1. Scope & Legal Capacity (Controller vs. Processor)
This Privacy Policy applies to all users, developers, enterprises, and visitors of the AMARACUS platform (operating at amaracus.tech, related subdomains, and associated REST APIs), operated by Amaracus Technologies (corporate registration pending), operating from Bengaluru, Karnataka 560103, India (“AMARACUS”, “we”, “us”, or “our”). We will publish our registered office address here once registration is complete; until then, the email addresses in Section 10 reach us.
We act as a Data Controller (or Data Fiduciary under the DPDPA 2023) for account registration data, authentication credentials, billing contacts, direct communications, and technical security audit telemetry collected to maintain platform integrity.
We act as a Data Processor (or Data Processor under the DPDPA 2023) for customer-managed cryptographic keys, Certificate Signing Requests (CSRs), Cryptographic Bill of Materials (CBOMs), and encrypted payloads processed on behalf of enterprise organizations under our Service Agreements.
2. Personal Information Collected & Technical Purposes
In strict adherence to the data minimization principle, we collect only the personal information strictly necessary to provision, secure, and operate cryptographic services:
A. Authentication & Account Identity
Data Elements: Full name, verified email address, organization name, password stored only as a scrypt hash (16-byte random salt, N=16384, r=8, p=5; raw passwords are never stored), 6-digit One-Time Password (OTP) codes (stored only as a hash), session tokens (stored only as a SHA-256 hash), and your choices about terms, age confirmation and marketing email.
Technical Purpose: Identity verification, authentication, session issuance, and account recovery.
B. Security & Access Audit Telemetry (CERT-In Compliance)
Data Elements: Originating client IPv4/IPv6 address, browser User-Agent header, request timestamp, HTTP method, endpoint route, response status and latency, the API credential used, and audit event records (actor identity, target resource, and outcome).
Technical Purpose: Fraud detection, brute-force mitigation, DDoS protection, and statutory compliance with Indian Computer Emergency Response Team (CERT-In) Cyber Security Directions.
C. Billing & Payment Data (Zero Cardholder Exposure)
Data Elements: Customer ID, subscription tier, billing contact email, company name, and VAT/GST tax identification numbers (if provided).
PCI-DSS Compliance Boundary: AMARACUS never collects, handles, transmits, or stores raw payment card numbers, expiry dates, CVVs, UPI IDs or bank details. USD payments are taken by Polar.sh, our Merchant of Record, through its PCI-DSS compliant payment processor (Stripe). Monthly INR payments are taken by Razorpay in its own checkout window: you enter your card or UPI details there, not on AMARACUS. We send Razorpay your name, email address and organization ID to set up the subscription, and receive back only the subscription ID, payment ID and payment status.
D. Cryptographic Artifacts & File Uploads
Data Elements: Public X.509 certificates (.pem, .crt, .cer), Certificate Signing Requests (CSRs), and CBOM/SBOM manifests (.json, .xml).
Security Controls: Uploaded files undergo mandatory magic-byte inspection and MIME-type validation, and are stored in isolated, non-executable directories with tenant-isolated access control.
E. Hackathon Submissions & Competitive Benchmarking
Data Elements: Contestant developer name, contact email address, GitHub repository URL, commit SHA, branch, benchmark performance scores, and cryptographic submission receipts.
Access Control: Hackathon submissions are protected by role-based access control (RBAC) and restricted strictly to authorized contest evaluators and organization administrators.
3. Absolute Warranties: Zero AI Model Training & Zero Data Brokerage
AMARACUS strictly commits that customer cryptographic keys, private keys, plaintext payloads, CSRs, and CBOM inventories are NEVER used to train, evaluate, or fine-tune artificial intelligence or machine learning models.
AMARACUS has never sold, rented, leased, or monetized personal information or customer cryptographic metadata to data brokers, ad exchanges, or third-party marketing services, and will never do so.
4. Legal Bases for Processing (DPDPA 2023 & GDPR)
We process personal data only when an established legal ground applies:
- • Performance of Contract (GDPR Art. 6(1)(b) / DPDPA Sec 6):Authenticating users, maintaining accounts, executing cryptographic API operations, and servicing developer subscriptions.
- • Statutory Legal Obligation (GDPR Art. 6(1)(c) / DPDPA / CERT-In):Preserving 180-day access and security logs under CERT-In Directions 2022 and maintaining 7-year financial accounting records.
