Privacy Policy

This Privacy Policy explains how Taal Lab (“Taal Lab”, “we”, “us”) handles personal information when you visit taallab.in, create an account, use file transfers, connect Google services, or purchase digital products.

1. Who is responsible for your information?

Taal Lab

2. Information we collect

• Account information: email address, password credentials in protected form, account identifiers, verification and security status, and sign-in method.
• Profile and checkout information: name is required for digital-store checkout. Phone number and billing address fields are optional. If you choose “Save these details to my account”, the details you provide are stored in your customer profile.
• Parent-link invitations: single-use links expire after 24 hours; invitation metadata is removed 30 days after expiry.
• Parental consent and permission history: retained while a parent-child link is active and for up to two years after withdrawal, unless a legal hold or other legal obligation requires longer. Child permission settings are deleted when consent is withdrawn.
• Marketing preferences: the current opt-in/opt-out state is retained while the account is active so the choice can be honoured. Withdrawn preference events and used unsubscribe tokens are retained for up to two years after withdrawal, then removed by scheduled cleanup.
• Booking enquiries: name, email address, WhatsApp number, requested service, preferred date and message submitted through the studio booking form. These enquiries are sent to Taal Lab by email and are not stored in the application database.
• Files and transfer information: files you upload or receive, file names, sizes, types, transfer messages, recipient details, download counts and expiry information.
• Purchase information: products, order references, payment status, amounts, coupon/discount information and payment-provider identifiers. Card and bank payment credentials are handled by Razorpay, not stored by Taal Lab.
• Connected-service information: if you use Google sign-in or connect Google Calendar, we process the account information and permissions needed to provide those features. Per-user Google Calendar connection tokens are stored in encrypted form. Taal Lab also uses its own Google Drive integration to store file transfers; its integration credentials are controlled by Taal Lab.
• Technical and security information: session identifiers, request information and records needed to operate, protect and troubleshoot the service.

3. Why we use information

• Create and secure accounts, authenticate users and prevent abuse.
• Transfer, store, deliver and expire files according to the transfer settings shown in the service.
• Process orders, verify payments, provide downloads, send purchase confirmations and provide customer support.
• Save customer details when you explicitly choose that option.
• Receive and respond to studio booking enquiries and arrange requested services.
• Operate connected Google features and maintain service security, reliability and legal records.
• Respond to requests, complaints and legal obligations.

TaalLab does not currently send marketing email campaigns. Account settings include a separate, optional adult-only marketing preference that is unchecked by default; when enabled, we record the consent version and timestamp. Child accounts cannot opt in. If marketing campaigns are introduced, every marketing message must include a working one-click unsubscribe option. The unsubscribe endpoint supports a one-click POST and the account preference can also be switched off at any time. Account, security, booking and purchase messages remain separate from marketing consent.

4. Service providers

We use service providers to operate parts of the service. Depending on the feature you use, information may be processed by:

• Cloudflare: website delivery, application hosting, database and related infrastructure.
• Backblaze: storage for digital-store product files and other app assets that use the configured B2 bucket.
• Razorpay: payment checkout and payment verification.
• Resend: account verification, security, transactional email and delivery of studio booking enquiries to Taal Lab.
• Google: Google sign-in, Google Fonts used to load website typography, and Google Drive storage and delivery for file transfers and connected Drive features. Loading Google Fonts may disclose technical request information such as your IP address and browser details to Google.

These providers process information under their own service terms and applicable privacy commitments. We do not publish a claim that every provider has a particular certification or that every data transfer is covered by a specific contractual arrangement. Contact us if you need information about a provider used for a particular feature.

5. Cookies and local storage

The service uses an essential session cookie to keep you signed in and browser local storage for the digital-shop cart, OCEAN interface preferences (such as theme and recently used emojis), and dismissal of this essential-storage notice. These local preferences are stored on your device. The notice shown on the website explains these essential storage uses; dismissing it only hides the notice and is not consent to advertising or analytics tracking. We do not currently operate optional advertising or analytics trackers. Google Fonts, Google sign-in, Google Drive, Google Calendar, Razorpay checkout and feature-specific APIs may make requests to their providers when the related page or feature is used. Those requests are described in the service-provider section and are not presented as optional advertising cookies.

