Privacy Policy

Qalakar is an artist identity platform that helps Indian artists create a professional public profile, share their work, and receive booking enquiries.

For the purposes of the General Data Protection Regulation (GDPR) and India's Digital Personal Data Protection Act 2023 (DPDP Act), Qalakar acts as the Data Controller and Data Fiduciary for personal data processed through this service.

Contact us: hello@qalakar.com

We collect only the data needed to run the service. This falls into two categories:

We use your personal data for the following purposes:

• Providing the artist profile service — creating and displaying your public profile, enabling bookings enquiries, and delivering account-related notifications (e.g. password reset, new enquiry received).
• Security and abuse prevention — detecting spam, bot traffic, and unauthorised access attempts using IP addresses and device signals.
• Service improvement — aggregated, anonymised page-view analytics help us understand which features are useful and where to focus development effort.
• Marketing communications — occasional product updates or feature announcements, only if you have given explicit consent and only via the email address you registered with.

For users in the European Economic Area or the United Kingdom, we rely on the following lawful bases:

• Performance of a contract (Art. 6(1)(b)): processing your name, email, phone, bio, photos, and city is necessary to create and operate your artist account and public profile.
• Legitimate interests (Art. 6(1)(f)): server-side analytics and security monitoring are in our legitimate interest to keep the service working reliably and safely, and do not override your fundamental rights.
• Consent (Art. 6(1)(a)): marketing emails are sent only if you have opted in. You may withdraw consent at any time by contacting hello@qalakar.com or clicking the unsubscribe link in any marketing email.

• Account and profile data (name, email, phone, bio, photos, city): retained for as long as your account is active. When you delete your account, this data is permanently erased within 30 days.
• Page-view records: purged on a rolling 90-day basis. We retain only aggregated, non-identifiable counts beyond that window.
• Booking enquiry and lead data: retained for 24 months from the date the enquiry was submitted, to allow artists and prospective clients to reference past conversations.
• Session data: purged automatically when the session expires or when you sign out.
• Security logs (IP address, device info): retained for 90 days and then deleted unless a specific incident requires longer retention.

Under the GDPR (Articles 15–22) and India's DPDP Act 2023 (Sections 11–13) you have the following rights over your personal data:

• Right of access: you can ask us for a copy of the personal data we hold about you.
• Right to rectification: you can ask us to correct inaccurate or incomplete data. Most profile data can be updated directly in your dashboard.
• Right to erasure (“right to be forgotten”): you can ask us to delete your personal data. You can also do this yourself by deleting your account in the dashboard.
• Right to data portability: you can ask us to provide your data in a structured, machine-readable format so you can transfer it to another service.
• Right to restriction: you can ask us to pause processing your data while a dispute is resolved.
• Right to object: you can object to processing based on legitimate interests at any time.
• Right to withdraw consent: where we rely on consent (e.g. marketing emails), you can withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, email us at hello@qalakar.com. We will respond within 30 days. We may ask you to verify your identity before fulfilling a request.

If you are in the EU/EEA, you also have the right to lodge a complaint with your local data protection authority. If you are in India, you may file a complaint with the Data Protection Board of India once it is established under the DPDP Act 2023.

We do not sell your personal data. We share it only with the sub-processors listed below, each of whom is bound by a data processing agreement and provides appropriate technical and organisational security measures.

We may also disclose personal data if required by applicable law, court order, or a legitimate request from a government authority, and only to the extent strictly necessary.

Because our infrastructure providers (Vercel, Neon, Resend) are headquartered in the United States, your personal data may be processed outside India and, if you are in the EU/EEA, outside the European Economic Area.

For transfers from the EU/EEA we rely on the European Commission's Standard Contractual Clauses (SCCs) as the appropriate safeguard. For transfers from India we comply with the applicable cross-border transfer provisions of the DPDP Act 2023 and any rules notified thereunder.

You may request a copy of the relevant transfer mechanism by emailing hello@qalakar.com.

Qalakar operates as a Data Fiduciary as defined under the Digital Personal Data Protection Act 2023 (DPDP Act). We process personal data on the basis of consent and for legitimate uses as permitted by the Act.

We are committed to:

• Processing personal data only for the purposes for which it was collected or as permitted by law.
• Implementing reasonable security safeguards to prevent personal data breaches.
• Notifying the Data Protection Board of India and affected Data Principals in the event of a significant data breach, in accordance with the Act.
• Honouring Data Principal rights including the right to access, correction, erasure, and nomination (as these provisions come into force).

Grievance Officer: For complaints or grievances under the DPDP Act 2023, please contact our Grievance Officer at grievance@qalakar.com. Alternatively, you may also reach us at hello@qalakar.com. We will acknowledge your complaint within 48 hours and endeavour to resolve it within 30 days.

We use a minimal number of cookies. We do not use third-party advertising cookies or browser-based analytics cookies.

• Session cookie — an HTTP-only, secure, same-site cookie that keeps you authenticated while you are signed in. It is deleted when you sign out or when the session expires. This cookie is strictly necessary for the service to function.
• Locale preference cookie — a small cookie that remembers your chosen language (e.g. English or Gujarati) so you do not have to reselect it on every visit. No personal data is stored in this cookie.

All analytics are computed server-side from server logs. We do not embed any tracking pixels, fingerprinting scripts, or third-party analytics SDKs that execute in your browser.

You can configure or block cookies through your browser settings at any time. Blocking the session cookie will prevent you from signing in.

Qalakar is intended for users who are 18 years of age or older. We do not knowingly collect personal data from anyone under 18. If you believe we have inadvertently collected data from a minor, please contact us immediately at hello@qalakar.com and we will delete the data promptly.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or applicable law. When we make a material change — for example, collecting a new category of data or sharing data with a new sub-processor — we will notify registered users by email at least 14 days before the change takes effect.

The updated policy will be posted at this URL with a revised “Last updated” date. Continued use of the service after the effective date constitutes acceptance of the updated policy.

If you have any questions about this policy or about how we handle your personal data, please get in touch:

• General enquiries and data rights requests: hello@qalakar.com
• DPDP Act grievances: grievance@qalakar.com

We aim to respond to all requests within 30 days.