1. Introduction and scope
This Privacy Policy (the "Policy") explains how Amaya Kavya ("Amaya Kavya", "he", or "his") collects, uses, discloses, retains, and protects personal data when a visitor ("you") accesses or interacts with the website at https://amayakavya.com and its subpages (the "Site"). It applies worldwide and is intended to comply with the European Union and United Kingdom General Data Protection Regulation (the "GDPR"), India's Digital Personal Data Protection Act, 2023 (the "DPDP Act"), the California Consumer Privacy Act as amended by the California Privacy Rights Act (the "CCPA" and "CPRA"), and comparable data protection frameworks. Where a law that applies to you grants you greater rights than this Policy describes, that law prevails.
2. Data controller and contact
Amaya Kavya is the data controller, and under the DPDP Act the Data Fiduciary, responsible for the Site, and operates it in a personal capacity from Mumbai, India. Questions, requests, or grievances regarding personal data may be raised through the contact page or the profiles listed in the about section, which serve as the channel for grievance redressal for the purposes of the DPDP Act.
3. Summary
The Site is a personal portfolio. It does not sell personal data, does not serve advertising, does not run profiling analytics, and does not set advertising or tracking cookies. The only personal data Amaya Kavya actively receives is what you choose to submit through the contact form. Everything else is the limited, standard technical data that any website and its host must process in order to deliver pages securely. Two Attic pages load content from a third party: the Photography page (/attic/photography) shows photographs served from Cloudinary, an image host, and the music page embeds click-to-load Apple Music players. When a photo loads, Cloudinary receives your IP address and standard request data but sets no cookies; opening an Apple Music player lets Apple collect limited information within the player. Both are described in section 5.
4. Categories of personal data collected
4.1 Information you provide
When you complete and submit the contact form, you provide your name, email address, subject, a stated reason for contact, and message, and you may optionally provide an organisation name. Any further personal data you include in the free-text message is provided at your own discretion.
4.2 Information collected automatically
When you visit the Site, the hosting provider automatically receives standard technical data needed to serve and secure the Site, which may include your Internet Protocol (IP) address, browser type and settings, device and operating system information, the page that referred you, and the date and time of access, recorded in server logs.
4.3 Local storage on your device
The Site is a Progressive Web App and may store files in your browser cache by means of a service worker, so that pages load quickly and remain available offline. It may also save small items of functional data in your browser's local storage, such as your best scores in the Play section and whether game sound is muted, under keys that begin with "ak-". This information stays on your device, is not transmitted to Amaya Kavya, and can be cleared at any time through your browser settings. Separately, the Apple Music web players embedded on the Attic music page may store their own cookies or data, set by Apple within a player once you choose to load it; that storage is described in section 5 and governed by Apple's own policy.
5. Service providers and third parties
Amaya Kavya relies on a small number of third-party service providers (the "processors") to operate the Site, and does not otherwise share personal data with third parties, except where required by law. Each processor acts on documented instructions and under its own published privacy terms. The categories below describe their roles. The identity of any specific processor will be disclosed to you on request. The Site self-hosts its typeface and embeds no third-party fonts, scripts, advertising, analytics, or social media widgets. The only third-party content loaded into any page is on the Attic: photographs served from Cloudinary on the Photography page, and the click-to-load Apple Music players on the music page, both described below. Every other page loads nothing from a third party, so visiting it does not expose your data to any further party.
- Hosting and form processing. A third-party hosting and deployment provider serves the Site and operates the contact form. Server logs and contact form submissions are processed and stored on that provider's infrastructure on Amaya Kavya's behalf.
- Source code and deployment. The Site's source code is maintained on a third-party version control and deployment platform that builds and publishes the Site, and which may, in the ordinary course of operation, process limited technical request data.
- Search engine tools. Amaya Kavya uses the webmaster and indexing tools of one or more search engines to understand how the Site appears in search results. These tools provide aggregated, non-identifying statistics to Amaya Kavya, while any underlying search and click data is processed by the search provider on its own infrastructure and under its own terms.
- Image hosting (Cloudinary). Photographs on the Attic photography page (/attic/photography) are stored and delivered by Cloudinary, a third-party image hosting and content delivery service that optimises and serves each image. When the page loads, your browser requests the images directly from Cloudinary, so it receives your IP address and standard request data, such as browser and device information, the referring page, and the time of the request. Cloudinary sets no cookies through these images and does not receive anything you enter on the Site; it processes this limited technical data as Amaya Kavya's image host and under its own privacy policy at cloudinary.com/privacy.
- Embedded media player (Apple Music). The Attic music page (/attic/music) embeds Apple Music web players, which are served and controlled by Apple. Each player is click-to-load, so nothing from Apple loads until you tap to open it; once you do, Apple may store cookies or similar data in the player and collect limited information, including the domain of the embedding page, your browser or device information, general geographic location derived from a truncated IP address, and what you play, associated with a random identifier that resets after one day and is not linked to an Apple ID. If you are signed in to Apple Music in your browser, related activity may be associated with your Apple ID. Amaya Kavya does not receive this information; Apple handles it under its privacy policy at apple.com/privacy.
