Privacy & IP Protection Policy

Layerium Labs operates as a Data Fiduciary under the provisions of the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Information Technology Act, 2000. We recognize our clients as Data Principals with fundamental rights over their personal data and proprietary intellectual property.

This policy explains how personal information, business registration identifiers, and proprietary engineering datasets (such as 3D CAD geometry, 2D technical drawings, and tolerance specifications) are collected, processed, protected, and retained when utilizing Layerium Labs manufacturing services, web portal, RFQ workflow, and client communications.

Layerium Labs processes data strictly on the lawful basis of contractual fulfillment (manufacturing, quoting, and delivering hardware components) and statutory compliance (taxation, GST invoicing, and corporate audits).

Account & Logistics Data: When you submit an enquiry, request a commercial quotation, or place an order, we collect your full name, business email address, direct telephone/WhatsApp contact number, shipping destination, postal pincode, state, and city.

Commercial & Invoicing Information: For corporate accounts requesting tax invoices, we collect the registered corporate entity name, Goods and Services Tax Identification Number (GSTIN), and registered billing address.

Proprietary 3D CAD Geometry & Technical Metadata: When uploading files via our engineering portal, we process the 3D model geometry (STL, STEP, IGES, OBJ, 3MF) and calculate derived spatial parameters (bounding box dimensions, volume, surface area, projected mass, and slicing layers) necessary for DFM review, machine chamber packing, and quoting.

Payment References: We capture transaction reference identifiers, Razorpay payment tokens, settlement timestamps, and payment statuses. Credit card numbers, CVVs, net banking passwords, and UPI PINs are handled exclusively by PCI-DSS Level 1 compliant payment partners (Razorpay) and are never captured, processed, or stored on Layerium Labs servers.

Ephemeral Technical Data: IP addresses are inspected transiently at the edge for rate-limiting, DDoS prevention, and bot mitigation, and are not persistently indexed in customer profile records.

Layerium Labs treats all client CAD models, engineering drawings, and manufacturing files as strictly confidential trade secrets. We enforce an uncompromising Non-Disclosure posture across all operations.

Access to uploaded CAD models is restricted strictly to qualified application engineers and machine operators directly assigned to slicing, quality auditing, and manufacturing your order.

Zero-Resale Guarantee: Uploaded 3D geometry is never commercialized, replicated, licensed, open-sourced, or transferred to third parties. Customer files are never used to train public machine learning algorithms or generative artificial intelligence models.

Storage Security: Files are stored in private, cryptographically secured object storage buckets (Supabase Storage / Cloudflare R2) protected by AES-256 encryption at rest and TLS 1.3 encryption in transit.

Customer 3D CAD Files: CAD models and derived build files are retained in our secure engineering archive for the duration of active manufacturing plus ninety (90) calendar days post-delivery. This retention window allows us to conduct quality verification, evaluate reprint claims, or execute rapid repeat batch orders. Following the 90-day window, models are eligible for permanent cryptographic deletion. Clients may submit a formal early-purge request upon delivery confirmation.

Statutory Tax & Financial Records: Transaction records, commercial quotations, purchase orders, and GST invoices are retained for seven (7) years in strict compliance with Section 36 of the Central Goods and Services Tax Act, 2017 (CGST Act) and Indian corporate tax regulations.

Technical Correspondence & Support Records: Email and messaging logs related to engineering feasibility and customer support are archived for ninety (90) days for quality assurance before being purged.

Under Sections 11 through 14 of the Digital Personal Data Protection Act, 2023, Data Principals possess enforceable statutory rights regarding their personal data held by Layerium Labs:

• Right to Access (§11): You may request a complete summary of the personal data held by Layerium Labs and the processing activities undertaken.

• Right to Correction & Erasure (§12): You may request correction of inaccurate, incomplete, or out-of-date personal information, or demand erasure of data that is no longer required for manufacturing or tax compliance purposes.

• Right of Grievance Redressal (§13): You may register a complaint with our designated Grievance Officer regarding any processing concern and receive a formal response within statutory timelines.

• Right to Nominate (§14): You may designate another individual to exercise your data principal rights on your behalf in the event of death or incapacity.

To exercise any of these statutory rights, submit a written request to our Grievance Desk at layeriumlabs@gmail.com.

Layerium Labs engages select, enterprise-grade cloud infrastructure and operational service providers under binding data protection agreements:

• Primary Database & Auth: Supabase Inc. (Hosted in AWS ap-south-1 Mumbai, India region) — Primary database hosting encrypted order, account, and configuration records.

• Payment Processing: Razorpay Software Pvt. Ltd. (India) — Processing online settlements, UPI, and banking transactions under PCI-DSS standards.

• Logistics Coordination: Authorized Domestic Courier Partners — Providing delivery address, recipient contact, and parcel dimensions to assigned logistics partners for doorstep fulfillment.

• Asset CDN & Storage: Cloudflare Inc. (Global edge network & R2 storage) — Providing secure web application delivery, DDoS mitigation, and encrypted file hosting.

• Transactional Notifications: Resend Inc. — Delivering automated order confirmations, DFM audit alerts, and dispatch updates.

• Operational Diagnostics: Sentry Inc. & PostHog — Capturing anonymized frontend errors and performance metrics. Personal identifiers and order values are strictly stripped before telemetry transmission.

Layerium Labs avoids intrusive cross-site advertising trackers and invasive tracking pixels.

Functional Local Storage: We utilize browser localStorage solely to preserve customer-entered form fields during multi-step enquiry and quoting workflows to prevent data loss on accidental refresh. This data never leaves your browser device.

Operational Session Storage: Ephemeral session identifiers may be stored in browser sessionStorage to verify active authenticated sessions. These tokens expire automatically when you close your browser tab.

Analytics: We use privacy-centric, cookieless telemetry to measure page performance and error rates. We do not sell user behavioral data to third-party ad networks or data brokers.

In compliance with Section 13 of the DPDP Act 2023 and Rule 3(2) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, Layerium Labs has designated a Grievance Redressal Officer to address privacy, data integrity, and CAD confidentiality concerns:

Designation: Grievance Redressal Officer Email: layeriumlabs@gmail.com Secondary Contact: sales@layeriumlabs.com Physical Jurisdiction: India

SLA Timelines: Layerium Labs will formally acknowledge receipt of your grievance within forty-eight (48) hours and deliver a reasoned resolution within thirty (30) calendar days.

Data Protection Board of India: If you remain dissatisfied with our resolution, you retain the statutory right to file a formal complaint with the Data Protection Board of India (DPBI) established under the DPDP Act 2023.