Privacy Policy

At LittleLayers (based in Dibrugarh, Assam, India), we value your trust. This Privacy Policy outlines how we collect, store, utilise, and protect your personal information, design assets, and order details when you visit littlelayers.in or interact with our 3D printing studio services. This policy is issued in compliance with the Digital Personal Data Protection Act, 2023 (India).

1. Identity of the Data Fiduciary

LittleLayers is the Data Fiduciary responsible for your personal data under the DPDP Act, 2023.

• Business Name: LittleLayers
• Address: Dibrugarh, Assam — 786001, India
• Email: hellolittlelayers@gmail.com
• Website: www.littlelayers.in

2. Personal Data We Collect

We collect only the personal data necessary to provide our products and services:

• Contact & Identity Data: Full name, email address, phone number, date of birth (collected at registration).
• Shipping & Address Data: Delivery address, city, state, PIN code.
• Account Data: Display name, profile photo, account preferences.
• Order & Transaction Records: Order identifiers (e.g., LL-1234567890), items purchased, order specifications, and chosen payment method. We never store raw card numbers or UPI PINs.
• Custom Design & 3D Model Files: CAD files (STL, OBJ, STEP, 3MF), reference images, dimensional specifications, and custom notes you submit for printing or quotation.
• Support Communications: Chat messages and correspondence sent through our website or WhatsApp for customer support.
• Authentication Data: Supabase Auth session tokens. If you sign in via Google (OAuth), we receive only your Google-authenticated email and display name.

3. Legal Basis for Processing (DPDP Act 2023, §7)

We process your personal data on the following lawful bases:

• Consent: When you create an account, place an order, or use our services, you provide voluntary, free, specific, and informed consent. You may withdraw consent at any time.
• Contractual Necessity: Processing necessary to fulfil your order — fabrication, packaging, shipping, delivery, and after-sale support.
• Legal Obligation: Processing required to comply with Indian tax law (GST Act, Income Tax Act), accounting obligations, or directions from competent authorities or courts.

We do not use your personal data for automated profiling or targeted advertising.

4. How We Use Your Information

• 3D Print Fabrication: Processing your design files, selecting materials, and printing your order.
• Logistics & Delivery: Sharing your name, phone, and address with registered courier partners (India Post, Delhivery, Blue Dart) solely to deliver your parcel.
• Order Communication: Sending order confirmations, dispatch notifications, and tracking links via email or WhatsApp.
• Customer Support: Resolving queries, design revisions, and replacement requests.
• Account Management: Maintaining your account, order history, and profile preferences.

5. Data Sharing & Third-Party Processors

We never sell or rent your personal data. Data is shared only with the following parties for the purposes stated:

• Supabase, Inc. (Data Processor): Our database, authentication, and file-storage infrastructure. Data is stored in the Tokyo, Japan (ap-northeast-1) region, with SSL/TLS in transit and AES-256 at rest, under Row-Level Security policies.
• Google LLC (OAuth Provider): If you sign in with Google, Google authenticates you and shares only your email and display name with us. We do not receive or store your Google password.
• Courier Partners: Name, phone number, and delivery address shared only to fulfil delivery.
• Payment Gateways: PCI-DSS compliant processors handle payments. We do not receive or retain card or UPI credentials.
• Law Enforcement / Courts: As mandated by applicable Indian law.

6. Cross-Border Data Transfers

Your personal data is stored on Supabase servers in Tokyo, Japan, constituting a transfer outside India. We make such transfers with appropriate safeguards under the DPDP Act, 2023, and applicable rules notified by the Central Government. By using our services and providing consent, you acknowledge this transfer.

7. Data Retention

• Account & Profile Data: Retained while your account is active; deleted within 30 days of an erasure request.
• Order Records: Retained for up to 7 years (GST/Income Tax compliance); anonymised thereafter.
• Support Messages: Retained for up to 2 years from resolution.
• Uploaded Design Files: Retained until order fulfilment; deleted on request after delivery.
• Authentication Tokens: Managed by Supabase Auth with standard session-expiry policies.

When the purpose of processing is fulfilled and retention is no longer required, we delete or anonymise your data.

8. Cookies & Local Storage

We use minimal functional local storage — no advertising trackers:

• theme — Light/Dark mode preference.
• accent_color — Accent colour preference.
• ll_cart — Shopping cart contents (guest users).
• ll_consent_v1 — Records your consent decision so the notice does not re-appear.

Supabase Auth may set functional session cookies required for authentication. No third-party advertising cookies are used.

9. Your Rights as a Data Principal (DPDP Act 2023, §§ 11–14)

• Right to Access (§11): Request a summary of the personal data we hold and how it has been processed.
• Right to Correction & Erasure (§12): Request correction of inaccurate data, or erasure of data we no longer need. You may also request deletion of your entire account via your Profile page or by contacting us.
• Right to Grievance Redressal (§13): Lodge a grievance with our Grievance Officer. We will respond within 30 days.
• Right to Nominate (§14): Nominate another individual to exercise your data rights in the event of your death or incapacity.
• Right to Withdraw Consent: Withdraw consent at any time. Withdrawal does not affect prior lawful processing.

10. Children's Data (DPDP Act 2023, §9)

LittleLayers does not knowingly collect personal data from children under the age of 18 without verifiable parental consent. Our services are intended for adults. We do not profile, target with advertisements, or track minors.

If you believe your child has provided data without your consent, contact hellolittlelayers@gmail.com immediately and we will delete it promptly.

11. Security Safeguards

• SSL/TLS encryption for all data in transit.
• AES-256 encryption for data at rest (Supabase).
• Row-Level Security (RLS) ensuring users can only access their own data.
• Supabase Auth secure session token management.
• Admin access restricted to authorised personnel only.

12. Data Breach Notification

In the event of a personal data breach, LittleLayers will:

• Notify the Data Protection Board of India as required under the DPDP Act, 2023.
• Inform affected users via email at the earliest feasible opportunity.
• Take immediate steps to contain and remediate the breach.

13. Grievance Officer & Contact

In accordance with the DPDP Act, 2023, we have designated a Grievance Officer:

• Designation: Grievance Officer — LittleLayers
• Address: LittleLayers, Dibrugarh, Assam — 786001, India
• Email: hellolittlelayers@gmail.com
• WhatsApp: +91 6000061991 (Mon–Sat, 9 AM – 7 PM IST)
• Response time: Acknowledgement within 48 hours; resolution within 30 days.

If you are dissatisfied with our resolution, you may escalate to the Data Protection Board of India once constituted under the DPDP Act, 2023.

14. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices or legal requirements. Material changes will be communicated via email or a prominent notice on our website prior to taking effect. Continued use of our services after the effective date constitutes acceptance of the updated policy.