Privacy Policy

India Compliance Overview

KALIYAZ is based in India and respects the Digital Personal Data Protection Act, 2023 (DPDP Act). This Privacy Policy explains how we collect, use, share, and protect your personal data. We process personal data only for lawful purposes and with appropriate consent where required. As a Data Fiduciary, we provide you with rights to access, correct, erase, and withdraw consent regarding your data.

Google Integrations & Data Practices

KALIYAZ integrates with certain Google services to improve functionality and user experience. These integrations were configured on June 4, 2026, and comply with Google's API Services User Data Policy, including Limited Use requirements.

1. Google OAuth (Sign-in)

If you choose to sign in with Google, we request only basic profile information: your name, email address, and profile picture URL. This data is used exclusively to:

• Create and authenticate your KALIYAZ account.
• Pre-fill your profile information (you can edit later).
• Link your account for future logins.

We do not request access to your Google Drive, Gmail, Calendar, Contacts, or any other Google service beyond basic profile info unless you explicitly enable additional features (like YouTube widgets).

2. YouTube Data API (Optional Widget)

If you enable the "YouTube Latest Video" widget on your KALIYAZ bio page, we request additional permission to read metadata from your YouTube channel. Specifically, we access:

• Your channel ID and basic channel info.
• Video titles, thumbnails, publish dates, and video URLs from your public uploads.

What we DO NOT access: private videos, unlisted videos (unless you own them and give permission), watch history, liked videos, subscriptions, comments, or any personal messages on YouTube.

How we use YouTube data: The video metadata is fetched in real-time and displayed on your bio page as a widget. We may cache it briefly (up to 24 hours) to reduce API calls. We never sell, share, or use YouTube data for any other purpose — it exists only to power the widget you requested.

3. Google Analytics 4

We use Google Analytics 4 to understand how visitors interact with KALIYAZ. This helps us improve the platform. Our GA4 implementation includes:

• IP anonymization — we do not store full IP addresses.
• No data sharing with Google for advertising — we disable all ads personalization and remarketing features.
• Data retention set to 14 months — after which it's automatically deleted.
• Consent mode enabled — GA4 only loads after you accept analytics cookies via our cookie banner.

Google Analytics collects aggregated information such as page views, referral sources, browser types, and approximate location (country/city level). It does not identify individual users personally.

Revoking Google Access

You can revoke KALIYAZ's access to your Google account at any time:

• Inside KALIYAZ: Go to Settings → Connections → Disconnect Google.
• Via Google: Visit Google Account Permissions and remove KALIYAZ.

Once revoked, we delete any Google-specific data (like YouTube video metadata) from our systems within 7 days.

Information We Collect

We collect several types of information to provide, maintain, and improve our Service:

A. Account Information

• Email address — used for login, notifications, and password resets.
• Username — displayed on your bio page and used for your profile URL (e.g., kaliyaz.com/@username).
• Password — stored as a salted hash; we never store plain-text passwords.
• Profile information — optional bio, profile picture, display name, and social links.

B. Content You Create

• Links — the URLs you add to your bio page (e.g., Instagram, Twitter, portfolio).
• Titles & descriptions — custom text for each link button.
• Background images — any image you upload as your page background.
• Theme preferences — color scheme, button style, layout choices.

C. Google & Third-Party Data (if connected)

• Google OAuth: name, email, avatar URL.
• YouTube (optional): channel ID, video titles, thumbnails, video URLs, publish dates.
• Analytics: anonymized IP, device type, browser, referring site, pages visited, time on site.

D. Usage & Technical Data

• IP address (anonymized in analytics; raw logs kept for security for 30 days).
• Browser type and version — to ensure compatibility.
• Operating system — for troubleshooting.
• Device identifiers (non-personal, for session management).
• Clickstream data — which links are clicked on your bio page (aggregated, not tied to individuals).
• Error logs — to debug technical issues.

E. Communications

• Support emails — when you contact us, we retain the conversation to assist you.
• Survey responses — if you voluntarily participate in feedback surveys.

How We Use Your Information

Your information enables us to run KALIYAZ and improve it over time. Specific uses include:

• Account management — creating your account, logging you in, sending password resets, and maintaining your settings.
• Bio page delivery — generating and serving your personalized link page to visitors.
• YouTube widget functionality — fetching and displaying your latest video(s) as you requested.
• Analytics & performance monitoring — understanding which features are used, fixing bugs, and optimizing load times.
• Security & fraud prevention — detecting brute force attacks, spam, or abusive behavior.
• Communication — responding to support inquiries, sending important service updates (e.g., downtime, security notices).
• Legal compliance — responding to lawful requests from authorities in India (under IT Act, DPDP Act) or other jurisdictions where we operate.

Cookies & Tracking Technologies

KALIYAZ uses cookies and similar technologies to enhance your experience. Here's what we use and why:

Strictly Necessary Cookies

• Session cookie — keeps you logged in as you navigate.
• CSRF token — prevents cross-site request forgery attacks.
• Consent preference — remembers your cookie choices (accept/decline analytics).

