Privacy Policy

This Privacy Policy explains how Anirudh Negi (“AssetLoom”, “we”, “us”), with a business address at Faridabad, Haryana 121006, India, collects, uses, shares, and protects personal data when you use assetloom.io and related services (the “Service”).

We are the Data Fiduciary under India's Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the controller under the EU General Data Protection Regulation and the UK GDPR (together, “GDPR”). For California residents, we are a business under the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA”).

This policy does not cover third-party websites you reach from the Service, or the payment provider's own processing when it acts as an independent controller or merchant of record; their own privacy notices apply.

We do not ask for sensitive data such as health, religion, or biometric information, and we ask you not to include it in Content. We do not knowingly collect data from children (see Children).

Under the DPDP Act, we process personal data on the basis of your consent, which you give when you create an account or submit information for a specified purpose, or for the “legitimate uses” permitted by section 7 (for example, where you voluntarily provide data for a specified purpose, or to comply with law or a court order). Under the GDPR, we rely on the bases below.

Where we rely on legitimate interests, we have balanced our interests against your rights. You can object at any time (see Your rights).

We share personal data only as described here. We do not sell personal data and we do not share it for cross-context behavioural advertising. We do not use advertising cookies, pixels, or trackers.

We may also share personal data:

• With Creators, to the limited extent needed to operate a sale: Creators see order details such as the Asset, license type, date, and amount. We do not give Creators your email address.
• Publicly, where you choose to publish it, such as your creator profile or reviews.
• With rights holders, where we forward a counter-notice as required by copyright law (see the Copyright & Takedown Policy).
• With authorities, where required by law, court order, or a lawful request from a government agency, including under section 69 or 79 of the Information Technology Act, 2000 and the rules made under it, or to protect the rights, safety, or property of users or others.
• With professional advisers, such as lawyers, auditors, and insurers, under confidentiality duties.
• In a business transfer, such as a merger or acquisition, in which case this policy continues to apply to your data and we will notify you.

We are based in India, and our providers operate in other countries, including the United States. The DPDP Act permits transfers outside India except to countries the Central Government restricts by notification; we will comply with any such restriction.

Where the GDPR applies, we transfer personal data outside the EEA or UK only where the destination has an adequacy decision or where we use appropriate safeguards such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum. Contact legal@assetloom.io for a copy of the relevant safeguards.

We keep personal data only as long as needed for the purposes above, then delete or anonymise it.

We may keep data longer where required by law, a court order, or to establish, exercise, or defend legal claims.

We use reasonable security safeguards appropriate to the risk, as required by section 8(5) of the DPDP Act and Article 32 of the GDPR. These include encryption in transit, private networking between our servers, least-privilege database roles, append-only financial records, short-lived signed download links, malware scanning of uploads, multi-factor authentication for staff, redaction of secrets and personal data from logs, and audit logging of administrative actions. No system is perfectly secure. If a personal data breach occurs, we will notify you and the relevant authorities (including the Data Protection Board of India and, where applicable, the Indian Computer Emergency Response Team or an EU or UK supervisory authority) as the law requires.

When you ask us to delete your account:

1. We confirm the request and verify that it comes from you.
2. We delete or anonymise your account, profile, and contact details within 30 days, except where we must keep them for the periods in How long we keep personal data.
3. Ledger, order, and tax records are retained under our legal obligations but are linked to an anonymised identifier instead of your identity.
4. Reviews you posted are removed or anonymised.
5. You lose access to your library and any remaining credits. Read the Loom Credits Terms before deleting, as you may be able to request a refund of unused purchased credits first.

Licenses for Assets you have already downloaded continue on their terms, but we can no longer show you your purchase history, so please keep your receipts. Creators should also read the Creator Terms on removing content and earnings.

We use automated tools to scan uploads for malware, validate files, compute listing-quality checklists, and flag possible fraud or abuse. Our payment provider also uses automated fraud screening. Decisions that significantly affect you, such as rejecting a listing, suspending an account, or withholding earnings, are reviewed by a person. You can ask for a human review of any decision by contacting support@assetloom.io.

We use only strictly necessary cookies, mainly to keep you signed in. Our analytics do not use cookies. See the Cookie Policy for details.

The Service is not intended for anyone under 18. We do not knowingly process personal data of children (as defined in the DPDP Act, anyone under 18), track them, or target advertising at them. If you believe a child has created an account, contact legal@assetloom.io and we will delete it.

We will update this policy when our practices change. If a change is material, we will notify you by email or in the Service before it takes effect and, where the law requires, ask for your consent again. The version and “Last updated” date above show the current version.

For privacy questions or to exercise your rights, email legal@assetloom.io. Complaints about our processing of personal data may be sent to our Grievance Officer, appointed under the Information Technology Act, 2000, the rules made under it, and the DPDP Act:

We acknowledge complaints within 24 hours and aim to resolve them within 15 days. Information about the Data Protection Board of India is available from the Ministry of Electronics and Information Technology (opens in a new tab).