Privacy Policy

Eye Candy Studio Private Limited, operating as “The Transformers” (“we”, “us”, “our”), decides why and how your personal data is used, and is responsible for it. It is a company registered in India (CIN U62099GJ2026PTC172474), with its registered office at Floor 4, 30/B-405, Monalisa Commercial, Wing B, Sri Lakshmi Narayan Mandir Marg, Manjalpur, Vadodara, Gujarat 390011, India.

This policy is written to meet the Information Technology Act, 2000 and its rules on sensitive personal data, and the Digital Personal Data Protection Act, 2023 and its Rules as they come into force.

It covers personal data we collect through thetransformers.co, our client portal, our website chat and WhatsApp, our forms and lead forms on Facebook and Instagram, email, phone and our sessions with you. It does not cover other companies' websites or apps, even if we link to them.

We collect only what we need. Here is what, and why:

• When you enquire or book: your name, email, phone, business name and anything you tell us, such as your role, sector or what you want to fix. We use it to reply to you and to arrange and run your call or Walk-In.
• When you take our scorecard: your answers and contact details. We use them to prepare and send your result.
• When you chat with us on the website or WhatsApp: your messages and your WhatsApp number and name. We use them to answer you and to hand you to our team when needed.
• When you pay: your payment status, amount and order reference from Razorpay. We never receive your card, UPI or bank details. We use it to confirm your booking and issue your invoice.
• When you use the client portal: your sign-in email or phone, messages, files you upload, approvals, and billing details such as GSTIN and billing address. We use them to deliver your engagement and to invoice you.
• When you sign an agreement: the details in the agreement and the e-signing record from Leegality. Aadhaar-based signing is handled by Leegality and its licensed e-sign provider. We do not receive your Aadhaar number.
• When you submit a Facebook or Instagram lead form: the details you choose to give in it, which Meta passes to us.
• When you use our website: pages viewed, the link or campaign that brought you, browser and device type, and errors on the page. We use this to understand how the site is used and to fix problems.
• Our servers also record technical data such as IP addresses, to keep the service secure.

We use your data only for the purpose you gave it for, for keeping our service secure, and to meet our legal duties, such as keeping tax records. We rely on your consent where the law requires it, and you can withdraw it at any time (see section 11).

We send marketing only if you opt in. The opt-in box is never ticked for you. You can opt out at any time: reply STOP on WhatsApp, use the unsubscribe link in any marketing email, or write to us.

Messages about your booking, payment, session, portal sign-in codes and invoices are part of the service, not marketing, so they continue while you use our service.

• Our website chat and WhatsApp are answered first by an AI assistant. It always says it is an AI. Ask for a person at any time and our team takes over.
• The assistant sees the messages in that conversation. For clients, it also reads messages you send in the client portal, to draft a reply that our team reviews before sending.
• Your messages are sent to OpenRouter, Inc. (USA), which passes them to the AI model's host. We have set our account so that messages go only to hosts that keep no copy of them and never use them to train AI models.
• We do not send your payment details or the files you upload to the AI providers.
• We keep chat transcripts as part of your enquiry or client record (see section 10). Please do not share passwords, card details or health information in a chat.

• We measure how our website is used with Ping, our own analytics service, which runs on our own server (ping.superhomes.app). It stores a random visitor ID in your browser's local storage, so we can tell a returning visitor from a new one.
• Ping receives the pages you view, the site that sent you, your browser and device type, the steps you take in our booking and enquiry forms (for example, that a call was booked), and errors on the page. Before a page address is sent, we remove everything after the “?” except campaign tags, and replace the private codes in payment, signing and scheduling links. We never send your name, email, phone number or the contents of a form to Ping.
• While you browse, we remember the link or campaign that brought you, so we know which of our pages and ads work. This is kept only until you close the tab.
• Our client portal stores a sign-in token in your browser so you stay signed in.
• We do not use advertising cookies or tracking pixels on our website.
• You can clear or block these in your browser settings. The website still works, but you will need to sign in to the portal again.

We never sell your personal data. We share it only with service providers who help us run our service, and only as much as they need:

• Razorpay (payments) and Leegality (e-signing agreements), in India.
• Meta (WhatsApp messages and Facebook and Instagram lead forms). Meta also uses data for its own purposes under its own privacy policy.
• MessageCentral (SMS sign-in codes).
• OpenRouter and the AI model hosts it routes to (our AI assistant, see section 5).
• Vercel (website hosting), our server host in France, and Cloudflare (backups).

Our application servers are in France, and some of our service providers process data in other countries, including the USA. We transfer data outside India only where Indian law allows it, and we require our providers to protect it.

Wherever we share data, we may also disclose it where the law requires, for example to a court or government authority, or to protect our rights, our clients or the public. If our business is sold or merged, your data would pass to the new owner under this policy.

• All connections to our website, portal and services are encrypted.
• Our team signs in with a password and a code sent by email. Passwords are stored only in hashed form. Clients sign in with one-time codes.
• Files you upload are private, and shared only through links that expire.
• Only team members who need your data to serve you can see it.
• Our daily backups are stored with Cloudflare, which encrypts them.

No system is completely secure. If a breach affects your personal data, we will tell you without delay what happened, what it may mean for you, what we are doing about it, and what you can do. We will also inform the authorities as the law requires.

• Enquiries, scorecard answers and chat and WhatsApp conversations from people who did not become clients: deleted 24 months after we last heard from them.
• Clients' records, portal messages and files: kept while you are a client and for 24 months after.
• Invoices and payment records: kept for 8 years, as tax and company law require.
• Signed agreements and their signing records: kept for the agreement's term and the period in which a legal claim could be brought.
• Backups: older backups are deleted after 30 days.
• When the law requires us to keep something longer, we keep it only for that purpose.

• See what personal data we hold about you, how we use it and who we have shared it with.
• Correct or complete your data, or update it.
• Delete your data, unless the law requires us to keep it.
• Withdraw your consent at any time, as easily as you gave it. This does not affect what we did before you withdrew it, and we may no longer be able to provide a service that needs that data.
• Name someone to act for you if you die or cannot act for yourself.
• Complain to us, and then to the Data Protection Board of India.

To use any of these rights, email hi@thetransformers.co from the email you used with us, or ask us to send a code to your phone. We may need to check it is you before acting.

Our Grievance Officer is Jimit Shah, Director. Email hi@thetransformers.co, call +91 22 6971 0875, or write to Eye Candy Studio Private Limited, Floor 4, 30/B-405, Monalisa Commercial, Wing B, Sri Lakshmi Narayan Mandir Marg, Manjalpur, Vadodara, Gujarat 390011, India.

We acknowledge every complaint within 48 hours with a reference number, and resolve it within one month. If you are not satisfied with our answer, you can complain to the Data Protection Board of India.

When we build or run systems for a client, such as a CRM, WhatsApp flows or automations, we may handle personal data of that client's customers and staff. The client decides how that data is used and is responsible for it. We act only on the client's instructions, under the data-protection terms in our agreement with them. If your data is in one of these systems, please contact that business first.

Our services are for businesses and are not meant for anyone under 18. We do not knowingly collect children's data. If you believe a child has given us their data, tell us and we will delete it.

When we change this policy, we update the date at the top. If a change is significant, we tell you by email or on our website before it applies. We will ask for your consent again before using your data for a new purpose.

If you would like this policy in Hindi or Gujarati, write to us.