Your Data.
Your Rights.

Play Pause Post is operated by Vareli Tecsoft Pvt. Ltd. ("we," "our," or "us"). Play Pause Post is a video analytics company that helps businesses and content creators understand how audiences engage with video content. This Privacy Policy describes how we collect, process, store, and protect the digital personal data of Data Principals (as defined under the Digital Personal Data Protection Act, 2023) in connection with our platform, website, APIs, and related services (collectively, the "Services").

This Policy is governed by the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Digital Personal Data Protection Rules, 2025 ("DPDP Rules"), and supplements any contractual terms agreed with our business customers. By using our Services, you acknowledge this Policy. Where we rely on consent as the basis for processing, a separate consent request will be presented to you in plain language at the point of collection.

1. Key Definitions (under the DPDP Act, 2023)

• Data Principal: The individual to whom the digital personal data relates. For a child (under 18), the parent or legal guardian acts as the Data Principal.
• Data Fiduciary: Play Pause Post, which determines the purpose and means of processing your personal data.
• Data Processor: A third-party entity that processes personal data on behalf of Play Pause Post under a contractual arrangement.
• Significant Data Fiduciary (SDF): A Data Fiduciary designated by the Central Government based on volume, sensitivity, or risk. We will notify users if we are so designated, and will appoint a Data Protection Officer (DPO) based in India accordingly.
• Consent Manager: A registered intermediary through which a Data Principal may give, review, or withdraw consent. Play Pause Post will integrate with registered Consent Managers once registration opens (expected November 2026 per DPDP Rules).
• Data Protection Board of India (the Board): The regulatory authority established under Section 18 of the DPDP Act.

2. Digital Personal Data We Collect

2.1 Data Provided by You (Account and Business Data)

• Name, email address, phone number, company name, and job title provided during registration.
• Billing and payment information (processed by our PCI-DSS compliant payment partners; we do not retain full card numbers).
• Communications and correspondence with our support, sales, or grievance teams.
• Video content, metadata, thumbnails, and captions you upload to our platform.

2.2 Video Engagement Analytics Data

The core of our Services involves collecting viewer engagement signals when videos are played via our platform or embedded player. This includes:

• Play, pause, seek, rewind, and stop events, along with timestamps and positions within the video.
• Video completion rates, average watch time, and drop-off points.
• Heatmap data indicating which segments of a video are watched, rewatched, or skipped.
• Engagement with interactive overlays, calls-to-action, and chapter markers.
• Buffering frequency, adaptive quality changes, and playback error logs.
• Click-through rates and conversion events linked to video content.

2.3 Technical and Device Data

• Internet Protocol (IP) address, used to derive approximate city/state-level geolocation within India.
• Device type, operating system version, browser type and version, and screen resolution.
• Session identifiers, cookie IDs, and similar persistent or session-based identifiers (see Section 6).
• Referring URL, pages visited on our platform, and time spent on each page.
• System logs, API call records, and error reports.

2.4 Data from Integrated Third-Party Services

If you connect our Services to third-party platforms (e.g., YouTube, social media accounts, CRM systems, marketing automation tools), we receive data as permitted by your authorisation and the third party's own terms. We process such data only for the purpose for which you connected the integration.

3. Purposes of Processing and Legal Basis

Under the DPDP Act, 2023, personal data may be processed either (a) with the informed consent of the Data Principal, or (b) for certain "legitimate uses" specified in the Act. We process your data on the following bases:

Consent-based processing: Delivering our video analytics services to you; generating audience engagement reports and dashboards; sending you marketing and promotional communications about our products (you may opt out at any time); enabling optional third-party integrations; and placing non-essential analytics or advertising cookies on your device.

Legitimate use (Section 7, DPDP Act): Processing necessary to provide a service you have explicitly requested (e.g., fulfilling your subscription); processing for compliance with any court order, law, or direction of a government authority; processing for purposes of fraud detection, security, and platform integrity; processing of data voluntarily made publicly available by you.