6. How long information is kept

• Sign-in sessions: expire after seven days; expired sessions are removed by scheduled cleanup.
• Verification and password-reset codes: are short-lived (normally 10 minutes for email verification and two-factor challenges, 30 minutes for password-reset links) and expired records are deleted.
• Passkey challenges and temporary Google app sign-in codes: expire after two minutes and are removed by scheduled cleanup.
• File transfers: files expire on the date shown for the transfer. Expired file objects are removed from active access and the associated transfer metadata is scheduled for deletion after a 30-day operational grace period.
• Unpaid store orders: abandoned or unpaid order records are removed after 30 days.
• Paid orders and payment records: retained only as needed for accounting, tax, payment disputes, fraud prevention and other legal obligations. The applicable period depends on the record and legal requirements; records subject to a dispute or legal hold may be kept longer.
• Account and OCEAN content: kept while the account remains active. Date of birth and the resulting account age category are retained with the account while needed to apply age-appropriate account safeguards and parent/guardian controls. Following a verified deletion request, we review and erase data that is no longer needed, subject to legal obligations, shared-content rights and provider-side deletion steps.
• Booking anti-abuse identifiers: rate-limit identifiers used to protect the booking form are retained for up to one year after their last use and then removed by scheduled cleanup.
• Privacy-request records: open and in-review requests are retained until resolved. Completed or declined requests are retained for up to two years after resolution, then removed by scheduled cleanup.
• Booking abuse-prevention data: the email address and IP address used to enforce booking request cooldowns are retained for up to one year after last use, then deleted by scheduled cleanup.
• Booking enquiries: delivered to Taal Lab’s business mailbox through Resend. They are retained in that mailbox while needed to respond to the enquiry and manage any resulting engagement. Automatic mailbox deletion is not currently configured, so the mailbox is reviewed and managed separately from the application cleanup.

Scheduled cleanup runs hourly for the temporary records and transfer metadata described above. Deletion from backups or third-party systems may take additional time under those providers’ retention practices.

7. Your choices and requests

Signed-in users can download an account-data export and submit a correction or deletion request from Account settings → Privacy & personal data. You may also write to contact@taallab.in from the email address associated with your account. We verify requests before acting. A deletion request is reviewed rather than immediately deleting the account, because we may need to preserve specific transaction records, resolve shared-content ownership and revoke connected-service access. We will explain if any information must be retained or if a request cannot be fully completed.

Email: contact@taallab.in

8. Security

We use technical and organisational measures intended to protect information, including protected account credentials, secure sessions and private file delivery. No internet service can guarantee absolute security. Please use a unique password and do not share private transfer or download links.

9. Age information and children

After an account's email address has been verified and the user signs in, we ask for their date of birth before allowing them to continue to the account area. We use it to determine whether the account is an adult account or needs parent/guardian involvement. We do not ask for date of birth during public browsing or before email verification.

If the date of birth indicates that the account holder is under 18, the account is placed in a pending parent/guardian setup state. Purchases and payment actions are blocked for that account. A parent/guardian must have a separate adult-classified account with a verified email address and must attest that they are the child's parent or legal guardian. TaalLab sends a single-use, 24-hour link to the child's already verified account email. The child must sign in to their own account and accept the link; the parent cannot sign in as or take over the child's account.

When the link is accepted, TaalLab records the parent and child account references, consent-policy version, permission scope, timestamps and the method used for this flow. All optional child permissions start switched off. The parent can separately enable tutorial viewing, lesson-material downloads, comments/discussions, and uploading/sharing. Child purchases and payments remain disabled regardless of these settings. Tutorial viewing also requires a valid tutorial entitlement; the current repository does not yet contain a tutorial catalogue or playback system, so this permission is not a promise that tutorial content is currently available.

Important limitation: the application initially screens adult status using a user-entered date of birth and verified email ownership. The parent declaration and the child's acceptance are recorded, but they do not independently verify government identity, legal age or parental authority. The link remains pending and child account features remain blocked until an authorised TaalLab administrator records a separate manual review of the adult's identity, age and parent/guardian relationship using reliable evidence outside this application. The dashboard records the reviewer, time and review method; it does not collect identity-document images. This manual process is not an automated government-ID check or a legal certification. TaalLab must obtain local legal advice on the adequacy of the evidence and procedure before enabling child access under applicable law.

A parent can withdraw consent from the parent dashboard. Withdrawal disables all four permissions, revokes the active parent-child link, marks the consent history as withdrawn and signs the child out of active sessions. Withdrawal does not automatically erase the child's account or all associated records; the parent or child can submit a deletion request through account settings or contact contact@taallab.in. Consent records and permission-change events are retained while the link is active and for up to two years after withdrawal, unless a longer period is required for a legal claim or other legal obligation. Expired invitation tokens are removed 30 days after expiry.

We aim to collect only the information needed for account security and age-appropriate safeguards. Parents/guardians may contact contact@taallab.in with questions or requests relating to a child's account.

10. Changes and contact

We may update this Policy when the service or applicable requirements change. The effective date above identifies the current published version. Questions, privacy requests and complaints can be sent to contact@taallab.in.