Privacy Policy
This Privacy Policy (“Policy”) explains how HereNow AI Labs Private Limited, a company incorporated under the Companies Act 2013, having Corporate Identification Number (CIN) U62099DL2024PTC435645 and its registered office at A23/16V PH3, MANGAL APT. V. ENCLAVE, East Delhi, New Delhi‑110096, India (“Company”, “we”, “our” or “Once Upon Me”), collects, uses, stores, shares and otherwise processes Personal Data when you (“you”, “User”, or “Parent/Guardian”) access www.onceuponme.studio or any sub-domain, mobile site or application we operate (collectively, the “Site”), place an order or otherwise interact with us.
This Policy is drafted in compliance with:
* the Digital Personal Data Protection Act, 2023 (“DPDP Act”);
* the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“IT Rules 2011”); and
* any other applicable Indian laws, regulations or guidelines in force from time to time.
By visiting the Site or transmitting any Personal Data to us, you confirm that you have read, understood and consent to the terms of this Policy. If you do not agree, please do not use the Site or share Personal Data.
| 2. DEFINITIONS | |
| Term | Meaning (for the purpose of this Policy) |
| “Child” / “Minor” | A natural person who has not completed eighteen (18) years of age. |
| “Consent” | A freely given, specific, informed, unconditional and unambiguous indication of the User’s wishes, signified by an affirmative action, by which the User agrees to the processing of their Personal Data for the stated purpose. |
| “Data Fiduciary” | The Company, which determines the purpose and means of Personal Data processing (analogous to “data controller”). |
| “Personal Data” | Any data about an individual who is identifiable by or in relation to such data, whether directly or indirectly. This includes “Sensitive Personal Data” as defined under the IT Rules 2011 (e.g., financial information). |
| “Processing” | Any operation performed on Personal Data, including collection, recording, storage, alteration, retrieval, use, sharing, transmission, or deletion. |
| “Service Provider” | Any third party that Processes Personal Data on behalf of the Company under a valid contract. |
| 3. CONTACT & GRIEVANCE REDRESSAL | |
| Purpose | Contact Details |
| General Queries / Exercise of Rights | onceuponme.official@gmail.com |
| Grievance Officer (Sec. 79 IT Act & Rule 5(9) IT Rules 2011) | Mr. Tushar Khattar |
| HereNow AI Labs Pvt Ltd | |
| A23/16V PH3, MANGAL APT. V. ENCLAVE, East Delhi, New Delhi‑110096, India | |
| Email: onceuponme.official@gmail.com | |
| Phone: +91-9211495164 | |
| The Grievance Officer shall redress grievances within thirty (30) days of receipt. | |
| 4. CATEGORIES OF PERSONAL DATA WE COLLECT | |
| Source | Data Elements |
| Data provided by you | Child’s first name, last name, photographs, age, gender, preferred pronouns; Parent/Guardian name; shipping & billing addresses; email ID; phone number; payment instrument details (UPI ID, card PAN, etc.); order notes; marketing preferences. |
| Data collected automatically | IP address; device identifiers; browser type & version; operating system; date & time stamps; time-zone; referring URLs; on-site behavior (page views, clicks); cookies & similar tracking identifiers. |
| Data from service integrations | Payment status from our payment gateway; logistics tracking IDs; error logs; browser crash reports. |
| 5. PURPOSES & LAWFUL BASES FOR PROCESSING | |
| Purpose | Lawful Basis under DPDP Act |
| Personalising & generating the child’s storybook (including AI-assisted image generation). | Consent from Parent/Guardian (Sec. 6 DPDP). |
| Order confirmation, fulfilment, delivery updates, customer support. | Performance of Contract (legitimate use – Sec. 7(1)(a)). |
| Processing payments, fraud prevention, accounting & tax compliance. | Performance of Contract and Legal Obligation (Sec. 7(1)(b)). |
| Improving Site performance, analytics, debugging. | Legitimate Use (Sec. 7(1)(b)); aggregated & pseudonymised wherever possible. |
| Direct marketing emails/SMS, re-marketing ads. | Consent (opt-in; ability to withdraw at any time). |
| Compliance with court orders, law-enforcement requests. | Legal Obligation / Public Interest. |
- 6. SPECIAL PROVISIONS FOR CHILDREN’S DATA We collect a Child’s Personal Data only from the Parent/Guardian who places the order.
- The ordering flow requires an affirmative tick-box confirming the Parent/Guardian’s legal authority and consent.
- If we learn that a Child’s Personal Data has been provided without verified parental consent, we will delete such data within a reasonable period.
- Parents/Guardians may review, correct or request deletion of the Child’s Personal Data at any time (see Section 10).
| 7. DISCLOSURE TO SERVICE PROVIDERS | |
| We share Personal Data strictly on a need-to-know basis under written data-processing agreements that impose confidentiality and security obligations: | |
| Category | Examples |
| Cloud & hosting | AWS, GCP |
| Payment gateways | Razorpay |
| Printing & logistics | Print partners and courier companies (Delhivery, Blue Dart, India Post, DTDC). |
| Analytics & error logging | Google Analytics, Mixpanel, proprietary logging tools hosted in India. |
| We do not sell or rent Personal Data to any third party. Personal Data is not transferred outside India unless (a) the Central Government permits such transfers under the DPDP Act, and (b) the recipient country/organisation offers comparable data-protection standards. | |
We use first-party and limited third-party cookies for (i) session management, (ii) cart persistence, and (iii) analytics. A banner on first visit seeks consent for non-essential cookies. You may disable cookies via browser settings; essential cookies (e.g., to retain items in your cart) cannot be disabled.
| 9. DATA RETENTION & DELETION | |
| Data Type | Retention Period |
| Uploads (child photographs, storyline data) | 90 days after delivery, then permanently erased or irreversibly anonymised. |
| Transaction & invoice data | 8 years to comply with the Companies Act 2013 and Income-tax Act 1961. |
| Customer support communications | Up to 2 years from ticket closure. |
| Cookie/analytics data | 12 months (or sooner if you clear browser cookies). |
| Where erasure is requested before the expiry of a statutory retention obligation, we convert the data to an irreversible hashed or anonymised form. | |
- 10. YOUR RIGHTS Subject to verification of identity, you may exercise the following rights free of charge:
- Access – Know what Personal Data we hold about you and receive a copy.
- Correction – Have incomplete or inaccurate data rectified.
- Erasure – Request deletion of Personal Data that is no longer necessary or processed with consent that you withdraw.
- Withdrawal of Consent – Opt out of marketing or any other processing based on consent.
- Grievance Redressal & Review – Approach our Grievance Officer; if unsatisfied, file a complaint with the Data Protection Board of India once constituted.
Please email onceuponme.official@gmail.com or use the in-account privacy dashboard. We will respond within 15 days, extendable to 30 days in complex cases (notice will be given).
If the Company undergoes a merger, acquisition or asset sale, Personal Data may be transferred to the successor, provided the transferee honours this Policy. A prominent notice will be displayed on the Site at least 30 days before the change takes effect, and you will have the right to delete your account beforehand.
We may amend this Policy to reflect legal or operational changes. The “Effective Date” and “Version” will be updated. Material changes will be notified by (i) email to registered Users, or (ii) a pop-up banner on the Site, 30 days prior to enforcement. Continued use after the effective date signifies acceptance.
This Policy is governed by, and construed in accordance with, the laws of India. Any dispute shall be subject to the exclusive jurisdiction of the courts of New Delhi, India, after mandatory good-faith mediation.
For any questions about this Policy or our privacy practices, please write to:HereNow AI Labs Private LimitedA23/16V PH3, MANGAL APT. V. ENCLAVE, East Delhi, New Delhi‑110096, IndiaNew Delhi – 1100XX, IndiaEmail: onceuponme.official@gmail.com
© 2024 HereNow AI Labs Private Limited. All rights reserved.
Version 1.0 | Effective April 29, 2025
© 2024 HereNow AI Labs Private Limited. All rights reserved.