grievances is: