Global Privacy Notice & Data Rights Charter

Under the Digital Personal Data Protection Act, 2023, the legal role of KRYSKAFLOW Technologies / Kryska Enterprises depends on how you interact with our platform:

In strict compliance with the principle of Data Minimisation (DPDP Act Section 6(1)), we collect only digital personal data that is strictly necessary for fulfilling our automated services:

Personal data is processed exclusively for the following specific, itemized purposes:

• Automated Resource Fulfillment: Dispatching creator-configured resource links, discount codes, or guide URLs to users who comment designated keywords on public social posts.
• Follower Verification (Follow-to-Unlock): Confirming public follower relationships via Meta Graph API endpoints when a creator chooses the follow-gate viral mechanic.
• Account Administration & Security: Authenticating dashboard logins, enforcing rate limits, monitoring infrastructure health, and preventing distributed denial-of-service (DDoS) or brute-force attacks.
• Payment & Statutory Invoicing: Executing subscription authorizations, processing UPI AutoPay recurring debits, and generating tax-compliant GST invoices in adherence to Indian tax statutes.
• Regulatory & Legal Compliance: Complying with court orders, statutory directives from CERT-In, and notices issued by the Data Protection Board of India.

Under Section 8(7) of the DPDP Act, personal data must be erased as soon as the purpose for which it was collected has been served, or upon withdrawal of consent. KRYSKAFLOW enforces strict programmatic data lifecycles:

KRYSKAFLOW engages trusted cloud infrastructure and payment partners under written data-processing agreements that enforce equivalent security and confidentiality obligations:

• Google Firebase Auth (Google LLC, USA / Global): Provider of identity token validation, email authentication, and OAuth verification under Google Cloud Terms.
• Supabase Inc. & AWS India (ap-south-1 Mumbai / Global): Primary encrypted cloud PostgreSQL database hosting user records, automations, and cryptographic audit ledgers.
• Upstash Inc. (USA / Global): Serverless Redis cluster utilized for sub-second webhook deduplication, rate limiting, and distributed locking.
• Meta Platforms, Inc. (USA / Global): Provider of Instagram Graph API & Webhooks. Interaction data flows through Meta's verified API endpoints under Meta Platform Terms.
• Telegram Messenger Inc. (Global): Telegram Bot API utilized for multi-channel creator notification and automation alerts.
• Razorpay Software Pvt. Ltd. (India): RBI-authorized Payment Aggregator processing UPI AutoPay, cards, and net-banking transactions in India (INR ₹).
• PayPal Inc. (USA / Global): Payment processor handling global USD ($) subscription orders, international credit cards, and merchant checkouts.
• Cloudflare, Inc. (Global Edge Network): Edge routing, DDoS mitigation, and SSL/TLS edge encryption.

Cross-Border Data Transfer: Data transfers outside India are conducted strictly in compliance with Section 16 of the DPDP Act 2023 and central government notifications, ensuring destination jurisdictions do not fall under any blacklisted territories.

As a Data Principal under the DPDP Act 2023, you are guaranteed enforceable statutory rights:

Use this automated form to submit a verifiable request under Sections 11, 12, or 14 of the DPDP Act. Our Compliance Desk processes all statutory requests within 48 hours and provides a cryptographic tracking reference.

In compliance with Section 13 of the Digital Personal Data Protection Act, 2023 and Rule 3(2) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, the particulars of our designated Grievance Officer are set forth below:

If you reside in the European Economic Area (EEA) or the United Kingdom (UK), this Section 9 supplements our Global Privacy Notice and provides mandatory statutory disclosures under the General Data Protection Regulation (GDPR) and the UK Data Protection Act 2018 / UK GDPR.

9.1 Legal Bases for Processing (GDPR Article 6)

We process your personal data strictly under one or more recognized legal bases:

• Performance of a Contract (Article 6(1)(b)): Processing creator registration, authentication credentials, billing transactions, and Meta Graph API tokens necessary to deliver our subscription SaaS automation services.
• Legitimate Interests (Article 6(1)(f)): Processing telemetry for distributed denial-of-service (DDoS) prevention, infrastructure health, sub-second latency optimization, and anti-fraud monitoring. Our legitimate interests do not override your fundamental privacy rights.
• Explicit Affirmative Consent (Article 6(1)(a)): For optional performance analytics cookies, non-essential telemetry, and product update newsletters. You have the right to withdraw consent at any time under Article 7(3).
• Compliance with Legal Obligations (Article 6(1)(c)): Retaining statutory corporate and tax records (GST, international sales invoicing) in adherence to statutory accounting laws.

9.2 International Data Transfers & Standard Contractual Clauses (SCCs)

When personal data originating in the EEA or UK is transferred to infrastructure hosted in India, the United States, or other third countries, KRYSKAFLOW ensures an adequate level of data protection by entering into:

• European Commission Standard Contractual Clauses (SCCs): Incorporating Commission Implementing Decision (EU) 2021/914 (Module 2 Controller-to-Processor and Module 3 Processor-to-Processor) with all cloud processors (Supabase, Upstash, Vercel, Meta).
• UK International Data Transfer Addendum (IDTA): Issued by the UK Information Commissioner's Office (ICO) under Section 119A of the Data Protection Act 2018.
• Supplementary Technical Measures: End-to-end TLS 1.3 transit encryption, AES-256-GCM rest encryption, and strict zero-knowledge token handling.