We do not process personal data for any purpose beyond what is described in this Policy. If we intend to use your data for a new purpose, we will obtain fresh consent or notify you in advance as required by applicable law.

4. Children's Personal Data

We do not knowingly collect or process personal data of children (individuals under 18 years of age) without verifiable consent from a parent or legal guardian, as required under Section 9 of the DPDP Act. We will not use the personal data of a child for targeted advertising, tracking, behavioural monitoring, or any processing that is detrimental to the well-being of the child.

If you are a parent or guardian and believe your child's data has been collected without your consent, please contact us immediately at vareli.techsoft@gmail.com and we will delete such data promptly.

5. How We Share Your Personal Data

5.1 Data Processors

We engage trusted third-party Data Processors who act strictly on our instructions, including cloud infrastructure providers, payment processors, email delivery platforms, customer support tools, security and fraud detection vendors, and analytics co-processors. All Data Processors are bound by written data processing agreements that restrict use to specified purposes and require equivalent security standards.

5.2 Business Customers (Data Fiduciaries using our Embedded Player)

If you watch a video on a third-party website powered by our embedded player, the operator of that website (our business customer) will receive analytics data relating to your viewing session. That operator is an independent Data Fiduciary in relation to you, and you should review their privacy policy for details of their processing.

5.3 Government and Regulatory Authorities

We may disclose personal data to the Data Protection Board of India, courts, or other government authorities where required by law, pursuant to a lawful order, or to respond to a legal process. We will notify affected Data Principals where legally permissible.

5.4 Business Transfers

In the event of a merger, acquisition, amalgamation, or sale of business undertaking, personal data may be transferred to a successor entity. Affected Data Principals will be notified and the successor will be bound by this Policy or a policy offering equivalent protection.

5.5 Aggregated and De-Identified Data

We may share aggregated, anonymised, or de-identified data that cannot reasonably be used to re-identify any individual for benchmarking, research, or product development purposes.

6. Cookies and Similar Technologies

We use cookies and similar tracking technologies on our website and within our embedded video player. Categories of cookies we use include:

• Essential cookies: required for authentication, session management, and security. These cannot be disabled.
• Functionality cookies: remember your preferences and settings to improve your experience.
• Analytics cookies: collect information on how users interact with our platform to help us improve it (requires consent).
• Measurement cookies: placed within our embedded video player to help our business customers measure campaign effectiveness (requires consent from the end viewer).

Business customers who deploy our embedded player on their own websites are responsible for obtaining valid consent from their own users under the DPDP Act and any applicable cookie regulations, and must provide their own disclosures accordingly.

You may manage your cookie preferences through our Cookie Preference Centre (accessible via the footer of our website) or your browser settings. Disabling essential cookies may affect the functionality of our Services.

7. Data Retention and Erasure

We retain personal data only for as long as necessary to fulfil the purpose for which it was collected or as required by applicable law, whichever is longer:

• Account and profile data: for the duration of your active subscription, plus up to 36 months thereafter for audit, legal, and dispute resolution purposes.
• Video engagement and analytics data: in identifiable form for up to 24 months from collection, after which it is aggregated and de-identified.
• System logs, security, and access records: up to 12 months.
• Payment transaction records: as required under applicable financial and tax laws (typically 7 years under Indian law).
• Backup and disaster recovery copies: deleted within 90 days of the original data being erased.

Upon erasure of your account or upon a valid erasure request, we will delete your personal data from our active systems within 30 days, subject to legal retention obligations. Data held in backups will be purged within the backup rotation cycle.

8. Rights of Data Principals

Under the DPDP Act, 2023, you have the following rights as a Data Principal:

8.1 Right to Access Information (Section 11)

You may request a summary of the digital personal data we hold about you, the purposes for which it is processed, and a list of Data Processors and other Data Fiduciaries with whom it has been shared.

