Privacy policy

This policy explains what personal data ELEMENTS NEXUS (“Fatbox”, “we”, “us”) collects when you use our website at fatbox.in, our console at console.fatbox.in, and Fatbox Player; why we collect it; who we share it with; how long we keep it; and the rights you have. We process personal data in line with India's Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000.

Fatbox is a service for businesses. When a business (a “customer”) uses Fatbox, it decides which of its staff get console accounts and which of its PCs run the player. For that data we act on the customer's instructions.

1. What we collect

When you book a demo or contact us

• Your name, work email, phone number, business name, city, type of venue, number of branches and anything you write in the message.
• The page you sent the form from, your IP address and your browser's user-agent string. We keep these to spot and block abuse of the form.

When you use the console

• Your name, email address, optional username and mobile number, and the venues and permissions your organisation gives you.
• Your password, stored only as a salted one-way hash. We cannot read it.
• Sign-in activity (time of last sign-in, failed attempts) and an audit log of changes you make, with the IP address they came from.

About your business and venues

• Brand and branch names, addresses, the map location you set for each branch, opening hours and settings.
• Your plans, their dates and limits, and records of payments made to us (amount, method, reference and date). We don't take card or bank details on our website or in the console.

From Fatbox Player

• The PC's name, Windows version, player version and a hardware identifier, recorded when the player is activated.
• Public keys created in the PC's security chip (TPM). The private keys never leave the PC.
• About once a minute: whether it's playing, the song playing and its position, the volume, free disk space and the IP address it connects from.
• A report of every song played, with the time, signed by the player. These reports are how rights holders are paid.
• If you add your own music: each file's title, artist and other tags plus a fingerprint (hash) of the file. We never upload the audio.

The player does not use a microphone or camera and does not collect anything about guests at your venue.

Cookies

This website uses no cookies and no analytics or advertising trackers. The console sets one essential cookie that keeps you signed in; it can't be used to track you elsewhere.

2. Why we use it

We don't sell personal data, and we don't use it for advertising.

3. Who we share it with

We use these service providers to run Fatbox. They process data only on our instructions:

• Amazon Web Services (Mumbai region) — storing music and artwork, message queues and encryption keys.
• DigitalOcean (Bengaluru region) — the servers that run our APIs.
• MongoDB Atlas — our database.
• Google Firebase Hosting — serving this website and the console's web pages.

Play reports go to the labels and distributors whose music was played. They show which songs played at which branch and when — never the names or contact details of your staff.

We may also disclose data where Indian law requires it, for example to comply with a lawful order.

4. Where it's stored

Our servers and file storage are in India. Some of our providers may process data outside India as part of their service; where they do, they are bound by contract to protect it, and we transfer data only as Indian law allows.

5. How long we keep it

• Demo requests: up to 24 months after our last contact with you, unless you become a customer.
• Console accounts: while the account is active, and deleted within 90 days after your organisation removes it or its contract ends, except the audit log entries we need for security.
• Play reports and payment records: as long as our licence agreements and tax law require, usually up to 8 years.
• Player status: we keep only the latest status of each player, replacing it every minute.

6. How we protect it

All connections to Fatbox are encrypted (HTTPS). Passwords are hashed. Access inside Fatbox is limited by role and recorded in an audit log. Music is encrypted end to end, and players prove who they are with keys held in their TPM chip.

7. Your rights

Under the Digital Personal Data Protection Act, 2023 you can ask us to:

• tell you what personal data we hold about you and how we use it;
• correct, complete or update it;
• erase it, where we no longer need it or you withdraw consent;
• let someone you nominate exercise these rights if you die or can't act for yourself.

You can withdraw consent for demo follow-ups at any time by writing to us; it doesn't affect anything we did before. If your console account belongs to an organisation, we may pass your request to them, since they control that account.

We reply within 30 days.

8. Grievances and contact

For questions, requests or complaints about your personal data, contact our grievance officer, SHAAN BHAVNANI:

• Email: sbelements@gmail.com
• Phone: +91 98207 23554
• Post: ELEMENTS NEXUS, Flat no 46, Jaldarshan, 51 Nepean Sea Road Mumbai, maharasthra 400026 IN

If you're not satisfied with our response, you can complain to the Data Protection Board of India.

9. Changes

If we change this policy we'll update the date at the top. For significant changes we'll also tell customers by email or in the console before they take effect.

The Fatbox patron app for guests isn't available yet. It will have its own privacy notice when it launches.