Privacy Policy & GDPR Compliance | SpiralBig

1. Scope and Distinctions in Data Processing

To understand how SpiralBig processes information, a fundamental distinction must be drawn between two separate categories of data handled by our infrastructure:

2. Information We Collect from Customers

When you interact with our platform, we collect the following categories of information:

• Identity & Contact Information: Your full name, corporate email address, telephone number, billing entity name, country of residence, and tax identifier (e.g. GSTIN or VAT number where applicable).
• Authentication Credentials: Passwords stored strictly using salted Argon2id/Bcrypt cryptographic hashing algorithms, session authentication tokens, and API secret keys.
• Billing & Payment Information: Payment transactions are handled directly via PCI-DSS Level 1 certified payment processors (Razorpay and PayPal). SpiralBig does not store complete credit card numbers, CVVs, or bank account authentication credentials on its servers. We retain transaction IDs, subscription expiry dates, and billing receipts.
• Telemetry & Usage Logs: IP address, browser user-agent, operating system, API endpoints queried, timestamps, download logs, and HTTP request metrics collected for security monitoring, fraud prevention, and rate-limiting enforcement.

3. Legal Basis for Processing Under GDPR

For individuals residing within the European Economic Area (EEA), United Kingdom, or Switzerland, our processing of personal data is governed by the following legal bases pursuant to Article 6 of the General Data Protection Regulation (GDPR):

4. Public WHOIS Records & GDPR Privacy Proxy Handling

In compliance with the ICANN Temporary Specification and the Registration Data Access Protocol (RDAP), SpiralBig respects privacy redactions implemented by accredited domain registrars. When a domain registrant utilizes an accredited WHOIS privacy proxy service or when European registry data is redacted under GDPR, SpiralBig stores and displays the record in its standardized redacted format (e.g. REDACTED FOR PRIVACY). We do not attempt to de-anonymize legitimately redacted individual registrant details.

5. Third-Party Service Providers & Sub-Processors

We partner with trusted third-party cloud infrastructure and payment processors who adhere to strict data security standards:

• Payment Gateways: Razorpay Software Private Limited (for INR transactions and UPI/cards) and PayPal Holdings Inc. (for USD/international transactions).
• Infrastructure & Hosting: High-availability European and North American cloud servers equipped with automated DDoS mitigation, TLS 1.3 encryption, and enterprise firewalling.
• Transactional Email: Enterprise SMTP relays for delivery of password resets, invoice receipts, and critical security alerts.

6. Data Retention Policy

We retain customer account details for as long as your account remains active or as required to fulfill our contractual obligations. If you close your account, non-financial data is purged within 90 days. Financial transactions, invoices, and payment receipts are retained for a minimum statutory period of seven (7) years to comply with tax, auditing, and corporate accounting regulations.

7. Your Data Protection Rights

Under applicable privacy statutes (including GDPR, UK Data Protection Act, and CCPA/CPRA), you possess the following enforceable rights:

• Right of Access: You may request a machine-readable copy of your personal data held in our systems.
• Right to Rectification: You may update or correct inaccurate profile details at any time via your user dashboard.
• Right to Erasure ("Right to be Forgotten"): You may request permanent deletion of your account and personal identifiers.
• Right to Restriction & Objection: You may object to data processing carried out under legitimate interest grounds.
• Right to Non-Discrimination: We do not alter service availability or charge discriminatory pricing when you exercise privacy rights.

To exercise any of these statutory rights, please submit a signed written request to our Data Protection Officer at privacy@spiralbig.com. We respond to all verified requests within thirty (30) days.

8. Contact Information