Privacy Policy

Abneesh Singh (sole proprietor, trading as ASWorks) is the data fiduciary (controller) for personal data processed through asworks.studio. For any question, request or complaint, write to hello@asworks.studio — that address reaches the proprietor directly.

When you create an account:

• Your name, email address and a password, stored only as a salted hash — we cannot read it.
• A username and avatar colour, generated for you.
• Your email verification status, and if you enable two-factor authentication, an encrypted TOTP secret.
• If you sign in with Google: your email address and basic profile from Google. We only accept a Google-verified email.
• If you verify a phone number: the number, and a one-time code that expires.

When you buy something:

• Order records: what you bought, the amount, the currency, the payment reference and the licence key issued.
• Download events, so you can see your own history and so we can investigate a leaked link.
• Refund requests and any note you send with them.

When you sell something: your product listings, uploaded archives, payout requests, bank or UPI details needed to pay you, and the tax details required to deduct TDS.

Automatically, as you use the site:

• Session records, so you stay signed in and can sign out of a device.
• Login attempts, including failures, to detect credential stuffing.
• Your IP address, in two specific places: rate-limiting (to stop abuse) and product view counts.
• Product views and search terms, to rank the catalogue.
• Audit logs of administrative actions, which record who did what and when.

We use a small number of cookies and none of them are for advertising:

• A session cookie, so you stay signed in. Strictly necessary — the site cannot work without it.
• A display-currency cookie, remembering your choice for a year.
• A theme preference, stored in your browser rather than sent to us.

There are no third-party advertising or cross-site tracking cookies, no advertising pixels, and we do not sell or share your data with data brokers.

• To perform our contract with you: creating your account, taking payment, delivering downloads, issuing licences, paying sellers, handling refunds.
• For our legitimate interests: keeping the platform secure, preventing fraud and abuse, rate-limiting, and understanding which products people find useful.
• To comply with law: keeping transaction records, and deducting and reporting tax where required.
• With your consent: the newsletter, and nothing else. You can withdraw it at any time from any email we send, or by writing to us.

We use a small number of service providers. Each receives only what it needs, and none of them are permitted to use your data for their own purposes:

• Razorpay — payment processing and seller payouts. Receives your payment details directly and your name and email for the transaction record.
• Microsoft Azure Blob Storage — stores product archives and generates time-limited download links.
• MongoDB — the database holding everything described above.
• Resend or SendGrid — sends transactional email (verification, receipts, refund decisions) and the newsletter if you subscribe.
• Google — only if you choose to sign in with Google.
• Twilio — only if you verify a phone number, and only to deliver the code.
• GitHub — only if a seller imports a public repository to draft a listing. No personal data is sent; we request a public repo by name.

Some of these providers operate outside India. Where data is transferred, it is to established providers under their standard contractual protections. We will tell you if that materially changes.

• Account data: while your account is open, and then deleted or anonymised on request as described in clause 8.
• Order, payment and payout records: retained after account closure where tax and accounting law requires it — generally eight years for financial records in India.
• Short-lived security data expires on its own: one-time codes, password reset tokens, rate-limit counters and download links (15 minutes).
• Login attempt and audit records: kept for a limited period for security investigation.

• Passwords are salted and hashed, never stored in a readable form.
• Two-factor secrets are encrypted at rest with a key held outside the database.
• Download links are individually signed and expire after 15 minutes, so a leaked link does not expose a purchase.
• Uploaded archives are inspected for unsafe paths and swept for exposed credentials before they can be sold.
• Administrative actions are logged.

Under India’s Digital Personal Data Protection Act, 2023 — and, if you are in the UK or EEA, the GDPR — you can:

• Ask what we hold about you, and get a copy of it.
• Have inaccurate details corrected — most of them you can edit yourself in your account.
• Ask us to delete your data. We will, except for records tax law requires us to keep; we will tell you exactly what is being retained and why.
• Withdraw consent for the newsletter at any time.
• Object to processing based on our legitimate interests, and ask for your data in a portable format.
• Nominate someone to exercise these rights if you are unable to.

Write to hello@asworks.studio and we will respond within 30 days. If you are not satisfied you can complain to the Data Protection Board of India, or to your local supervisory authority if you are in the UK or EEA.

The platform is not intended for anyone under 18. We do not knowingly collect data from children. If you believe a child has created an account, tell us and we will remove it.

If we change this policy in a way that materially affects you, we will email registered users at least 14 days beforehand. The date at the top of this page is always the version in force.