Privacy Policy

This Privacy Policy explains how personal data is collected, used, stored, and shared when you visit onestudio.digital (the "Website"), submit a project scoping brief, or engage OneStudio (formerly RayzStudio) for software engineering or digital design services.

Identity of the Operator: OneStudio is an independent, unincorporated studio based in India. For the purposes of India's Digital Personal Data Protection Act, 2023 ("DPDP Act") and Digital Personal Data Protection Rules, 2025 ("DPDP Rules"), the European Union General Data Protection Regulation ("EU GDPR"), and the UK GDPR, the Data Fiduciary / Data Controller is: Ishan, trading as OneStudio, located in Pune, Maharastra, India.

No Fictional Corporate Department: Because OneStudio is operated by an independent proprietor and is not a Significant Data Fiduciary under Section 10 of the DPDP Act or an enterprise required to appoint a statutory Data Protection Officer under Article 37 of the GDPR, privacy inquiries and statutory grievances are handled directly by our designated Grievance & Privacy Contact: Ishan: Same As Contact Information at help@onestudio.digital.

We practice strict data minimization. Based on our actual Website codebase, we collect personal information only in the following ways:

• 1. Project Briefing & Contact Form Submissions (/contact): When you voluntarily submit a project brief, our API endpoint (/api/contact) collects your Name or Network Handle, Email Address, Discord Username, selected Project Discipline, Target Version/Stack, Platform/Environment, Estimated Budget Tier, Target Timeline, and Project Description.
• 2. Direct Communications & Commission Records: If you email us at help@onestudio.digital, open a support or commission ticket on our Discord server, or enter into a Custom Development Agreement, we process your communication history, project specifications, invoices, and payment confirmation records.
• 3. Automated Security, Rate-Limiting & Infrastructure Logs: When your browser requests pages or submits a form to /api/contact, our hosting infrastructure (Netlify) and server-side API route process your IP address, HTTP request headers (including Origin, Content-Type, and User-Agent), timestamp, and a transient cryptographic hash of your submission key (Idempotency-Key) to prevent duplicate webhook dispatches and enforce our rate limit of 5 requests per 10-minute window.
• 4. Strictly Necessary Local Storage: We store a single preference key (onestudio_cookie_consent_v1) in your browser's localStorage to remember that you acknowledged or configured the privacy banner. We do NOT run Google Analytics, Meta Pixels, TikTok trackers, session replay scripts, or third-party advertising cookies.
• 5. Self-Hosted Typography: Our Website uses Next.js build-time font optimization (next/font/google for IBM Plex Mono). Font files are downloaded at build time and served directly from our own domain so your browser does not send your IP address to Google Font servers when loading pages.

We process personal data solely for explicit, lawful purposes under the India DPDP Act 2023 (Sections 4, 6, and 7) and EU/UK GDPR (Article 6):

• Reviewing Project Briefs & Preparing Proposals: Processed on the basis of your affirmative consent (via the form consent checkbox under Section 6 of the DPDP Act) and taking steps at your request prior to entering into a contract (GDPR Art. 6(1)(b)).
• Performing Custom Development Contracts & Support: Processed as necessary for the performance of a contract with you (GDPR Art. 6(1)(b)) and for your voluntary provision of data for specified service delivery (DPDP Act Sec. 4 & 7(a)).
• Infrastructure Security, Abuse Prevention & Rate Limiting: Processed based on our legitimate interest in protecting the Website from DDoS attacks, bot spam, and duplicate webhook floods (GDPR Art. 6(1)(f) and India IT Act / CERT-In security obligations).
• Tax, Accounting & Legal Compliance: Retaining invoice and transaction records to comply with applicable Indian tax and accounting laws (GDPR Art. 6(1)(c) and DPDP Act Sec. 7(d)).

We never sell, rent, or trade your personal data to data brokers or advertisers. However, operating an online engineering studio requires trusted infrastructure providers ("Data Processors") that process data on our behalf:

• Netlify, Inc. (Website Hosting & Edge Delivery — United States / Global CDN): Hosts the Website, executes serverless API routes (/api/contact), and maintains standard HTTP access and security logs.
• Discord Inc. (Inquiry Triage & Community Support — United States): When you submit the project brief form on /contact, the sanitized payload is transmitted via an encrypted HTTPS webhook (DISCORD_WEBHOOK_URL) to a private, access-restricted internal OneStudio triage channel on Discord so our lead engineer can review your brief.
• Email & Invoicing Providers: Direct emails and commission invoices are processed through our email host and agreed payment providers ([ACCEPTED PAYMENT METHODS — e.g., PayPal Commercial Invoices, Wise, Stripe, or Bank/UPI Transfer]).
• Third-Party Marketplaces (BuiltByBit & SpigotMC): When you click an external link to purchase or download a plugin on BuiltByBit or SpigotMC, your account registration, checkout, and payment details are collected directly by those independent platforms under their own privacy policies. OneStudio only receives your marketplace username and purchase verification status.

