Privacy policy

Eye Candy Studio Private Limited (“Eye Candy”, “we”) collects and keeps the personal data described here. Under Indian law we are the data fiduciary for it: we decide why and how it is used.

Legal name

Eye Candy Studio Private Limited

Trade name

The Eye Candy Studio

CIN

U62099GJ2026PTC172474

GSTIN

24AAJCE4416A1Z7

Registered office

30/B-405, Monalisa Commercial, Manjalpur, Vadodara 390011, Gujarat, India

Email

hello@theeyecandy.studio

Phone

+91 86900 62814

Website

www.theeyecandy.studio

• For you, our client (and anyone who contacts us or visits our website), we decide how your data is used, and this policy explains it.
• For your staff and customers who appear in content we make for your brand, we act on your instructions and you, our client, decide how their data is used. Requests about that footage should go to the brand, and we will help it answer them. If we want to use such footage in our own portfolio, we first get the person’s own consent.

We only collect what we need to run your plan:

We never use your data for anything unrelated to your plan without asking. Marketing emails, portfolio use and any optional extras are separate choices, never bundled into signing up, and you can say no to them and still use our service.

Passwords and payment details are sensitive personal data under Indian law. We collect a password only with your written or email consent, and only where a platform offers no safer way to give us access. Card, UPI and bank details are entered on Razorpay’s secure checkout and handled by Razorpay, a payment aggregator regulated by the Reserve Bank of India.

We don’t sell your data. We share it only with service providers who help us run Eye Candy, under contracts that require them to keep it safe and use it only for us:

• Razorpay, for payments and payment mandates;
• our website host and network provider (Vercel and Cloudflare);
• our email providers, for account and service emails;
• cloud storage providers, for your files;
• editing and AI tools we use to make your content (see AI tools);
• freelancers who work on your content, bound by confidentiality agreements.

We may also disclose data when the law requires it, for example to a government agency or court with lawful authority, or to protect our legal rights.

Some of our providers store or process data outside India, for example in the United States or Europe. We use providers that protect data to standards at least as high as those required in India, and we will never send data to a country the Government of India restricts.

This website uses no analytics, advertising or tracking cookies. Our host may set a strictly necessary security cookie to keep bots out. If we ever add analytics or marketing cookies, we will ask for your consent first, and saying no will be as easy as saying yes.

We may use AI tools to help edit, caption and plan your content. We only use services that don’t train their models on your material, a person on our team reviews all output, and we never clone anyone’s face or voice without their written consent.

Anyone filmed at our shoots signs a release saying how their image and voice will be used. Use in our portfolio is a separate, optional tick on that release. If someone withdraws their consent, we stop new uses of their footage; content already published lawfully before that doesn’t have to be taken down. We film children only with a parent’s or guardian’s verifiable consent.

We prefer partner or team-member access, which you control from your own account and can remove anytime. Any password you give us is stored encrypted in a password manager, seen only by the people working on your account, and deleted when your plan ends.

We follow a written security programme: encryption in transit and at rest where our providers support it, two-factor login on our systems, access only for the people who need it, activity logs and regular backups. No system is perfectly secure, so we also plan for breaches (see if there is a data breach).

• Raw footage and finished files: available to you for 90 days after your plan ends, then deleted from our storage. Copies you have downloaded are yours.
• Briefs, messages and portal records: deleted within 90 days after your plan ends, unless we need them for an unresolved dispute.
• Invoices, payment and account records: kept for 8 years, as company and tax law require.
• Security and access logs: kept for at least one year.

You can ask us to:

• tell you what personal data we hold about you, how we use it and who we have shared it with;
• correct, complete or update it;
• erase it, unless the law requires us to keep it (such as invoices);
• stop using it where you withdrew consent;
• let someone you nominate exercise your rights if you die or can’t act for yourself.

Email hello@theeyecandy.studio from the address on your account, or with your name, phone number and an invoice or client number, so we can confirm it’s you. We answer within one month, and usually much sooner.

If a breach affects your personal data, we will tell you without delay: what happened, what it may mean for you and what we are doing about it. We will also report it to the authorities the law requires, including the Data Protection Board of India.

You can withdraw any consent you gave us by emailing hello@theeyecandy.studio; it is as easy as giving it. Withdrawing doesn’t undo anything we did lawfully before. If you withdraw consent we need to run your plan, we may have to end the plan, as set out in our refunds and cancellation policy.

Our service is for businesses and adults aged 18 or older. We don’t knowingly collect data from children except as part of a shoot with a parent’s or guardian’s verifiable consent, and we never target advertising at children.

For any question or complaint about your personal data, contact our grievance officer, who is also our contact for data-protection requests:

• Jimit Shah, Director
• Email: hello@theeyecandy.studio
• Phone: +91 86900 62814
• Post: 30/B-405, Monalisa Commercial, Manjalpur, Vadodara 390011, Gujarat, India

We acknowledge complaints within 48 hours and resolve them within one month.

If you are not satisfied with our answer, you can complain to the Data Protection Board of India once its complaints process is open, after first using ours.

If you would like this policy in Hindi, Gujarati or another language listed in the Constitution of India, email hello@theeyecandy.studio.

If we change this policy, we update the version and effective date at the top and email clients about any significant change before it applies. Earlier versions are available on request.