- • Legitimate Interests (GDPR Art. 6(1)(f)):Defending platform infrastructure against cyber attacks, preventing credential abuse, and verifying system uptime.
- • Voluntary Consent (GDPR Art. 6(1)(a) / DPDPA Sec 6):Participation in hackathons, voluntary developer surveys, and non-essential communications.
5. Third-Party Sub-processors & Service Providers
We use the third-party service providers below. Each processes personal data under its own data processing terms, which include Standard Contractual Clauses where the GDPR requires them:
| Sub-processor | Purpose | Data Shared | Location |
|---|---|---|---|
| Cloudflare, Inc. | Website hosting (Pages), DNS, edge routing, DDoS protection, email forwarding | Client IP, HTTP headers, request telemetry | Global Edge Network |
| Polar.sh (with Stripe as its processor) | Merchant of Record: checkout, subscriptions, invoices, tax | Billing email, customer ID, subscription status | United States / EU |
| Razorpay Software Private Limited | Payment processor for monthly INR subscriptions (not a Merchant of Record) | Name, email, organization ID; the card or UPI details you enter in Razorpay's checkout | India |
| Microsoft Azure | Azure Key Vault / Managed HSM, only for Azure-held keys and BYOK | Wrapped data keys and key identifiers; no personal data | Region of the vault (yours, for BYOK) |
| Supabase (on AWS) | Managed PostgreSQL Database & Data Storage | Application tables, accounts, audit events | Asia Pacific (Mumbai, India) |
| Render | API hosting: runs every API request and cryptographic operation | All data sent to or returned by the API, in transit and in memory | Asia Pacific (Singapore) |
| Resend | Transactional and opted-in email delivery | Recipient email address, name, email content | United States |
| Trigger.dev | Background tasks (for example certificate renewal) | Organization and resource identifiers in task inputs | European Union / United States |
| Composio | Only if you connect GitHub, Slack or Gmail integrations | Content of the actions you enable (for example a Slack message) | United States |
6. Verified Data Retention & Deletion Schedule
We retain data only for periods strictly required by technical function or statutory mandate:
| Category | Retention Period | Statutory / Operational Basis |
|---|---|---|
| User Account & Profiles | Lifetime of account | Erased immediately upon verified user deletion request |
| Authentication OTP Codes | 10 minutes | Stored only as a hash; deleted on verification, after 5 wrong attempts, or on expiry |
| Security & Audit Logs | At least 180 days | CERT-In Directions 2022 require 180 days; logs are not yet deleted automatically after that |
| Sessions | Until sign-out or 30 days without use | Authentication; stored only as a hash |
| API usage records | Lifetime of the Organization | Billing, usage reporting and abuse prevention |
| Rate-limit counters | Minutes to about an hour | Hold only an IP address or user ID and a count |
| Tax, Invoicing & Billing | 7 years | Statutory corporate taxation and financial reporting regulations |
| Uploaded Certificates & CSRs | Configurable / Account lifetime | Retained until deleted by tenant administrator or upon account erasure |
7. Exercising Data Principal & Subject Rights
Under the Indian DPDPA 2023, EU/UK GDPR, and applicable global privacy statutes, you possess enforceable rights regarding your personal information:
- Right of Access & Portability: Obtain a complete copy of all personal records and audit history.
- Right to Rectification: Update or correct inaccurate profile and organization details at any time.
- Right to Erasure (“Right to be Forgotten”): Request permanent deletion of your account and personal records.
- Right to Grievance Redressal: Submit grievances directly to our designated Resident Grievance Officer.
- Right to Nominate (DPDPA Sec 14): Designate a representative to exercise rights on your behalf in the event of incapacity.
- Right to Object & Restrict (GDPR Art. 18, 21): Object to processing based on legitimate interests, or ask us to restrict processing while a request is resolved.
- Right to Withdraw Consent: Withdraw consent at any time (for example to marketing email, through the unsubscribe link or Account Settings). This does not affect processing before withdrawal.
- Right to Complain: Complain to a data protection authority: the Data Protection Board of India, or, in the EU/UK, the supervisory authority where you live or work.
We answer requests within 30 days (the GDPR's one month), and may ask you to confirm your identity first. Requests are free unless they are manifestly unfounded or excessive. We do not make decisions that have legal or similarly significant effects on you solely by automated means; automated rate limits and fraud checks only protect the Services.
