Privacy Policy

1. The short version

• Photos you upload are analysed only in memory and deleted as soon as the result is returned. We never write them to disk, keep copies, look at them manually, sell them or use them to train AI models.
• We do not use advertising or tracking cookies and we do not sell personal data.
• You can contact our Grievance Officer at any time to exercise your rights.

2. Data we process

• Photos and their embedded metadata (for example EXIF camera data, location tags, C2PA Content Credentials) that you submit for a check. Photos can contain personal data about you or other people.
• Technical data needed to run and protect the Service: IP address (used in memory for rate limiting and abuse prevention), browser type, request time and error logs. Logs never contain image data.
• For business (API) customers: name, work email, company details, billing and GST information, API keys and usage counts.
• Messages you send us (support, grievances) and their contents.
• A preference stored in your own browser (localStorage) that remembers whether popcorn sounds are on. It never leaves your device.

3. Why we process it (purposes) and on what basis

• To analyse the photo you submit and show you the result — on the basis of your consent, given when you upload a photo, and to perform the service you requested.
• To keep the Service secure, prevent abuse and enforce our Terms — a legitimate use under section 7 of the DPDP Act.
• To provide, bill and support API accounts — performance of our contract with the business customer.
• To comply with law, court orders or requests from authorities empowered by law — section 7 of the DPDP Act.

You may withdraw consent at any time by stopping use of the Service; withdrawal does not affect processing already completed.

4. How long we keep it

• Uploaded photos: not retained. They exist only in server memory for the duration of the check (normally under two seconds).
• Rate-limit counters: in memory, reset within minutes.
• Error logs without personal content: up to 30 days.
• API account and billing records: for the duration of the contract and as long as required by tax and accounting law (generally 8 years).
• Support and grievance correspondence: up to 3 years after closure.

5. Sharing

We do not sell or rent personal data. We share data only with service providers (Data Processors) that host and operate the Service under written contracts that require confidentiality and security, with payment processors for API billing, and with authorities where required by law. AI detection runs on our own servers; uploaded photos are not sent to any third-party AI service.

Our infrastructure may be located in or outside India. Any transfer outside India is made only to countries not restricted by the Central Government under section 16 of the DPDP Act.

6. Security

We use encryption in transit (HTTPS), in-memory-only processing of uploads, access controls, rate limiting and the reasonable security practices expected under the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. If a personal data breach occurs we will inform affected people and the Data Protection Board of India as the DPDP Act requires.

7. Your rights

• Access a summary of personal data we process about you and the processing activities.
• Correction, completion, updating and erasure of your personal data.
• Grievance redressal through our Grievance Officer (see below), and escalation to the Data Protection Board of India.
• Nominate another person to exercise your rights in case of death or incapacity.

Write to Hello@popped.info. We respond within 30 days, and earlier where the law requires.

8. Children

The Service is not directed at children. If you are under 18, use it only with the verifiable consent and supervision of a parent or lawful guardian. We do not knowingly track, profile or target advertising at children.

9. Photos of other people

Only upload photos you are entitled to use. If a photo shows other people, make sure you have a lawful reason to have it checked — for example, verifying a claim or document submitted to you.

10. Grievance Officer and contact

Grievance Officer: Vikram Pagadala, Hello@popped.info. Data Fiduciary: Vikram Pagadala (owner of Popped!), Vijayawada, Andhra Pradesh, India. Email: Hello@popped.info.

11. Changes

We will post any change on this page and update the date above. Material changes will be highlighted on the website before they take effect.