Privacy policy

This website is run by Kailash Wani Studio, a film production company based in Pune, Maharashtra (“the Studio”, “we”, “us”). Under the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the rules made under it, the Studio is the Data Fiduciary for the personal data described here.

This policy covers this website only. Our social media pages, our YouTube channel and the platforms that stream our films have their own privacy policies.

We collect what you choose to give us, and a small amount of technical information needed to run the site:

• Contact forms: your name, email address, phone number if you give it, the reason you are writing (for example as a writer, actor or journalist) and your answers, such as a logline, links to your work, your city or your publication.
• Technical data: your IP address, used briefly to block spam and repeated submissions, and what your browser sends with every request, such as device type and browser version.
• Analytics: how pages are used, through the cookies described below.

Please don’t send sensitive information we haven’t asked for, such as bank details, Aadhaar or other ID numbers, or health information.

We use your personal data only for the purpose you gave it to us for:

• to read and reply to your message, and pass it to the right team: development, casting, distribution, press or partnerships;
• to consider you for a role, project or collaboration you have written to us about;
• to keep the site secure, block spam and abuse, and fix problems;
• to understand which pages are useful and improve the site, from aggregated analytics;
• to meet a legal obligation, or to establish or defend a legal claim.

We don’t sell your personal data, and we don’t use it to build advertising profiles.

When you send a form, you consent to us processing the data you give for that purpose. Each form says what it is for, and links to this policy. Some processing, such as keeping records the law requires, relies on the legitimate uses allowed by section 7 of the DPDP Act.

You can withdraw your consent at any time by writing to us (see “Questions and grievances” below), and it is as easy as giving it. Withdrawing doesn’t affect what we did before, but we may then be unable to consider your application or reply to you.

The site works without cookies. If you allow analytics in the notice shown on your first visit, we use Google Analytics, which sets cookies, to count visits and see which pages, films and links people open. They hold a random identifier, not your name or email, and Google Analytics is set not to use our data for advertising. Until you choose “Allow”, it is not loaded.

Our spam check, Cloudflare Turnstile, reads technical signals from your browser to tell people from bots. Trailers play from YouTube in privacy-enhanced mode, which sets no cookies until you press play; after that, Google’s own policy applies.

You can change your choice at any time with “Cookie settings” at the foot of every page; withdrawing stops analytics and deletes the Google Analytics cookies. You can also block or delete cookies in your browser settings. The site keeps working either way.

Your data is seen by the members of the Studio’s team who handle your enquiry. We also use service providers who process it for us, under contracts that limit what they may do with it:

• Vercel, which hosts the website;
• Resend, which delivers form messages and our replies by email;
• Cloudflare, which provides the Turnstile spam check;
• Upstash, which counts form submissions to stop abuse;
• Google, which provides analytics and the YouTube player.

Some of them store data outside India, for example in the United States or the European Union. The DPDP Act allows this except to countries the Government of India restricts, and we will stop any transfer a restriction applies to.

If we take a project further with you, we may share relevant details with co-producers, distributors or the Samarth Group companies working on it, and we will tell you first. We disclose data to the police, courts or regulators only when the law requires it.

• Contact form messages: up to 12 months after our last reply. Messages that lead to a project or contract are kept for as long as it lasts and the law requires.
• Pitches from writers and directors: 12 months, as our submission policy explains.
• Security records, such as IP addresses: up to 30 days.
• Analytics: 14 months, after which Google Analytics deletes it.

After that we delete your data, or keep it only in a form that no longer identifies you.

Under the DPDP Act you have the right to:

• ask for a summary of the personal data we hold about you and how we use it;
• ask us to correct, complete or update it;
• ask us to erase it, unless the law requires us to keep it;
• withdraw your consent at any time;
• nominate someone to exercise these rights for you in case of death or incapacity;
• have a grievance addressed by us and, after that, by the Data Protection Board of India.

We may ask you to confirm your identity first, so we never hand your data to someone else.

The site is served only over HTTPS, every form is checked again on our servers, and access to messages is limited to the people who need it. No system is perfectly secure: if a breach affects your data, we will tell you and the Data Protection Board as the DPDP Act requires.

The site is meant for adults. We don’t knowingly collect personal data from anyone under 18 without the verifiable consent of a parent or lawful guardian. Casting applications for young actors must be filled in by a parent or guardian, who gives that consent by sending the form. If you think a child has sent us data, tell us and we will delete it.

To use your rights, withdraw consent or raise a concern about your personal data, write to our Grievance Officer at the email address on the Contact page, with “Personal data” in the subject line. We will reply within 30 days.

If you are not satisfied with our answer, you can complain to the Data Protection Board of India.

We will update this policy when our practices or the law change, and change the “Last updated” date at the top. If a change affects how we use data you have already given us, we will ask for your consent again where the law requires it.