Privacy Policy

Last updated: 18 August 2026 (revision 3)

1. Who we are

Ethos Agora LLC, trading as Arangetram Registry (“we”, “our”, “us”, the “Company”), operates arangetramregistry.com. In data protection terms we are the controller of the personal data described here.

The platform is a registry of Indian classical arts: artists who have completed an arangetram publish a profile of their training and lineage; gurus who teach these forms publish a profile of their school; and artists with an upcoming arangetram may announce it.

We also operate a Vendor Directory — a listing service for businesses that provide goods and services to families preparing for a classical arts debut, such as costumes, jewellery, photography, videography, sound and light, make-up, invitations, décor, catering, venues, orchestras and printing. Vendors are businesses, not performers, and are listed separately from artist and guru profiles.

We handle personal data with reference to the Children’s Online Privacy Protection Act (COPPA), the California Consumer Privacy Act as amended by the CPRA, and the General Data Protection Regulation where it applies.

2. What we collect

2.1 Artists — account

• Name and email address
• A password, stored only as a bcrypt hash — it cannot be read, by us or anyone else
• Your age band, but not your age. We ask for your year of birth on a neutral screen. It is used once, on our servers, to work out whether you are old enough to hold an account and whether you are over 18. The year itself is then discarded and never stored. We keep only the answers: over 13, over 18, and whether a parent or guardian has confirmed
• Where the artist is under 18: a parent or guardian’s name and email address
• Which documents you accepted, which version, when, and the IP address you accepted from

2.2 Artists — profile

• Art form, biography, years of experience
• Your guru’s name and your lineage
• Country, state or region, and city
• A photograph, if you choose to upload one
• Your arangetram certificate
• Optional: phone number, website, and social media links
• Optionally a handle, such as @your-name, which becomes part of your public web address. Artists under 18 may reserve one, but it does not become active until they confirm they are 18

2.3 Gurus

• Name, title, and email address
• School or academy name and location
• Art forms taught, lineage, biography, teaching background
• A photograph, if you choose to upload one
• Optional website and social media links

2.4 Vendors

When a business registers as a vendor we collect and store:

• Account information: the email address and password used to sign in. Authentication is shared with the rest of the platform; passwords are stored only as a bcrypt hash and are never readable by us
• Business listing information the vendor provides: business name, an optional contact person’s name, tagline, description, one or more service categories, city, state or region and country, service area, year established, a website or social-media link, a business phone number, a logo or main image, and up to five portfolio photographs

We do not collect a vendor’s street address, and the directory takes no payment or financial details — it is free and we operate no payment processing.

2.5 Announcements

Where an artist announces an upcoming arangetram we collect the performing name, art form, guru, date, time, venue and location, an optional photograph, optional orchestra credits, and a contact address that is never published.

2.6 Collected automatically

• IP address, browser type and version, device characteristics
• Pages visited and the time of the visit
• A session cookie so that you remain signed in

2.7 From people who contact you

When someone uses a contact form — whether to reach an artist, a guru or a vendor — we record their name, email address, optional phone number, the message itself, their IP address, and how long they took to complete the form. The last of these helps us distinguish automated submissions from real ones. Where the sender is signed in, the enquiry is linked to their account.

2.8 What we deliberately do not collect

• Date of birth, or year of birth. Neither is stored. The year you enter at signup is evaluated once and discarded within the same request — it is never written to our database or our logs
• Any date on which your age changes. We hold no birthday and no “turns 18” date, so nothing counts down in the background
• Gender — never asked
• Home or mailing address — never asked. Announcement venues must be public places, and vendors give city-level location only
• Payment or financial data — the platform is free and we operate no payment processing
• Location data from photographs. Uploaded images — artist, guru and vendor alike — are re-encoded to strip embedded metadata, including GPS coordinates, capture time and device identifiers, before they are stored

3. What is public, and what is not

3.1 Never public, for anyone

• Your email address. It is never displayed and never passed to anyone contacting you unless you reply to them yourself
• Your arangetram certificate. It is a verification document, visible only to you and our review team. The directory holding certificates is closed to direct web access and files are served through an authenticated proxy
• A vendor’s phone number. It is held for our team and for moderation use only, and is never displayed on a listing
• Your password, in any form
• Your age, in any form — we do not hold it to disclose
• Your guardian’s name or contact details
• Any personal phone number you provide

3.2 Public on an adult artist profile

Name, art form, biography, guru and lineage, city, state and country, photograph, any links you add, and your handle if you choose one.