8.2 Right to Correction and Erasure (Section 12)

You may request that we correct inaccurate or misleading personal data, complete incomplete data, or erase personal data that is no longer needed for the purpose for which it was collected or if you have withdrawn consent (and there is no overriding legitimate use).

8.3 Right to Grievance Redressal (Section 13)

You have the right to have your grievances addressed by our Grievance Officer (see Section 10). If you are not satisfied with our response, you may escalate to the Data Protection Board of India.

8.4 Right to Nominate (Section 14)

You may nominate another individual to exercise your data principal rights on your behalf in the event of your death or incapacity.

8.5 How to Exercise Your Rights

Submit a request through any of the following channels:

• Online: playpausepost.in/privacy-requests
• Email:vareli.techsoft@gmail.com
• Post: Data Protection Officer, Vareli Tecsoft Pvt. Ltd. (Play Pause Post), 23C Ashutosh Chowdhury Avenue, KCI Plaza, 3rd Floor, Kolkata, West Bengal 700019, India

We will verify your identity before processing any request and will respond within 30 days. There is no fee for the first request in any 12-month period. Repeated or manifestly unfounded requests may be subject to a reasonable administrative fee.

9. Data Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, or destruction, as required under Section 8(5) of the DPDP Act. Our safeguards include:

• Encryption of data in transit using TLS 1.2 or higher, and encryption at rest using AES-256.
• Role-based access controls and the principle of least privilege, with regular access reviews.
• Multi-factor authentication for internal system access.
• Continuous security monitoring, vulnerability management, and periodic penetration testing.
• Vendor security assessments for all Data Processors.
• A documented Incident Response Plan and Personal Data Breach Notification procedure.

In the event of a personal data breach, we will notify the Data Protection Board of India and affected Data Principals in accordance with the timelines specified in the DPDP Rules, 2025, irrespective of the gravity or scale of the breach, as required under the Act.

10. Grievance Officer and Data Protection Officer

In accordance with the DPDP Act and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (to the extent applicable), we have appointed a Grievance Officer. If we are designated a Significant Data Fiduciary, a Data Protection Officer based in India will be appointed separately and their details updated herein.

We will acknowledge your grievance within 48 hours and resolve it within 30 days. If you are dissatisfied with our resolution, you may approach the Data Protection Board of India at https://dpboard.gov.in.

11. Cross-Border Transfer of Personal Data

Play Pause Post may transfer your digital personal data to servers and infrastructure located outside India. Such transfers are permitted under the DPDP Act subject to the Central Government notifying permitted countries. We will update this Policy if the Central Government restricts transfers to any country where we operate infrastructure.

Where we transfer data outside India, we ensure that our Data Processors located abroad are contractually bound to provide a standard of protection equivalent to the DPDP Act, including restrictions on onward transfer and requirements for data security.

12. Consent Managers

Once the registration of Consent Managers with the Data Protection Board of India becomes operational (expected November 2026 under the DPDP Rules), you will have the option to manage your consent through a Board-registered Consent Manager. We will update our platform to integrate with registered Consent Managers at that time and provide you with relevant links and instructions.

13. Language Accessibility

In accordance with the DPDP Act, this Privacy Policy and our consent notices are available in English. We are committed to making this Policy available in additional languages listed in the Eighth Schedule of the Constitution of India upon request. Please contact vareli.techsoft@gmail.com to request a translated version.

14. Changes to This Privacy Policy

We may update this Policy from time to time to reflect changes in our Services, applicable law, or business practices. Where changes are material, we will:

• Post the revised Policy on our website with an updated effective date.
• Send a notice to your registered email address and/or display an in-app notification.
• Where required under the DPDP Act, obtain fresh consent before processing your data under the new terms.

If you do not agree with the revised Policy, you may withdraw consent and discontinue use of our Services. Continued use after the effective date of the revised Policy constitutes your acceptance of the changes.

15. Contact Us

For any questions, concerns, or requests relating to this Privacy Policy or our data processing practices, please reach out to us: