Data Privacy & Encrypted Vault Security
Privacy Policy & Data Protection
How PiximPlanet protects your personal information, encrypts your credentials with AES-256-GCM, and processes payments securely via Razorpay.
Vault Encryption
AES-256-GCM
All subscription credentials and keys stored in /downloads/ are encrypted at rest in our database.
Own-Email Upgrades
0 Passwords
We never ask for your personal email password when upgrading your own email via official workspace invite.
Payment Gateway
Razorpay PCI-DSS
Card numbers, CVV codes, and UPI PINs are handled 100% by Razorpay and never touch our servers.
Third-Party Marketing
0% Data Sold
PiximPlanet never sells, rents, or trades your email address or order history to external advertisers.
01. Minimal Personal Data We Collect & Plain-Language Purpose
DPDP Act Section 5 & 6In compliance with India's Digital Personal Data Protection (DPDP) Act, 2023, PiximPlanet collects only the minimum personal data strictly required for clear, lawful purposes:
- Account Identity & Profile Data (`Name, Email Address, Optional City/Country`): Collected when you register at /login/ (or sign in via Google OAuth) strictly to create your buyer profile, send 6-digit login OTPs, and unlock your My Purchases Vault (/downloads/).
- Order, Target Upgrade Email & Billing Reference (`Plan, INR Amount, Razorpay ID / UTR`): Collected at /checkout/ strictly to provision your digital subscription or downloadable file, send your official Own-Email invite, and maintain your
1:1 INRStore Wallet (/wallet/) ledger. - Live Support & Warranty Tickets (`Name, Email, Chat Messages, Optional Screenshots`): Collected only when you message Riya in Live Support or submit a form on /contact-us/ strictly to resolve your support or warranty claim.
02. AES-256-GCM Encrypted Vault & Zero Email Passwords
Vault Security- Encrypted at Rest (`AES-256-GCM`): Every Dedicated Vault Account username, password, and activation key delivered to My Purchases (/downloads/) is encrypted in our database using authenticated
AES-256-GCMencryption with unique initialization vectors and authentication tags. - Authenticated On-Demand Decryption: Credentials are only decrypted in memory when you are signed in as the verified buyer of that order and click View Credentials inside /downloads/.
- Zero Personal Email Password Rule: When you choose Own Email Upgrade, our team sends an official workspace invitation link to your email address. PiximPlanet support will never ask for your personal email password.
03. Un-Ticked Consent & 1-Click Consent Withdrawal
DPDP Act Section 6- Zero Pre-Ticked Boxes: Optional promotional email updates on /login/?tab=register and /account-settings/ are unchecked (`OFF`) by default. We never bundle hidden marketing consent into account registration.
- Withdraw Consent as Easily as Giving It: Signed-in buyers can turn off optional product emails in 1 click on /account-settings/, or use the dedicated DPDP Privacy, Consent Withdrawal & Data Rights card on /account-settings/.
- 1-Click Data Export, Correction & Permanent Account Erasure: Edit your profile anytime at /account-info/, or submit a 1-click consent withdrawal / permanent account erasure request at /contact-us/?topic=data_erasure (completed within 7 business days).
04. Children's Personal Data (Under-18 Protection Rule)
DPDP Act Section 9- 18+ Age Requirement & Verifiable Parental Consent: PiximPlanet is designed for individuals 18 years of age or older. Users under 18 years of age may only create an account or place an order with verifiable consent and direct supervision from a parent or legal guardian.
- Zero Child Tracking or Behavioral Profiling: PiximPlanet strictly prohibits behavioral monitoring, tracking, or targeted advertising directed at children under Section 9(3) of the DPDP Act.
- 24-Hour Guardian Deletion Protocol: If a parent or legal guardian discovers that a child under 18 has provided personal data without verifiable consent, email [email protected] and we will permanently erase the account and associated personal data within 24 hours.