These providers operate internationally, including in the United States. Where personal data is transferred outside your jurisdiction, it is done in reliance on recognised safeguards such as the European Commission's Standard Contractual Clauses or an equivalent mechanism offered by the provider. A complete list of the current processors and the safeguards applied is available on request.
6. Purposes and legal bases for processing
Amaya Kavya processes personal data only for the purposes and on the legal bases set out below, as required by Article 6 of the GDPR and the corresponding provisions of other applicable laws.
- To respond to your enquiry. Contact form data is processed to read and reply to your message. The legal basis is your consent, which you give by submitting the form, and, where relevant, the taking of steps at your request before entering into any arrangement. You may withdraw consent at any time.
- To operate and secure the Site. Technical and log data is processed to deliver pages, maintain availability, and prevent abuse or attack. The legal basis is Amaya Kavya's legitimate interest in running a functioning, secure website, and the legitimate uses permitted under the DPDP Act.
- To comply with law. Personal data may be processed where necessary to meet a legal obligation or to establish, exercise, or defend a legal claim.
7. Cookies and tracking technologies
The Site does not set advertising, analytics, or profiling cookies, and does not track you across other websites. It uses no third-party analytics. Because no non-essential cookies are used, no cookie consent banner is required. Any storage the Site itself uses is strictly necessary or functional, as described in section 4.3, and none of it is used to track you or build a profile. The photographs served from Cloudinary on the Attic photography page set no cookies; loading them only reveals your IP address and standard request data to Cloudinary, as described in section 5. The Apple Music web players embedded on the Attic music page are click-to-load and may set their own cookies or local storage only once you choose to open one; that storage belongs to Apple and is described in section 5.
8. Data retention
Contact form submissions are retained only for as long as needed to handle your enquiry and any reasonable follow-up, after which they are deleted, unless a longer period is required to comply with a legal obligation or to defend a legal claim. Server logs are retained by the hosting provider for a limited period in the ordinary course of operations. You may request deletion of your data at any time, as described in section 10.
9. Your rights
Subject to the law that applies to you, you have some or all of the following rights regarding your personal data.
9.1 Rights under the GDPR (European Union and United Kingdom)
You have the right of access, rectification, erasure (the "right to be forgotten"), restriction of processing, data portability, and objection to processing, as well as the right to withdraw consent at any time without affecting processing carried out before withdrawal, and the right to lodge a complaint with your local supervisory authority.
9.2 Rights under the DPDP Act (India)
You have the right to access a summary of your personal data and its processing, the right to correction, completion, updating, and erasure, the right to grievance redressal, and the right to nominate another individual to exercise your rights in the event of death or incapacity.
9.3 Rights under the CCPA and CPRA (California)
You have the right to know what personal information is collected and how it is used, the right to access and delete it, the right to correct inaccurate information, and the right to opt out of the sale or sharing of personal information. Amaya Kavya does not sell or share personal information as those terms are defined under the CCPA and CPRA, and will not discriminate against you for exercising any right.
9.4 Other jurisdictions
Visitors covered by other frameworks, such as Brazil's LGPD or Canada's PIPEDA, may exercise the equivalent rights granted to them under those laws.
10. How to exercise your rights
To exercise any right, contact Amaya Kavya through the contact page or a profile in the about section. A reasonable request will be honored without charge and within the time required by the applicable law. Amaya Kavya may ask for information sufficient to verify your identity before acting on a request, in order to protect your data from unauthorised access.
11. Security
The Site is served only over an encrypted connection (HTTPS) and applies a set of modern security protections. While no method of transmission or storage is completely secure, reasonable technical and organisational measures are maintained to protect personal data against unauthorised access, loss, or misuse.
12. Children
The Site is not directed to children, and Amaya Kavya does not knowingly collect personal data from a child as defined by the law that applies to the visitor, including any person under the age of eighteen under the DPDP Act and any person under the age of sixteen under the GDPR. If you believe a child has provided personal data, contact Amaya Kavya and it will be deleted.
13. Do Not Track and external links
Because the Site performs no cross-site tracking, no action is taken in response to browser Do Not Track signals, as there is no tracking to disable. The Site links to external destinations, including research repositories, ColleNet, and Seerandra, which are governed by their own privacy policies and lie outside Amaya Kavya's control.
14. Changes to this Policy
This Policy may be updated from time to time to reflect changes in practice or law. The "Last updated" date above indicates the latest revision, and continued use of the Site after a change takes effect constitutes acceptance of the revised Policy.
15. Governing law
This Policy is governed by the laws of India, without prejudice to any mandatory data protection rights you hold under the laws of your own country of residence.