9.3 Your GDPR Data Subject Rights (Articles 15–22)

EEA and UK residents possess enforceable statutory rights:

• Right of Access (Art. 15): Obtain confirmation as to whether personal data is being processed, and access a copy of all stored personal records.
• Right to Rectification (Art. 16): Demand correction of inaccurate or incomplete personal information without undue delay.
• Right to Erasure ("Right to be Forgotten") (Art. 17): Demand immediate deletion of personal data where it is no longer necessary for original purposes or upon withdrawal of consent.
• Right to Restriction of Processing (Art. 18): Restrict the processing of personal data during accuracy verification or legal disputes.
• Right to Data Portability (Art. 20): Receive your personal data in a structured, commonly used, and machine-readable format (JSON/CSV).
• Right to Object (Art. 21): Object at any time to data processing based on legitimate interests or direct marketing.
• Automated Decision-Making Safeguards (Art. 22): KRYSKAFLOW does not conduct automated profiling producing legal or similarly significant effects.

9.4 Right to Lodge a Complaint with a Supervisory Authority

You have the statutory right under GDPR Article 77 to lodge a formal complaint with a competent Data Protection Authority, in particular in the EU Member State of your habitual residence, place of work, or place of the alleged infringement (e.g., the Data Protection Commission (DPC) in Ireland, or CNIL in France), or the Information Commissioner's Office (ICO) in the United Kingdom (ico.org.uk).

EU / UK Privacy Point of Contact: Dedicated Data Protection Liaison: [email protected] (Subject: EU/UK GDPR Inquiry).

This Section 10 applies solely to visitors, subscribers, and creators residing in the United States, including California residents under the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020 (CCPA / CPRA, Cal. Civ. Code § 1798.100 et seq.), and residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), and Utah (UCPA).

10.1 Notice at Collection: Categories of Personal Information Collected (12-Month Lookback)

10.2 California Consumer Rights under CCPA / CPRA

• Right to Know & Access: You may request disclosure of the specific pieces and categories of personal information collected, the sources, commercial purposes, and third parties with whom data was shared.
• Right to Delete: You have the right to request deletion of personal information collected from you, subject to statutory exemptions (e.g. tax records, legal defense).
• Right to Correct: You may request correction of inaccurate personal information.
• Right to Opt-Out of Sale / Sharing: Because we do not sell or share data, our service operates in full compliance by default. You may also activate your browser's Global Privacy Control (GPC).
• Right to Non-Discrimination: We will never deny services, charge different prices, or provide a different level of quality because you exercised any CCPA rights.

10.3 Recognition of Global Privacy Control (GPC)

KRYSKAFLOW programmatically detects and honors universal opt-out preference signals, including the Global Privacy Control (GPC) sent by modern privacy browsers. When our system detects an active GPC signal, non-essential telemetry and tracking cookies are automatically disabled without requiring any manual action.

10.4 California "Shine the Light" Law (Civil Code § 1798.83)

California Civil Code Section 1798.83 permits California residents to request information regarding disclosure of personal data to third parties for their direct marketing purposes. KRYSKAFLOW does not disclose personal information to third parties for their direct marketing purposes.

KRYSKAFLOW is a commercial SaaS productivity suite built exclusively for professional creators, educators, and enterprise brand owners. Our platform is strictly intended for individuals who are at least 18 years of age (or the legal age of majority in their jurisdiction).

• Zero Minor Profiling: In strict compliance with the United States Children's Online Privacy Protection Act (COPPA, 15 U.S.C. § 6501 et seq.), Article 8 of the EU GDPR, and Section 9 of the India DPDP Act 2023, we do NOT knowingly solicit, collect, process, or track personal data from children under 13 years of age (US), under 16 years of age (EU/UK), or individuals under 18 years of age without verified legal parental authorization.
• Prohibition on Child-Targeted Triggers: Creators are contractually prohibited from configuring automation rules or link triggers designed to harvest information from children or direct commercial solicitations at minors.
• Expedited Child Data Deletion Protocol: If a parent or legal guardian discovers that their child has provided personal data to KRYSKAFLOW without parental consent, please contact us immediately at [email protected]. Upon verification, we will permanently and irrevocably purge such records from our databases within 24 business hours.

KRYSKAFLOW adheres to international fair information principles across additional global jurisdictions:

• Canada (PIPEDA): We adhere to the 10 fair information principles of the Personal Information Protection and Electronic Documents Act (PIPEDA, S.C. 2000, c. 5). Canadian users may request access to, or correction of, personal information held by contacting our Privacy Desk.
• Australia (Privacy Act 1988): We handle personal information in adherence to the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth). In the event of an eligible data breach likely to result in serious harm, notifications will be made to the Office of the Australian Information Commissioner (OAIC) in accordance with the Notifiable Data Breaches (NDB) scheme.

In strict compliance with Directive 2002/58/EC (EU ePrivacy Directive), UK PECR, and Section 6 of the India DPDP Act 2023, this section discloses every cookie, local storage key, and client-side identifier utilized by KRYSKAFLOW.

You can inspect, modify, or withdraw your cookie and telemetry preferences at any time by clicking Cookie & Privacy Preferences.