idlidu — Privacy Policy
=======================
Version: 2026.09.15-counsel-approved
Date: 15 September 2026
Status: COUNSEL-APPROVED FOR PUBLISH — effective 15 September 2026.
Related: RETENTION.md · SUBPROCESSORS.md · Terms · AUP

1. Who we are

idlidu is owned and operated by Saptarang Ventures (OPC) Private Limited
(“Operator”), CIN U43900MH2023OPC413456, registered office C-102, Acropolis
Apartments, Thatte Nagar, Gangapur Road, Nashik – 422005, Maharashtra, India.
Corporate particulars: https://www.saptarang.net/
Privacy contact: research@idlidu.com
There is no automated data-subject portal in soft launch.

For DPDP and similar frameworks, the Operator is the organisation determining
purposes of processing account and usage data described here. Counsel to
confirm “Data Fiduciary” / analogous labelling.

2. Scope

This Policy describes how we process information when you:
- visit www.idlidu.com or Dataset documentation sites;
- join a waitlist or email us;
- obtain or use an API Key;
- pay (when checkout is enabled);
- submit Shape C check inputs (simdeck / mlipfit / dftconv / engprobe-class).

It also explains product archives that contain Upstream public content
(observations about public web/API surfaces — not your private files by
default).

3. Categories of data we process

3.1 Account / waitlist
    - Email address you submit
    - Optional name / organisation if you volunteer it in mail
    - Correspondence content you send to research@idlidu.com

3.2 API / MCP usage (telemetry)
    - Key id / key prefix (not the secret key material in logs by design)
    - Timestamps, route or tool class, HTTP/MCP status, plan counters
    - We do not store request bodies by default for standard Dataset queries

3.3 Payments (when PSP is live)
    - PSP customer / order / payment reference ids
    - Plan and amount metadata we need for entitlements
    - Card numbers and full payment credentials stay with the PSP (PayU
      when checkout is enabled). We do not intend to store PAN / CVV.

3.4 Security and abuse
    - IP addresses and User-Agent strings as processed by Cloudflare
    - Signals needed to enforce rate limits, AUP, and fraud controls

3.5 Product archives (Dataset content)
    - Public-source snapshots, hashes, timestamps, derived extracts, indices
    - These are product data about Upstream public surfaces, cited as
      observations. They may include personal data that appeared on public
      pages (e.g. names in public READMEs). We treat that as Upstream public
      content, not as our marketing database.

3.6 Shape C inputs
    - Decks / structures / payloads you submit for computed checks are hashed
      and processed to return a result
    - Not retained by default beyond what is needed to produce the response,
      unless an Archive vault product is expressly opted in later

3.7 Cookies / local storage / page measurement
    - Soft-launch www is primarily static documentation; we do not run a
      third-party advertising pixel stack
    - Cloudflare may set strictly necessary security cookies
    - We use Cloudflare Web Analytics (cookieless beacon from
      static.cloudflareinsights.com) and Microsoft Clarity (clarity.ms /
      c.bing.com) for aggregated page metrics and session heatmaps/replay —
      not for advertising

4. Purposes

We process data to:
- provide and secure the Service;
- issue and meter Keys;
- communicate about waitlist, billing, and security;
- prevent abuse and enforce the AUP;
- comply with law;
- improve documentation and reliability (aggregated / operational metrics);
- operate Dataset archives as described in methodology pages.

5. Legal bases

Depending on jurisdiction, bases may include: contract performance (providing
the API you requested); legitimate use / legitimate interests (security,
abuse prevention, soft-launch operations); consent where we ask for it
(e.g. certain marketing mail — we do not currently run a marketing list
product); and legal obligation.
India DPDP “legitimate use” / consent mapping is applied as advised for this product posture.

6. What we do not do

- We do not sell personal data.
- We do not operate a recruiting marketplace or applicant PII warehouse.
- We do not settle cryptocurrency payments in this stage.
- We do not use your Shape C inputs to train public foundation models as a
  product feature (we do not enable customer-content training as a product feature).

7. Sharing and subprocessors

We share data with processors who help us run the Service:

| Processor   | Role                                      |
|-------------|-------------------------------------------|
| Cloudflare  | Hosting, DNS, Workers, D1, R2, Email Send |
| Migadu      | Founder human email                       |
| GitHub      | Source code hosting / CI (backup)         |
| PayU        | INR checkout when enabled (USD list → live FX) |

Details: SUBPROCESSORS.md
We may disclose information if required by law, legal process, or to protect
the Operator, customers, or the public from severe harm.

8. International transfers

Infrastructure is operated on Cloudflare’s global network. Data may be
processed in multiple regions. Counsel to confirm transfer mechanisms /
DPDP cross-border rules for our facts.

9. Retention

See also RETENTION.md. Soft-launch defaults (subject to statutory
overrides):

| Data                         | Default retention                                      |
|------------------------------|--------------------------------------------------------|
| Account email                | While active + up to 24 months after closure           |
| Usage logs                   | ~90 days rolling unless needed for security / dispute  |
| R2 raw archives              | Product retention per Dataset methodology              |
| Keys                         | Until revoked/deleted; hashes retained as needed       |
| Payment references           | As needed for accounting / chargebacks / tax           |
| Shape C payloads             | Not retained by default                                |

10. Security

We use industry-typical cloud controls (TLS, access-controlled Workers,
secrets in Cloudflare secrets store, least-privilege bindings). No method
of transmission or storage is perfectly secure. Report suspected incidents
to research@idlidu.com.

11. Your requests

Subject to law, you may request access, correction, or deletion of personal
data we hold about you, or key revocation, by emailing research@idlidu.com
from the relevant account address.
Founder mail — multi-day replies, not a ticket SLA.
We may need to verify identity and retain certain data for security, fraud,
accounting, or legal obligation.

12. Children

The Service is directed at organisations and adults building software. We do
not knowingly collect personal data from children. If you believe we have,
contact research@idlidu.com.

13. Automated decision-making

Quota enforcement and abuse throttling are automated. We do not use Content
to make legal or similarly significant decisions about natural persons as a
consumer credit or hiring product.

14. Changes

We may update this Policy. The version date will change. Material changes
will be posted on https://www.idlidu.com/legal/privacy/.

15. Contact

Saptarang Ventures (OPC) Private Limited
CIN U43900MH2023OPC413456
C-102, Acropolis Apartments, Thatte Nagar, Gangapur Road,
Nashik – 422005, Maharashtra, India
research@idlidu.com
https://www.idlidu.com/contact/