You can exercise your rights immediately without submitting email requests through the AMARACUS Account Settings console:
8. Cookies & Local Storage Inventory
AMARACUS operates under a strict privacy-first architecture. We deploy zero third-party advertising cookies or cross-site tracking pixels. The only browser storage keys utilized are strictly essential for session authentication and interface rendering:
| Storage Key | Storage Type | Lifespan | Technical Purpose |
|---|---|---|---|
| sessionToken | HTTP-Only Cookie (SameSite=Lax, Secure) | 30 days, renewed while in use | Essential authenticated session token for API verification |
| amaracus_session_token | Browser localStorage | Until user sign-out | Frontend bearer authorization token for secure API client calls |
| amaracus_cookie_consent | Browser localStorage | Persistent | Records acknowledgment of essential storage notice |
| theme | Browser localStorage | 1 Year | Persists user interface visual theme preference |
For comprehensive details on managing your browser storage, review our dedicated Cookie and Local Storage Policy.
9. International Data Transfers & Hosting Architecture
Our database is hosted in India (Supabase, Mumbai region). The API, which runs every request and cryptographic operation, is hosted in Singapore (Render), so personal data is transferred outside India when you use the Services. Other transfers:
- Edge Transit: Request traffic is processed through Cloudflare's global Anycast edge network to minimize latency and block DDoS attacks prior to reaching origin infrastructure.
- Cross-Border Sub-processing: Service providers located in the United States and European Union (Polar.sh and Stripe, Resend, Trigger.dev, and Composio if you connect it) receive data under their data processing terms, which use Standard Contractual Clauses (SCCs) where the GDPR requires them. All transfers are encrypted in transit (TLS).
- DPDPA 2023 Cross-Border Compliance: We will not transfer personal data to a country the Central Government restricts by notification under Section 16 of the DPDPA 2023, and we will follow any such restriction when it is notified.
10. Statutory Grievance Redressal & Regulatory Contacts
In accordance with Section 13 of the Digital Personal Data Protection Act, 2023 and Rule 5(9) of the Information Technology (SPDI) Rules, 2011, the details of our designated Resident Grievance Officer and privacy contact points are set out below (see full corporate status on our Contact & Company Information Register):
11. Children's Privacy, Age Requirements & Minor Data Governance
AMARACUS is an enterprise-grade Universal Cryptographic Operating System, developer API, and infrastructure platform designed for software engineers, cryptographers, enterprise organizations, academic researchers, and students aged 13 and older. We do not provide consumer services or marketing directed to children under 13.
11.1 User Eligibility, Student Access & Age Requirements (13+)
Pursuant to Section 1.3 of our Terms of Service, users must be at least thirteen (13) years of age to create an AMARACUS account or utilize our cryptographic APIs. We enthusiastically welcome students, teenage developers, and academic researchers aged 13 and older. Users between 13 and 17 years of age represent that their parent or legal guardian has reviewed and consented to these policies. Paid commercial subscriptions, enterprise billing, and legal contracts require legal age of majority (18+ or applicable jurisdictional majority). Children under the age of 13 are strictly prohibited from registering or transmitting any personal data through the platform.
11.2 Multi-Jurisdictional Statutory Alignment
Defines a child as an individual under 18 years. We strictly adhere to Section 9(2) by engaging in zero tracking, zero behavioural monitoring, and zero targeted advertising directed at children. For student developers under 18, accounts require parental or guardian consent to our terms.
In compliance with the Children's Online Privacy Protection Act (15 U.S.C. §§ 6501–6506), AMARACUS does not knowingly collect, maintain, or disclose personal information online from children under 13. We do not sell or share student or minor data under California CCPA/CPRA or California AADC standards.
The GDPR sets digital consent thresholds between 13 and 16 years across EU Member States (13 in the UK). Our minimum platform age of 13 aligns directly with these statutory frameworks. Under the UK Age Appropriate Design Code, our platform maintains high-privacy defaults, zero profiling, and zero tracking for all users.
11.3 Data Minimization: No Overcollection of Sensitive Birth Information
Under the data minimization principles of GDPR Article 5(1)(c) and DPDPA Section 6, AMARACUS does not collect sensitive identity records, national identification numbers, birth certificates, or exact dates of birth during standard developer registration. Age assurance is maintained through upfront audience framing, business/work email requirements, neutral age screening gates, and affirmative legal capacity certifications.