These cookies cannot be disabled because the Service would not function properly without them.

Analytics Cookies (Optional)

• Google Analytics cookies — only set after you click "Accept" on our cookie banner.
• You can decline analytics cookies without losing any core features.
• If you decline, we do not track your behavior via GA4.

How to Control Cookies

You can manage cookies through your browser settings (e.g., block all cookies, clear existing cookies). However, blocking necessary cookies will prevent you from staying logged in. Our cookie banner appears on your first visit; you can change your preference anytime by clicking the "Cookie Settings" link in the footer.

Data Sharing & Third Parties

We share your data only in limited circumstances and only with service providers who help us operate KALIYAZ. These providers are bound by confidentiality and data protection agreements.

Service Providers We Use

• Vercel / Cloudflare — hosting and content delivery network (logs may contain IP addresses for security).
• Supabase (PostgreSQL) — database hosting (all data encrypted at rest).
• Resend / SendGrid — transactional emails (welcome emails, password resets, notifications).
• Google (Analytics, OAuth, YouTube API) — as described in the Google section above.

Legal Disclosures

We may disclose your information if required by law, such as to comply with a subpoena, court order, or similar legal process from Indian authorities (under the Information Technology Act, 2000, or DPDP Act, 2023). Where possible and legally permitted, we will notify you before complying with such requests.

Business Transfers

If KALIYAZ is involved in a merger, acquisition, or asset sale, your data may be transferred as part of that transaction. We will notify you via email and/or a prominent notice on the Service before your data becomes subject to a different privacy policy.

Data Retention

How long we keep your data depends on the type of data and why we collected it:

• Account data (email, username, profile) — kept for as long as your account is active. When you delete your account, we remove or anonymize this data within 30 days.
• Bio page content (links, images, themes) — deleted within 30 days of account deletion.
• YouTube metadata (from API) — deleted within 7 days after you disconnect YouTube or delete your account. Cached data expires after 24 hours.
• Usage logs (IP, browser) — anonymized after 60 days; raw logs deleted.
• Support conversations — retained for 12 months after resolution, then deleted.
• Analytics (Google Analytics) — data retention set to 14 months, after which it is automatically purged by Google.
• Backups — database backups are kept for 30 days and then destroyed; backups are encrypted.

Your Privacy Rights

Depending on where you live (especially India, EEA, UK, California), you may have the following rights regarding your personal data:

Rights under India's DPDP Act, 2023

• Right to access — request a copy of the personal data we hold about you.
• Right to correction — update inaccurate or incomplete data.
• Right to erasure — delete your account and associated data.
• Right to withdraw consent — for processing based on consent (e.g., Google connection, analytics cookies).
• Right to grievance redressal — have your complaint reviewed by our designated contact.
• Right to nominate — nominate someone to exercise your rights on your behalf in case of death or incapacity.

Rights under GDPR (EEA/UK)

• Access, rectification, erasure, restriction, data portability, objection, and automated decision-making safeguards.

How to Exercise Your Rights

Email us at privacy@kaliyaz.com with your request. To protect your privacy, we may ask for verification (e.g., confirming your email address). We will respond within 30 days. You may also lodge a complaint with the Data Protection Board of India or your local supervisory authority.

Security Measures

We take security seriously and implement industry-standard measures to protect your data:

• Encryption in transit — all connections use TLS 1.3 (HTTPS).
• Encryption at rest — database is encrypted using AES-256.
• Password security — passwords are salted and hashed (bcrypt). We never store plain-text passwords.
• Regular updates — we apply security patches to our infrastructure promptly.
• Access controls — only authorized personnel can access production systems.

International Data Transfers

KALIYAZ is based in India, but we use service providers that may store or process data in other countries (e.g., United States, European Union). When we transfer personal data outside India, we take steps to ensure adequate protection, such as:

• Using providers that comply with GDPR or other recognized frameworks.
• Entering into Standard Contractual Clauses (SCCs) where required.
• Ensuring transfers are made only for legitimate purposes (hosting, email, analytics).

For Indian users, we note that your data may be transferred to servers outside India. By using KALIYAZ, you consent to such transfers.

Children's Privacy

KALIYAZ is not intended for children under the age of 13 (or under 18 in India without parental consent). We do not knowingly collect personal information from children. If you are a parent or guardian and believe your child has provided us with personal data, please contact us and we will delete it. Under India's DPDP Act, verifiable parental consent is required for processing children's data; we do not have such consent mechanisms, so children should not use KALIYAZ.

Changes to This Privacy Policy

We may update this policy from time to time to reflect changes in our practices, technology, or legal requirements. If we make material changes, we will notify you by:

• Sending an email to the address associated with your account (if you have one).
• Posting a prominent notice on the KALIYAZ website or dashboard.

The "Last revised" date at the top of this policy indicates when it was last updated. Your continued use of KALIYAZ after such changes constitutes acceptance of the revised policy. If you do not agree, you should delete your account and stop using the Service.