Privacy Policy

Pandalilly is operated by Pongangairaman N K S, as an individual/unregistered business based in Bengaluru, Karnataka, India. Pandalilly is not a registered company, private limited company, LLP, or other incorporated legal entity. We are the Data Fiduciary as defined under the DPDP Act, 2023 — meaning we determine the purpose and means by which your personal data is processed.

Contact: admin@pandalilly.com  |  Location: Bengaluru, Karnataka, India

We collect the following categories of personal data:

• Account information: name, email address, and password (hashed) when you register.
• OAuth data: if you sign in with Google, we receive your name and email from Google.
• Video content: videos you upload for caption processing. These are processed to generate transcripts and captions.
• Generated data: AI-produced transcripts, captions, and export files associated with your account.
• Usage data: pages visited, features used, timestamps, and actions taken on the platform.
• Technical data: IP address, browser type, operating system, device identifiers, and session tokens (via cookies).

• Directly from you: when you create an account, upload videos, or contact us.
• Automatically: through cookies and server logs when you use the Service.
• From third parties: from Google when you sign in using Google OAuth.

We use your data on the basis of your consent (as required under the DPDP Act, 2023) and our legitimate interest in providing and improving the Service:

• To create and manage your account.
• To process your videos using AI and generate captions and transcripts.
• To allow you to preview, edit, and export captioned videos.
• To enforce free-tier usage limits (e.g., 3 videos per month).
• To send transactional emails (password resets, account notifications).
• To improve our AI models and service quality using aggregated, anonymised analytics.
• To comply with applicable Indian laws and legal obligations.

Your uploaded videos are processed solely to generate captions and are not used to train AI models without your explicit consent. Videos may be temporarily stored on secure cloud infrastructure during processing and are automatically deleted after export or within 30 days, whichever is sooner.

We use third-party AI and cloud infrastructure providers (such as speech-to-text APIs) to power our transcription service. These providers act as Data Processors on our behalf and are contractually bound to process your data only for the specified purpose and to maintain appropriate security standards.

We do not sell your personal data. We share it only in the following circumstances:

• Service providers: cloud hosting, AI transcription, and email delivery providers engaged to operate the Service.
• Legal obligation: when required by a court order, law enforcement authority, or applicable Indian law.
• Business transfer: in the event of a merger, acquisition, or sale of assets, with prior notice to you.

We use essential cookies for authentication (session tokens) and preference storage (e.g., dark/light theme). We do not use third-party advertising or tracking cookies. You may disable cookies in your browser settings, but this may affect your ability to sign in or use the Service.

• Account data: retained while your account is active and for 90 days after deletion, then permanently erased.
• Uploaded videos: deleted within 30 days of upload or immediately after export, whichever is sooner.
• Captions and transcripts: retained in your account until you delete them or your account is closed.
• Logs and analytics: retained in aggregated, anonymised form for up to 12 months.

Under the Digital Personal Data Protection Act, 2023, you have the following rights:

• Right to access: request a summary of the personal data we hold about you.
• Right to correction and erasure: request that inaccurate data be corrected, or that your data be erased (subject to legal retention obligations).
• Right to grievance redressal: raise a complaint with our Grievance Officer (see below). We aim to respond within 30 days.
• Right to nominate: nominate another individual to exercise your rights in the event of your death or incapacity.
• Right to withdraw consent: you may withdraw consent at any time by deleting your account. Withdrawal does not affect the lawfulness of processing prior to withdrawal.

To exercise any of these rights, email our Grievance Officer at admin@pandalilly.com.

Pandalilly is operated as an individual/unregistered business, so this role is held directly by our founder rather than a separate appointed employee. In accordance with the Digital Personal Data Protection Act, 2023:

• Name: Pongangairaman N K S
• Designation: Grievance Officer
• Email: admin@pandalilly.com
• Location: Bengaluru, Karnataka, India
• Response time: we aim to acknowledge your query within 2 business days and respond within 30 days

We implement reasonable technical and organisational security measures, including HTTPS encryption, hashed password storage, and role-based access controls. However, no internet transmission is 100% secure. In the event of a data breach affecting your rights, we will notify you in accordance with applicable law.

The Service is not directed at individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor has provided us their data, please contact us immediately and we will delete it.

Some of our third-party service providers (AI APIs, cloud infrastructure) may process data outside India. We ensure such transfers comply with applicable Indian data protection laws and that recipients maintain equivalent data protection standards through contractual agreements.

We may update this Privacy Policy from time to time. Material changes will be communicated by email or a prominent notice on the platform at least 30 days before taking effect. Continued use of the Service after the effective date constitutes acceptance of the revised policy.

For any privacy-related queries, please contact us at admin@pandalilly.com. See our Contact Us page for more ways to reach us.