S3 Cubes Innovations Private Limited is incorporated in India and processes the personal data of users in India. This statement explains how we approach the Digital Personal Data Protection Act, 2023 (the "DPDP Act") and the rights it gives you.
How this sits alongside our Privacy Policy
Our Privacy Policy describes what we collect and why, across all our apps. This document is narrower: it maps those practices onto the specific obligations and rights created by the DPDP Act for users in India. Where the two differ for an Indian user, this document governs.
1.Our role and the terms used
The DPDP Act uses specific terms. In plain language, as they apply to us:
| Term under the Act | Who that is here |
|---|---|
| Data Fiduciary | S3 Cubes Innovations Private Limited — we decide the purpose and means of processing your personal data. |
| Data Principal | You — the individual the personal data relates to. For a child, this includes the parent or lawful guardian. |
| Data Processor | Third parties who process data on our instructions, such as cloud hosting, analytics and AI providers. |
| Personal data | Any data about you by which you are identifiable, including the wellbeing information you choose to record in our apps. |
2.Notice and lawful purpose
We process personal data only for lawful purposes for which you have given consent, or for a legitimate use permitted by the Act. Before or at the time we ask for your consent, we give you a notice that sets out:
- An itemised description of the personal data we intend to collect.
- The specific purpose for which it will be processed.
- How you can exercise your rights as a Data Principal.
- How you can withdraw consent, as easily as you gave it.
- How you can complain to the Data Protection Board of India.
You may ask us to provide that notice in English or in any language listed in the Eighth Schedule to the Constitution of India.
3.Consent
Where we rely on consent, that consent is free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the personal data necessary for the stated purpose.
- Granular: consent to one purpose is not treated as consent to another. Optional processing is presented separately from what the app needs to function.
- Withdrawable: you can withdraw consent at any time, from within the app or by writing to us. Withdrawal is as easy as giving consent was.
- Consequences of withdrawal: we stop the related processing within a reasonable time and erase the personal data unless retention is required by law. Features that depended on that data may stop working.
Sensitive wellbeing data
Mood entries, assessment answers and other wellbeing information are only collected when you actively enter them. We do not infer them silently, we never sell them, and we never use them for advertising.
4.Your rights as a Data Principal
Under the DPDP Act you have the following rights, and we honour all of them:
- Right to access information — a summary of the personal data we hold about you, and the processing activities we have undertaken with it.
- Right to correction, completion and updating — to have inaccurate or misleading data corrected, incomplete data completed, and outdated data updated.
- Right to erasure — to have your personal data deleted, unless retention is required for a legal purpose.
- Right to grievance redressal — to have your complaint answered by us before escalating to the Data Protection Board.
- Right to nominate — to nominate another individual to exercise your rights on your behalf in the event of your death or incapacity.
How to exercise them
- Erasure / deletion
- Use our Data Deletion Request form
- Access, correction, nomination
- Email support@s3cubes.com
- Marketing opt-out
- Use our unsubscribe page
- Grievances
- Email support@s3cubes.com with "DPDP grievance" in the subject
We will verify that a request genuinely comes from you before acting on it, since acting on an impersonated erasure request would itself cause harm.
5.Your duties under the Act
The Act also places duties on Data Principals. When dealing with us, you agree to:
- Not impersonate another person when providing personal data.
- Not suppress material information when providing data for an official document.
- Not register a false or frivolous grievance or complaint.
- Provide only information that is verifiably authentic when exercising your right to correction or erasure.
6.Children's data
Age threshold under Indian law
The DPDP Act treats anyone under 18 as a child. For users in India, we require verifiable consent from a parent or lawful guardian before processing a child's personal data. This is a higher bar than the 13+ general audience rating shown on our store listings, which reflects platform content-rating rules rather than Indian data protection law.
For children and for persons with a lawful guardian, we do not:
- Undertake processing likely to cause any detrimental effect on the wellbeing of the child.
- Carry out tracking or behavioural monitoring of children.
- Direct targeted advertising at children.
If you believe a child has provided us personal data without the required parental consent, write to dev@s3cubes.com and we will remove it promptly.
7.Security safeguards
We are required to take reasonable security safeguards to prevent a personal data breach. Ours include:
- Encryption of personal data in transit, and at rest where supported by our storage providers.
- Access control, so staff and contractors can reach only the data their role requires.
- Pseudonymisation or anonymisation before data is sent to third-party AI providers.
- Contractual obligations on every Data Processor we engage, binding them to our instructions and to confidentiality.
- Logging and monitoring to detect unauthorised access.
- Deletion routines that remove data once its purpose is served.
8.Personal data breach notification
In the event of a personal data breach, the Act requires us to give notice to both the Data Protection Board of India and each affected Data Principal. Our process is to:
- Contain the breach and preserve evidence.
- Assess the nature, extent and likely consequences, and identify who is affected.
- Notify the Data Protection Board of India in the form and manner prescribed.
- Notify affected users directly, describing the breach, its likely consequences, the measures we have taken, and what they can do to protect themselves.
- Remediate the root cause and record the incident.
9.Retention and erasure
We erase personal data, and require our Data Processors to do the same, once the purpose for which it was collected is no longer being served and retention is not required by law. This includes when you withdraw consent or your account is deleted.
Data deletion requests are processed within 30 days. We send a confirmation once deletion is complete. Some records — for example transaction records required under tax or accounting law — may be retained for the statutory period even after account deletion.
10.Transfers outside India
Some of our service providers process data outside India. The DPDP Act permits such transfers except to territories restricted by the Central Government. Where personal data is transferred outside India, we keep the contractual and security safeguards described above in place, and we restrict what leaves the country to what the service genuinely needs.
11.Grievance redressal and escalation
If you are unhappy with how we have handled your personal data, contact us first so we can put it right.
- Grievance contact
- support@s3cubes.com
- Acknowledgement
- Within 72 hours of receipt
- Substantive response
- Within 30 days
- Postal address
- S3 Cubes Innovations Private Limited, R H 79, Treasure Town, Bijalpur, Rajendra Nagar, Indore, Madhya Pradesh 452012, India
If we do not resolve your grievance to your satisfaction, you may escalate it to the Data Protection Board of India in accordance with the DPDP Act.
12.Changes to this statement
We will update this statement as the DPDP Act's rules are notified and as our processing changes. This statement is effective as of 11 March 2026.
This statement describes our practices and is provided for transparency. It is not legal advice, and it does not limit any right you have under applicable law.
Questions about this document?
Write to us and a person will answer — we do not run an automated legal inbox.
S3 Cubes Innovations Private LimitedR H 79, Treasure Town, Bijalpur, Rajendra Nagar, Indore, Madhya Pradesh, India, 452012