3.3 Reduced on a profile belonging to someone under 18

• No photograph is shown publicly. It remains visible to the artist, their parent or guardian, and our review team
• First name and last initial only — never a full surname
• No city. State or region and country only
• No public handle. A handle such as @your-name would place a real name in a public, guessable web address. An artist under 18 may still reserve a handle so that nobody else takes it, but it does not work and is not shown until they confirm they are 18
• A private web address instead. Minor profiles are reached by a random link containing no name, which cannot be guessed or counted through to find other profiles
• The page instructs search engines not to index it or its images
• Upcoming announcements are not shown on the profile, even where the artist has made one

Because we do not keep your date of birth, these restrictions do not lift by themselves — nothing in our systems knows when your birthday is. Once a year your dashboard asks whether you have turned 18. Confirming updates your status immediately, and again the year you enter is used once and discarded.

This is a deliberate trade. Lifting the restrictions automatically would mean tracking the date you turn 18, which is age data we have chosen not to retain.

We apply them because a named child, shown with a photograph, a city and a named school, is findable in person. That is a greater exposure than an email address, and it is not one a young person is well placed to weigh for themselves.

3.4 Public on a guru profile

Name, title, school, location, art forms taught, lineage, biography, photograph, and any links provided. Guru profiles are indexed by search engines, because a teacher listing a school is seeking to be found. The email address is never shown.

3.5 Public on a vendor listing

Once a listing is approved, the following is shown publicly: business name, tagline, description, service categories, city, state or region and country, service area, website or social-media link, logo, and any portfolio photographs our team has approved.

• Never shown publicly: the vendor’s phone number, held for our team and moderation use only
• Shown only to signed-in gurus: the optional contact person name. It is not visible to the general public

Portfolio photographs. A vendor may upload up to five portfolio images. On upload, the vendor must confirm that each image shows no identifiable person and that they hold the rights to it. We re-encode uploaded images to strip embedded metadata (including any location/GPS data), and every portfolio image is reviewed by our team before it appears publicly. Images that appear to show identifiable people, or that we consider unsuitable, are declined or removed. Vendor listings are indexed by search engines, because a business listing services is seeking to be found.

3.6 Announcements

An approved announcement publicly shows the performing name, art form, guru, date, time, venue, location, photograph, orchestra credits and any notes provided. The contact address is never shown.

Announcement pages are never indexed by search engines, and an announcement leaves the public listing automatically once its date has passed.

3.7 How your profile is addressed

Every profile and vendor listing has a random web address containing no personal information — for example arangetramregistry.com/p/K3nR8vQx2Lm for a profile, or arangetramregistry.com/v/7Bq2Rn9xK4m for a vendor. These cannot be guessed, and they cannot be counted through to discover others.

Adult artists and gurus may additionally choose a handle, which becomes their public address. A handle is optional, and the random address continues to work alongside it. Vendors use their own separate address and may choose a short custom link; a vendor link is never part of the artist or guru handle namespace.

A handle that is changed or deleted stops working at once and is held for twelve months before anyone else can take it, so that a link you have already shared does not lead to a different person.

4. Nobody contacts you directly

There is no way for a visitor to email an artist, guru or vendor through this site. When someone submits a contact form:

1. The message is stored. Nothing is sent to you
2. A member of our team reads it
3. Only if it is approved is it forwarded to your email address
4. Where the artist is under 18, their parent or guardian receives a copy of the same message — not a notification, the message itself, so that they can judge it for themselves

If a message is not passed on, you never see it. We retain a record of the decision and the reason for it.

Replying is entirely your choice. Your email address reaches the sender only if you choose to reply.

Vendor enquiries. Because vendors are adult businesses seeking custom, anyone may send a vendor an enquiry — a sender does not need an account. The enquiry is still held and read by our team before it is forwarded, and the sender’s details are shared with the vendor only if we forward the message. The additional parent-or-guardian copy described above does not apply to vendor enquiries, as the recipient is a business rather than an individual who may be a minor.

5. If you are under 18

You must be at least 13 to create your own account. If you are younger, a parent or guardian may create an account in their own name.

If you are between 13 and 17 we ask for a parent or guardian’s name and email address, and we email them a single-use link asking them to confirm. Your profile cannot be submitted for review until they do.

Your parent or guardian receives a copy of any message forwarded to you, and may contact us at any time to review, correct or remove your profile.

If you believe a child under 13 has created an account, write to us and we will delete it.

Vendors. The Vendor Directory is for businesses and is not intended for use by children. Vendor accounts are held by the business or the adult responsible for it.