11.4 Suspected Under-13 Child Account Escalation & Expedited Deletion Protocol
If AMARACUS discovers, or has reason to suspect, that an account belongs to or was created by a child under thirteen (13) years of age, or if a parent or legal guardian informs us of an unauthorized registration by a child under 13, we execute the following four-stage containment and erasure protocol:
- Stage 1 (Immediate Containment - 24h SLA): The reported account is immediately suspended. API keys, session tokens, and webhook endpoints are revoked to block any further data transmission.
- Stage 2 (Age Verification): The account holder or guardian is provided a strict 48-hour cure window to demonstrate that the user is at least 13 years of age. If proof is omitted or indicates the user is under 13, permanent deletion is triggered immediately.
- Stage 3 (Irreversible Personal Data Erasure - 48h SLA): All personal identifiers (full name, email address, credentials, project metadata, and uploaded files) are permanently purged from all production databases and active memory stores.
- Stage 4 (Statutory Cryptographic Ledger Retention): Purely anonymized, one-way cryptographic hashes in historical audit ledgers are retained solely to satisfy non-derogable legal mandates under Indian CERT-In Directions 2022 (180-day security log mandate), without preserving identifiable personal records.
11.5 Parental & Legal Guardian Notice & Direct Escalation
Parents, legal guardians, and school administrators may at any time review, inspect, or demand the immediate erasure of any personal information inadvertently provided by an under-13 child or student by contacting our designated Data Protection and Grievance desks:
You may also submit urgent escalation notices through our interactive Contact & Statutory Register.
12. U.S. State Privacy Rights (including California)
12.1 Categories Collected: In the last 12 months we collected identifiers (name, email, IP address), customer records (organization and billing details), commercial information (plan and purchase history), and internet activity (API usage and audit records), from you directly and from your use of the Services, for the purposes in Section 2. We do not collect sensitive personal information beyond account credentials, which we use only to sign you in.
12.2 No Sale or Sharing: We do not sell personal information or share it for cross-context behavioral advertising, and have not done so in the last 12 months. We do not knowingly sell or share the personal information of anyone under 16. We disclose personal information to the service providers in Section 5 only to run the Services.
12.3 Your Rights: Depending on your state, you can ask to know what we collect and disclose, to receive a copy, to correct it, and to delete it, and to opt out of sale, sharing or targeted advertising (which we do not do). We will not discriminate against you for using these rights.
12.4 How to Exercise Them: Use the self-service tools in Section 7 or email [email protected]. We will verify your request by confirming control of your account email. An authorized agent may act for you with your signed permission, and we may ask you to confirm it. If we decline a request, you may appeal by replying to our decision; if the appeal is denied, you can contact your state Attorney General.
12.5 California “Shine the Light”: We do not disclose personal information to third parties for their own direct marketing purposes.
13. Other Disclosures, Security & Changes
13.1 Business Transfers: If AMARACUS is involved in a merger, acquisition or sale of assets, personal data may be transferred as part of it. We will tell you before your data becomes subject to a different privacy policy.
13.2 Legal Requests: We disclose personal data to public authorities only where the law requires it (for example a valid court order or a direction under the Information Technology Act, 2000), and, where the law allows, we tell the affected customer first. We may also disclose it to protect the rights, property or safety of AMARACUS, our users or the public, or to investigate fraud or abuse.
13.3 Security: We encrypt data in transit (TLS), store passwords, session tokens, OTP codes and API keys only as hashes, keep Key Material only in wrapped form, isolate each Organization's data, restrict database access to the API, and log security-relevant events. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
13.4 Breach Notification: If a personal data breach occurs, we will notify the Data Protection Board of India and affected users as the DPDPA 2023 requires, report to CERT-In within six hours where its Directions apply, and, for the GDPR, notify the competent supervisory authority within 72 hours and affected people without undue delay where required.
13.5 Email: We send service and security emails needed to run your account. Marketing emails are sent only with your consent, and every one includes a one-click unsubscribe link.
13.6 Do Not Track and Global Privacy Control: We do not track you across sites, so there is no tracking for these signals to switch off; we honor them by default. See the Cookie Policy for details.
13.7 Links to Other Websites: The Services link to third-party sites (for example Polar.sh or Razorpay checkout, or GitHub). Their privacy practices are governed by their own policies.
13.8 Changes to This Policy: We will post changes on this page with a new version number and effective date. For material changes, we will notify you by email or in the console at least thirty (30) days before they take effect, and ask for consent again where the law requires it.