Privacy Policy

Welcome to Sketch2Shape ("we," "us," "our," or the "Company"). We are committed to protecting your privacy and ensuring the security of your personal data. This Privacy Policy explains how we collect, use, store, share, and protect your personal information when you use our website at sketch2shape.com and our services (collectively, the "Services").

This Privacy Policy is drafted in compliance with:

• The Digital Personal Data Protection Act, 2023 (DPDPA) and DPDP Rules, 2025 of India
• Information Technology Act, 2000 and IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011
• Consumer Protection Act, 2019 and Consumer Protection (E-Commerce) Rules, 2020
• General Data Protection Regulation (GDPR) principles for users outside India

By using our Services, you consent to the collection and processing of your personal data as described in this Privacy Policy. If you do not agree with this Policy, please do not use our Services.

For the purposes of applicable data protection laws, the data controller is:

We collect personal data that you voluntarily provide to us and data that is automatically collected when you use our Services.

We process your personal data for the following purposes:

We share your personal data only as necessary to provide our Services and as described below:

In compliance with the DPDP Rules 2025, we retain your personal data only for as long as necessary to fulfill the purposes for which it was collected:

• Account Data: Until you delete your account or request deletion
• Order and Transaction Data: 7 years from the date of transaction (as required for tax and legal compliance in India)
• Uploaded Images and Designs: 90 days after order completion (unless you request earlier deletion)
• Design Preferences: Until you delete your account or request deletion
• Communication Records: 3 years from the date of communication
• Analytics Data: 26 months (anonymized after this period)

After the retention period, your data will be securely deleted or anonymized using appropriate technical measures including encryption, masking, or tokenization as required under DPDP Rules 2025.

Under the DPDPA and applicable data protection laws, you have the following rights:

• Right to Access: You may request information about what personal data we hold about you and obtain a copy of such data.
• Right to Correction: You may request correction of inaccurate or incomplete personal data.
• Right to Erasure: You may request deletion of your personal data, subject to legal retention requirements.
• Right to Withdraw Consent: You may withdraw your consent for data processing at any time through your account settings or by contacting us. As per DPDP Rules 2025, we provide a dedicated consent withdrawal mechanism. Withdrawal will not affect the lawfulness of processing based on consent before its withdrawal.
• Right to Nominate: You may nominate another individual to exercise your rights on your behalf in case of your death or incapacity.
• Right to Grievance Redressal: You have the right to have any grievances addressed by us and, if unsatisfied, to approach the Data Protection Board of India.

To exercise any of these rights, please contact us at pgrudrakshi@gmail.com with the subject line "Data Subject Request." We will respond within 30 days of receiving your request.

Under the DPDPA and DPDP Rules 2025, a "child" is defined as an individual below 18 years of age. Sketch2Shape services are intended for users who are 18 years of age or older.

Our "Drawing to 3D" service allows adults to upload drawings (including those created by children in their care) for conversion to 3D models. In such cases:

• Adult Account Holder: The parent or guardian is the account holder and Data Principal. We collect personal data from the adult, not from the child.
• Content Responsibility: The adult account holder is responsible for any content they upload, including drawings created by minors in their care.
• No Direct Data Collection from Children: We do not knowingly collect personal data directly from individuals under 18 years of age.
• No Behavioral Tracking: We do not track, behaviorally monitor, or serve targeted advertisements to any users based on children's activities.

If we become aware that we have inadvertently collected personal data directly from an individual under 18 without a parent or guardian as the account holder, we will take steps to delete that information promptly. If you believe a child under 18 has provided us with personal data directly, please contact us immediately at pgrudrakshi@gmail.com.

In compliance with the DPDP Rules 2025, we implement appropriate technical and organizational security measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit using TLS/SSL protocols
• Encryption, masking, obfuscation, or tokenization of sensitive data at rest (as required by DPDP Rules 2025)
• Strict access controls and continuous monitoring mechanisms
• One-year log retention for security audit purposes (DPDP Rules 2025)
• Verified backup systems and disaster recovery
• Regular security assessments and updates
• Secure data storage with reputable cloud service providers with mandatory security clauses in processor contracts
• Employee training on data protection practices

We use cookies and similar tracking technologies to enhance your experience on our website.

Some of our third-party service providers are located outside India. When we transfer your personal data outside India, we ensure that:

• The transfer complies with applicable data protection laws
• Appropriate safeguards are in place (such as standard contractual clauses or adequacy decisions)
• The receiving party maintains adequate security measures

Data may be transferred to and processed in countries where our service providers operate, including the United States. These countries may have different data protection laws than India.

In compliance with the DPDP Rules 2025, in the event of a personal data breach that is likely to result in risk to your rights and freedoms, we will:

• Immediate User Notification: Notify affected individuals immediately via registered communication channel (email/SMS) in a clear, concise manner
• Data Protection Board Notification: Provide initial intimation to the Data Protection Board of India without delay, followed by a detailed report within 72 hours (or extended period if formally permitted)
• Breach Details: Include in notifications: nature of breach, extent, timing, likely consequences, mitigation measures taken, safety recommendations for you, and our contact details
• Documentation: Document all breaches and remedial actions taken, maintaining logs for a minimum of one year as required under DPDP Rules 2025

Our website may contain links to third-party websites. We are not responsible for the privacy practices or content of these external sites. We encourage you to read the privacy policies of any third-party sites you visit.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes:

• We will update the "Effective Date" at the top of this Policy
• We will notify you via email or through a prominent notice on our website
• For significant changes, we may seek your renewed consent where required

We encourage you to review this Privacy Policy periodically.

In accordance with the Digital Personal Data Protection Act, 2023, the Information Technology Act, 2000, and Consumer Protection (E-Commerce) Rules, 2020, we have appointed a Grievance Officer to address your concerns regarding data privacy and protection:

The Grievance Officer will:

• Acknowledge your complaint within 48 hours of receipt
• Investigate and resolve complaints within 30 days
• Provide you with updates on the status of your complaint

If you are not satisfied with the resolution, you may approach the Data Protection Board of India as established under the DPDPA.

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: