Privacy Policy
How Aayaam Object Library collects, uses and protects personal data, written to the standard of India’s DPDP Act, 2023 and DPDP Rules, 2025.
Also read our Terms and Conditions.
Who we are
This Privacy Policy explains how Aayaam Object Library (“we”, “us”), a venture of The Zariya Collective, Nazirabad, Kolkata, West Bengal, India, collects and uses personal data. Under India’s Digital Personal Data Protection Act, 2023 (the “DPDP Act”) we are the Data Fiduciary for the data described here.
The DPDP Rules, 2025 were notified in November 2025 and their obligations take effect in phases. We follow them from now, and we also follow the Information Technology Act, 2000 and the Reasonable Security Practices and Procedures Rules, 2011 while they apply. Contact: [email protected].
Effective 16 October 2026. This version replaces any earlier privacy note on this site.
Notice at a glance
The short version. The sections below give the detail.
| What | Why | Basis | Kept for |
|---|---|---|---|
| Contact details and what you tell us | To reply, quote, schedule and deliver what you asked for | Your consent, or you gave it to us voluntarily for that purpose | See “How long we keep data” |
| Newsletter email | To send articles and updates you asked for | Your consent. Withdraw any time | Until you unsubscribe |
| Account data (when accounts are available) | To let you sign in and use features | Your consent and the service you request | While the account is active, plus up to 1 year of security logs |
| Records we must keep | To meet tax, accounting and legal duties | Legal obligation | As the law requires |
We do not sell personal data. We do not run advertising or build advertising profiles. You can withdraw consent, ask for your data, correct it or delete it by writing to [email protected].
What we collect and how
We collect only what we need.
What you give us
- Account details: your email address (your username), a password that we store only as a salted one-way hash, an optional name and profession, whether you want occasional update emails, and the time you accepted our Terms and Privacy Policy.
- Download records: which object and file you downloaded and when. We use them to apply fair-use limits and to give manufacturers aggregate download counts, never your identity.
- Emails we send you: confirmation and password-reset links, a notice when your password changes, and update emails only if you opted in.
What your browser sends automatically
When you visit, our hosting provider receives standard technical data such as your IP address, browser type, pages requested and time. This is used to deliver the site and keep it secure. We do not use it to identify you or profile you. We do not currently use analytics.
What we ask you not to send
Please do not send Aadhaar, PAN, passport, bank or card details, or passwords, by form, email or WhatsApp. We do not need them to answer an enquiry.
Searching and browsing do not require an account. We do not attach your searches to your profile.
Why we use your data and our basis
- To respond and provide what you asked for: replying to enquiries, quoting, scheduling, delivering work or training.
- To send updates you asked for: newsletters and announcements, only after you tick the consent box.
- To run and secure the service: keeping the site working, preventing abuse and fixing faults.
- To meet legal duties: tax, accounting and responding to lawful requests.
Our lawful basis is your consent (section 6 of the DPDP Act) or the “certain legitimate uses” in section 7, such as data you voluntarily gave us for a stated purpose, and compliance with law. Where we rely on consent, we ask for it separately and in plain language, and you can withdraw it as easily as you gave it.
Cookies and similar technologies
This site sets one strictly necessary cookie, aol_s, to keep you signed in. It lasts up to 30 days on that device and, after 90 days at most, you must log in again. We set no advertising cookies. If we add analytics, we will ask for your consent first and update this page.
Who we share data with
We share data only with service providers who help us run the site, and only as needed:
- Cloudflare, Inc. (hosting, content delivery, security, and the database behind our sign-up, enquiry and announcement system). Servers are in multiple countries.
- Resend (email delivery for confirmation and newsletter emails, United States).
- Meta Platforms (WhatsApp) when you choose to message us. WhatsApp’s own terms and privacy policy apply to that conversation.
- Google for email (Gmail) and web fonts. Loading fonts sends your IP address and browser details to Google.
- Professional advisers such as accountants and lawyers, under confidentiality.
- Authorities when the law requires it.
We do not sell, rent or trade personal data.
Transfers outside India
Some of our providers store or process data outside India. The DPDP Act allows this unless the Government restricts a country by notification. We choose providers that apply recognised security standards and we will stop transfers to any restricted country.
How long we keep data
| Data | Kept for |
|---|---|
| Account details | Until you delete your account, or 24 months after your last login (we email you before deleting an unused account) |
| Download records | Deleted with your account, otherwise 24 months |
| Confirmation and reset links | They expire within 1 to 48 hours and are then deleted |
| Account data (when accounts are available) | While the account is active. Accounts unused for 24 months are deleted after notice to you |
| Security and access logs | 1 year, to detect and investigate breaches, then deleted |
When the period ends or you withdraw consent, we delete the data or anonymise it, unless the law requires us to keep it. Backups are overwritten within a short period.
How we protect data
We use HTTPS, restrict administrative access with secret tokens, give staff and providers only the access they need, and keep personal data out of public pages. When accounts launch, passwords will be stored only as salted one-way hashes, and we will support stronger sign-in checks.
If a personal data breach occurs, we will tell the Data Protection Board of India and affected people as the DPDP Rules require, without delay, and tell you what happened, the likely effect and what you can do.
Children
Our services are for adults. We do not knowingly collect personal data of anyone under 18 without the verifiable consent of a parent or lawful guardian. We do not track or profile children or direct advertising at them. If you think a child has given us data, write to us and we will delete it.
Your rights and how to use them
- Access: ask for a summary of the personal data we hold about you and how we use it, and who we share it with.
- Correction and updating: ask us to correct or complete data.
- Erasure: ask us to delete data we no longer need.
- Withdraw consent: at any time. Withdrawal does not affect what we did before. Some services may stop if we cannot process the data they need.
- Grievance redressal: raise a complaint with us first (below).
- Nominate: name another person to exercise your rights if you die or become unable to.
Write to [email protected] or message +91 74396 51029 on WhatsApp from the number we hold for you. We may ask for details to confirm it is you. We aim to act within 30 days.
Accounts and sign-in
When you create an account we collect the details you give at sign-up (such as name, email and optionally phone), a password hash, and activity data needed to run the features you use (for example your download history). We record sign-in events and device data for security. You can ask us to delete your account at any time.
We ask for your consent at sign-up, show this policy before you submit, and record when you agreed.
Email and marketing
We send marketing email only with your consent, and we use double opt-in: after you sign up we email you a confirmation link and add you to the list only once you click it. Every email has an unsubscribe link and supports one-click unsubscribe. We keep a record of when and how you consented. If you unsubscribe, we keep only your email address on a suppression list so that we do not email you again.
Links to other sites
Our pages link to other sites, including the reading list. They have their own privacy practices. We are not responsible for them.
Changes to this policy
We will update this policy when our practices or the law change. The date at the top shows the latest version. We will tell you about material changes, and where the law requires it, ask for your consent again.
Grievance redressal and complaints
Grievance Officer: The Grievance Officer, The Zariya Collective, Nazirabad, Kolkata, West Bengal, India. Email [email protected]. WhatsApp +91 74396 51029.
We acknowledge complaints within 3 working days and aim to resolve them within 30 days. If you are not satisfied, you may complain to the Data Protection Board of India after you have used our grievance process.