Effective date: [date] · Data Fiduciary: [Legal Entity Name], [address], India. Contact: [privacy@sunonovels.top]
1. What we collect
You give us:
| Data | Why |
|---|---|
| Phone number, or email and password | To create and secure your account; OTP login |
| Display name, profile photo, language | To personalise the app |
| Payment details — handled by our payment partner, not stored by us | To take payment |
| UPI reference / UTR and payment screenshot, if you use the manual payment option | To verify a payment a human approves |
| Creator KYC: legal name, PAN, bank or UPI details, address | Legally required to pay creators and withhold tax |
| Support messages, reports, copyright complaints and counter-notices | To handle your request |
We collect as you use the service:
| Data | Why |
|---|---|
| What you play, for how long, where you stopped | Resume playback, recommendations, and to pay creators |
| Purchases, entitlements, refunds | To give you what you paid for and to keep accounts |
| Device id, model, OS version, app version | Session security, device limits, crash diagnosis |
| IP address and coarse location derived from it | Fraud prevention, tax place-of-supply, regional catalogue |
| Downloads, quality settings, data used | To make the features work |
| Crash and performance logs | To fix the app |
We do not collect your contacts, photos, precise GPS location, microphone, or any other data the app does not need. We do not use third-party advertising trackers.
2. Why we may lawfully use it
We process personal data on the basis of the consent you give when you sign up and when you enable a feature, and where processing is necessary to provide a service you have asked for, to comply with a legal obligation (tax, copyright, court orders), or for our legitimate interest in preventing fraud and abuse. You may withdraw consent at any time — see section 7.
3. Who we share it with
- Payment partner ([Razorpay]) — to process payments and refunds.
- SMS and email providers — to send OTPs, receipts, and service notices.
- Cloud infrastructure ([Cloudflare], [DigitalOcean]) — to host and deliver the service.
- Analytics and crash reporting ([Sentry]) — self-hosted or configured without advertising identifiers.
- Tax and legal authorities — where required, and in response to a valid order.
- The other party in a copyright dispute. This one is deliberate and you should read it twice: if you file a copyright complaint, your identity and contact details are given to the uploader. If you file a counter-notice, your legal name, address, email and phone are given to the complainant, because the law requires the complainant to be able to bring proceedings against you. This is set out again in the Copyright and Rights Policy.
We do not sell personal data. We do not share it for anyone else's advertising.
4. What creators and the public can see
- Creators see aggregate statistics: play counts, listening minutes, completion rates, subscriber counts, coarse geography. They never see your identity, your phone, your email, or your individual listening history.
- Your display name and photo are visible if you post a rating or review.
- Nothing else about your listening is public.
5. Where it is stored and for how long
Data is stored on servers in [region] and on Cloudflare's network. We keep it as follows:
| Data | Retention |
|---|---|
| Account and profile | While your account exists, then 30 days |
| Listening history and progress | While your account exists, then anonymised |
| Aggregate statistics (no identity) | Indefinitely |
| Payment records, invoices, tax documents | 8 years — required by Indian tax law |
| KYC documents | Duration of the creator relationship + 8 years |
| Copyright complaints, counter-notices, dispute records | 7 years after resolution |
| Support tickets | 3 years |
| Server and access logs | 90 days |
| Crash logs | 180 days |
Deleting your account does not delete records we are legally required to keep.
6. How we protect it
- Encryption in transit (TLS) everywhere, and at rest for the sensitive fields — phone, email, payment references, KYC documents.
- KYC documents and payment proofs are stored in private storage that is never served through the public media path, and are readable only by named staff, with every access logged.
- Passwords are hashed with argon2id. We never store payment card details.
- Access to production data is role-limited, audited, and requires re-authentication for anything that touches money or grants access.
- We will notify you and the Data Protection Board of a personal data breach as required by DPDP.
7. Your rights
Under DPDP you may:
- Access a copy of your personal data — in-app, from Settings → Privacy → Download my data.
- Correct anything inaccurate — in-app.
- Erase your data and close your account — Settings → Privacy → Delete my account. Your data is deleted within 30 days, except records we must keep (section 5).
- Withdraw consent — as easily as you gave it; note that most of the service stops working without it.
- Nominate another person to exercise your rights if you die or become incapacitated.
- Complain to us first, and to the Data Protection Board of India if we do not resolve it.
Exercise any of these in the app, or email [privacy@sunonovels.top]. We respond within 15 days.
8. Children
The service is for adults. We do not knowingly collect data from anyone under 18 without verifiable parental consent, and we will delete such data promptly if we discover it. Content is rated, and mature works are gated.
9. Cookies and similar
The website uses only what is necessary to keep you signed in and to remember your settings, plus first-party analytics without advertising identifiers. No third-party advertising cookies. You can decline non-essential storage; the site works without it.
10. Changes
We will tell you in the app and by email at least 14 days before a material change takes effect, and we will say what changed.
11. Who to contact
- Privacy / Data Protection Officer: [Name], [privacy@sunonovels.top], [postal address].
- Grievance Officer (IT Rules, 2021): [Name], [grievance@sunonovels.top], [postal address], [phone]. Acknowledgement within 24 hours; resolution within 15 days.