Privacy Policy & DPDP Act, 2023 Compliance

This Privacy Policy governs the collection, processing, storage, and transfer of digital personal data by Holcenic (“Kolavia”, “we”, “us”, or “our”), acting as the Data Fiduciary under the Digital Personal Data Protection Act, 2023 (DPDP Act 2023).

This policy applies to all registered creators (“Data Principals”), brand partners, and visitors utilizing the Kolavia platform and associated APIs.

In strict adherence to the principles of purpose limitation and data minimization (Section 7 of the DPDP Act 2023), we only collect personal data necessary for specified, lawful purposes:

• Account & Identity Data: Full name, email address, contact number, and account credentials — used for authentication and collaboration notifications.
• Public Creator Metrics: Instagram handle, follower count, public post engagement, and niche tags — collected via authorized integration feeds to allow brand discovery. We do not access private messages or post on your behalf.
• Financial & Banking Details: Bank account holder name, account number, IFSC code, and UPI ID — isolated in private database tables with strict Row-Level Security (RLS) and used solely for outbound escrow earnings disbursal via our certified payment partner (Cashfree Payments).
• Permanent Account Number (PAN): 10-character PAN card number, legal name returned by the Income Tax Department, and Aadhaar seeding status — collected strictly for statutory compliance with Section 194-O of the Indian Income Tax Act, 1961 (TDS withholding).
• Sample Shipping Address: Physical delivery address, landmark, pincode, and recipient phone number — collected strictly to enable brands to ship physical product samples for barter and sponsored deliverables via courier services.

Personal data is collected and processed only with your explicit, free, specific, informed, unconditional, and unambiguous consent given through clear affirmative action.

You retain the absolute right to withdraw consent at any time via your account settings. Withdrawal of consent does not affect the legality of processing conducted prior to withdrawal. If you withdraw consent for essential services (such as banking details for payouts), related platform functions may be restricted.

Kolavia is intended solely for individuals aged 18 years or older. In compliance with Section 9 of the DPDP Act 2023, we do not knowingly process personal data of minors without verifiable parental or legal guardian consent, nor do we engage in behavioral tracking or targeted marketing directed at children.

If you are under 18, you may only participate on Kolavia under the active supervision and explicit consent of a parent or legal guardian.

To prevent unauthorized access, accidental alteration, disclosure, or personal data breach, we enforce rigorous technical and organizational security safeguards:

• PII & Banking Table Isolation: Bank details, PAN cards, and delivery addresses are isolated into dedicated private tables with strict database Row-Level Security (RLS). Public scrapers and unauthorized queries receive NULL.
• Encryption in Transit & At Rest: All web traffic is strictly encrypted using TLS 1.3 / HTTPS. Underlying cloud storage uses AES-256 encryption at rest.
• Data Masking: Sensitive identifiers such as PAN cards (AZJP****0R) and bank account numbers (A/C ...4321) are masked in administrative views and client interfaces.
• Payment Gateway Security: We do not store credit or debit card numbers, CVVs, or net banking passwords. Financial routing is processed via RBI-licensed payment aggregators (Cashfree Payments).

We do not sell, rent, or trade your personal data. Personal data is shared only with certified Data Processors under binding data protection contracts:

• Cashfree Payments India Pvt. Ltd.: For automated payout disbursals (UPI/NEFT) and synchronous Income Tax PAN verification.
• Supabase Inc. & Cloud Infrastructure: For encrypted database hosting and authentication infrastructure.
• Collaborating Brands: When a creator accepts a brand campaign, the brand receives the creator's shipping address strictly for product sample dispatch.
• Statutory & Law Enforcement Authorities: When strictly mandated by Indian law, court order, or regulatory directive (such as Income Tax filing under Section 194-O).

Under the DPDP Act 2023, you have enforceable statutory rights:

• Right to Access Information (Section 11): Right to obtain a summary of your personal data being processed and the identities of third parties with whom it was shared.
• Right to Correction & Updation (Section 12): Right to correct inaccurate or incomplete personal data directly in your settings.
• Right to Erasure (“Right to be Forgotten”): Right to request permanent account deletion. We provide a 30-day grace period, following which all personal profile data is scrubbed.
• Right of Grievance Redressal (Section 13): Right to prompt resolution of any data protection complaint through our designated Grievance Officer.
• Right to Nominate (Section 14): Right to nominate another individual to exercise your data rights in the event of death or incapacity.

We retain personal data only for as long as your account remains active or as necessary to fulfill the specified purpose.

Statutory Exemption (Section 8(7) Proviso): Upon account deletion, personal marketing data, photos, and delivery addresses are erased. However, financial general ledger records, bank UTR references, and PAN tax snapshots are retained for a minimum statutory period of 7 years as mandated by the Indian Income Tax Act, 1961 and Companies Act, 2013 for statutory audit and TDS compliance.

In accordance with Section 8(9) and Section 13 of the DPDP Act 2023, you may contact our designated Grievance Redressal Officer for any privacy inquiries, consent withdrawal, or data rights requests:

If your grievance is not resolved within the statutory period, you hold the legal right to escalate the matter to the Data Protection Board of India (DPBI).

In accordance with the DPDP Act 2023, Kolavia uses essential, first-party HTTP cookies and local browser storage strictly for:

• Authentication & Session Continuity: Maintaining your encrypted login session via Supabase Auth so you do not have to re-enter credentials on every page.
• Escrow & Transaction Integrity: Securing wallet checkout handshakes and preventing cross-site request forgery (CSRF) during financial operations.
• Interface Preferences: Remembering your chosen color mode (Light/Dark) and cookie consent acknowledgment.

We do not deploy third-party advertising tracking cookies or sell your browsing history to data brokers.