05. Data Retention Schedule — How Long We Keep Each Category of Data
DPDP Act Section 8(7)We retain personal data only for as long as necessary to fulfill the stated purpose or comply with mandatory Indian tax/audit laws, after which it is automatically deleted or anonymized:
| Data Category | Why We Collect It | Exact Retention Period | Deletion / Erasure Action |
|---|---|---|---|
| Account Profile Data (Name, Email, Avatar, Optional City/Country) | Buyer authentication, Vault access & account recovery | While Account Is Active (or max 36 Months of inactivity after a 30-day reminder notice) | Permanently erased within 7 Business Days of a withdrawal/deletion request at /contact-us/?topic=data_erasure |
| Encrypted Vault Credentials ( AES-256-GCM Logins in /downloads/) | On-demand credential viewing & warranty replacement during your plan | Active Plan Term + 90 Days post-expiry for renewal/reference | Encrypted ciphertexts are permanently purged 90 days after subscription expiry |
| Order & Payment Reference Ledgers (Order #, INR Paid, Razorpay Ref / UTR) | Order history, Store Wallet accounting & statutory tax/accounting compliance | 8 Financial Years (as required under Indian Income Tax & GST audit rules) | Kept in isolated read-only accounting archives; never used for marketing |
| Live Support Chat & Ticket Attachments (Riya Chat Logs & Error Screenshots) | Resolving support inquiries, 24h SLA checks & warranty claims | 180 Days (6 Months) after ticket or chat resolution | Automatically purged from support tables and media storage after 180 days |
| 6-Digit Login OTPs & Security Audit Logs (OTP Codes, Vault Reveal IP & Timestamp) | Passwordless/2FA login verification & anti-fraud protection | 10 Minutes for OTP codes · 90 Days for security/UTR audit logs | OTPs expire in 10 minutes; security logs auto-rotate and delete after 90 days |
06. Who We Share Data With — Authorized Service Processors Only (0% Sold)
Transparent DisclosurePiximPlanet never sells, rents, or trades your personal data to advertisers or data brokers. We share strictly limited technical data only with the essential infrastructure processors required to complete your checkout and deliver your order:
| Service Partner / Processor | Role & Purpose | Exact Data Shared | Security & Privacy Standard |
|---|---|---|---|
| Razorpay Software Pvt. Ltd. (India) | Official INR Payment Gateway (UPI, GPay, PhonePe, Paytm, Cards, NetBanking) | Order ID, INR amount, and billing email/phone entered inside the Razorpay modal | PCI-DSS Level 1 Certified · Card/UPI PINs never touch PiximPlanet servers |
| Google LLC (OAuth 2.0 & Gmail SMTP) | Optional 1-Click Google Sign-In & transactional OTP / order email delivery | Verified email address & display name (only when you click Continue with Google or receive store emails) | OAuth 2.0 / TLS 1.3 Encrypted · Zero access to your Google password |
| Cloudflare, Inc. & Hostinger Cloud | Edge SSL/TLS 1.3 encryption, DDoS protection & encrypted database hosting | Visitor IP address and HTTP request headers for firewall/bot filtering | ISO 27001 / SOC 2 Certified · 256-Bit HTTPS transport encryption |
| Third-Party Advertisers & Data Brokers | External ad targeting, cold-call lists, or cross-site behavioral profiling | NONE (0% Shared) | Strictly Prohibited under PiximPlanet Privacy Charter |
07. Technical Security Safeguards & Breach Protocol
DPDP Act Section 8(5)–(6)- End-to-End 256-Bit SSL / TLS 1.3 Encryption: Every page, login request, checkout session, and Vault API call on
https://piximplanet.comis forced over HTTPS with Strict-Transport-Security (HSTS) and Cloudflare WAF protection. - Authenticated Database Encryption & Hashing: Buyer passwords use salted cryptographic hashing, and all delivered Vault credentials use authenticated
AES-256-GCMencryption with strict role-based access control. - Statutory Data Breach Notification Protocol: In the unlikely event of a personal data breach affecting your account, PiximPlanet will immediately rotate affected credentials and notify both impacted users and the Data Protection Board of India (DPBI) in accordance with Section 8(6) of the DPDP Act.
08. Designated Grievance & Data Protection Officer
DPDP Act Section 13If you have any questions, wish to exercise your Data Principal rights (access, correction, consent withdrawal, or erasure), or want to file a privacy grievance, contact our Designated Grievance Officer directly:
- Name & Designation: Riya Sharma — Designated Grievance & Data Protection Officer, PiximPlanet Official Store
- Official Grievance Email & Phone: [email protected] · Phone / WhatsApp Desk: +91 98114 27635 (Connaught Place, New Delhi – 110001, India)
- 1-Click Online Escalation & SLA: Submit via /contact-us/?topic=grievance — acknowledged within 24 hours and resolved within 7 business days (max 15 days statutory ceiling).