OneStudio is operated from India, and our core infrastructure providers (Netlify and Discord) utilize servers located in the United States and global edge locations.

Under the India DPDP Act 2023 (Section 16), cross-border transfers are permitted to all jurisdictions except those specifically restricted by Central Government notification. For visitors located in the European Economic Area (EEA) or the United Kingdom, transfers of inquiry data to India or the United States are necessary to take pre-contractual steps at your explicit request (GDPR Art. 49(1)(b)) or are protected by standard data protection clauses maintained by our infrastructure processors (Netlify and Discord).

In accordance with Section 8(7) of the India DPDP Act 2023 and GDPR storage limitation principles, we retain personal data only as long as necessary to fulfill the purpose for which it was collected:

• Transient API Rate-Limit & Idempotency Records: Stored strictly in volatile server memory for ten (10) minutes (600,000 ms) and automatically pruned thereafter.
• Unconverted Project Inquiries: If a project brief submitted via /contact does not result in a commission, we retain the inquiry thread for up to twelve (12) months in case you resume the project, or delete it immediately upon your written erasure request.
• Active Commission & Invoice Records: Contracts, Statements of Work, and tax/payment invoices are retained for eight (8) years following the end of the relevant financial year as required under Indian income tax and accounting record-keeping rules.
• Browser Consent Preference (localStorage): Retained locally in your browser for 12 months or until you clear your site data.

We implement reasonable technical and organizational safeguards as required by Section 8(5) of the India DPDP Act 2023 and GDPR Article 32, including HTTPS/TLS encryption in transit, input sanitization (stripping dangerous HTML tags in /api/contact), payload size bounding (32KB maximum), strict Origin header verification, honeypot anti-bot traps, and two-factor authentication on studio accounts.

Personal Data Breach Notification: In the event of a confirmed personal data breach affecting your data, we will notify the Data Protection Board of India and affected individuals in accordance with Section 8(6) of the DPDP Act 2023 and Rule 7 of the DPDP Rules 2025, as well as applicable CERT-In and GDPR notification timelines.

Depending on your jurisdiction, you have enforceable rights over your personal data:

• Right to Access & Summary of Data (DPDP Act Sec. 11 / GDPR Art. 15): Request confirmation of what personal data we hold about you, a summary of processing activities, and the identities of processors with whom data has been shared.
• Right to Correction, Completion & Erasure (DPDP Act Sec. 12 / GDPR Arts. 16–17): Request correction of inaccurate details or complete deletion of your inquiry data where it is no longer necessary for an active contract or legal retention mandate.
• Right to Withdraw Consent (DPDP Act Sec. 6(4) / GDPR Art. 7(3)): Withdraw your consent to inquiry processing at any time with the same ease with which consent was given, by emailing help@onestudio.digital.
• Right of Grievance Redressal (DPDP Act Sec. 13): Register a privacy complaint directly with our Grievance Contact, who will acknowledge receipt within 48 hours and resolve the grievance within 30 days.
• Right to Nominate (India DPDP Act Sec. 14): If you are a Data Principal covered by the India DPDP Act 2023, you have the right to nominate another individual who may exercise your data rights in the event of your death or incapacity.
• Right to Object, Restrict, or Port Data & Lodge a Supervisory Complaint (EU/UK GDPR): EU/EEA and UK residents may object to legitimate-interest processing, request data portability, or lodge a complaint with their local Data Protection Authority (or the UK Information Commissioner's Office). Indian residents may escalate unresolved grievances to the Data Protection Board of India after exhausting our internal grievance mechanism.

Our commercial commission services are directed to adults (18 years and older). Under Section 9 of the India DPDP Act 2023, a "child" is defined as any individual under the age of eighteen (18) years, and processing a child's personal data requires verifiable parental consent. Under US COPPA and GDPR Article 8, restrictions apply to children under 13–16.

We do not knowingly engage in behavioral tracking or targeted advertising toward minors, nor do we knowingly collect personal data from individuals under 18 without the involvement and verifiable consent of a parent or legal guardian. If you are under 18 and wish to commission a project, your parent or legal guardian must submit the inquiry and contract on your behalf. If a parent or guardian believes a minor has submitted personal data without consent, please contact help@onestudio.digital and we will promptly delete the record.

To submit an access, correction, deletion, consent withdrawal, or nomination request, or to raise a privacy grievance, contact:

Grievance & Privacy Contact: Ishan: Same As Contact Information (Ishan, trading as OneStudio) | Email: help@onestudio.digital | Location: Pune, Maharastra, India.