6. Why we hold this information

What	Why
Name, email, password	To create and secure your account
Age band flags (over 13, over 18)	To apply the correct protections and meet our obligations towards young people. The underlying year is never stored
Guardian details	To obtain confirmation and to keep a parent informed
Profile and guru content	To publish the registry entry you asked for
Vendor listing content	To publish the vendor’s directory entry and let families and gurus find them
Vendor phone number	To let our team contact a vendor for moderation; never shown publicly
Certificate	To review a submission before publishing it
Portfolio photographs	To present a vendor’s work, after review that they show no identifiable person
Announcement details	To publish an upcoming performance
Contact messages	To moderate them and record what we decided
IP addresses and form timings	To detect automated abuse and enforce rate limits
Consent records	To evidence what you were shown and when
Access logs	To record who viewed sensitive fields

7. Legal bases (GDPR)

Where the GDPR applies, we rely on:

• Performance of a contract — operating your account and publishing the profile or vendor listing you requested
• Consent — optional updates by email, and a parent or guardian’s consent under Article 8 where the artist is a minor
• Legitimate interests — moderating content, preventing abuse, and keeping the platform secure
• Legal obligation — responding to valid legal demands and meeting child-safety requirements

8. Children’s privacy (COPPA)

An arangetram is commonly given during a student’s teenage years, so a substantial proportion of artists listed here are minors.

Under 13. We do not permit anyone under 13 to create an account. Our signup asks for year of birth on a neutral screen — a blank dropdown with no default and no statement of the minimum age, so that the question is not itself an instruction on how to pass it. Where the answer indicates an age under 13, registration stops and cannot be completed. This is enforced on our servers, not only in the browser.

The year is not retained. It is evaluated within the same request and discarded. We record only whether the person is over 13, whether they are over 18, and whether a parent or guardian has confirmed. Nothing we store can be worked back to a date of birth.

We do not knowingly collect personal information from children under 13.

13 to 17. A parent or guardian must be named and must confirm by email before a profile can be submitted for review. The additional protections in section 3.3 apply throughout.

Vendors. The Vendor Directory is directed to businesses and adults, not to children, and vendors are not asked for any age information.

Parental rights. A parent or guardian may at any time ask us to show them what we hold about their child, correct it, or delete it and the associated account. Write to the address in section 15.

If a child under 13 registers despite the block. On becoming aware, we delete the account and its associated data promptly.

9. California privacy rights (CCPA / CPRA)

If you are a California resident you may:

• Know and access — request the categories and specific pieces of personal information we hold about you
• Delete — request deletion of your profile, media and account
• Correct — request correction of inaccurate information
• Limit use of sensitive information — we do not use sensitive personal information for any purpose beyond providing the service
• Not be discriminated against — exercising these rights will never affect the service you receive

We do not sell or share personal information as those terms are defined under the CCPA and CPRA, and have not done so in the preceding twelve months. We therefore display no “Do Not Sell or Share My Personal Information” link.

10. GDPR rights (EU / EEA / UK)

• Access and rectification — inspect and correct your data
• Erasure — request deletion of your profile and account
• Restriction — pause processing while accuracy is disputed
• Portability — receive your data in a structured, machine-readable form
• Objection — object to processing based on legitimate interests
• Withdraw consent — at any time, without affecting processing already carried out
• Complain — to your national data protection authority

11. Cookies and analytics

Essential cookies. A session cookie keeps you signed in. It is removed when you log out and cannot be declined, because the site cannot authenticate you without it.

Analytics. We use Google Analytics 4, provided by Google LLC, to understand which pages are used and to diagnose faults. It collects technical data including an anonymised IP address, approximate region, browser configuration and page interactions. We use this only in aggregate.

Consent. For visitors in the EU, EEA, UK and California, analytics scripts are held until you give consent through our cookie banner. You may change your choice at any time through the banner controls.

Opting out. You may block analytics by declining in the banner, disabling cookies in your browser, or installing Google’s official Analytics Opt-out Browser Add-on.

We use no advertising cookies and no cross-site tracking.

12. Who we share with

We do not sell personal information. We do not share it for advertising. We share only:

• Publicly — the profile or vendor listing content described in section 3, once approved
• With a parent or guardian — where the artist is a minor, as described in section 4
• With a signed-in guru — a vendor’s optional contact person name, as described in section 3.5
• With service providers — hosting and email delivery providers who process data on our instructions to operate the service
• With analytics providers — Google Analytics, subject to consent, as described in section 11
• Where the law requires it — in response to a valid legal demand, or where disclosure is necessary to protect someone from harm

Business transfer. If the Company is acquired or merged, personal data may transfer as part of that transaction. We will give notice before any such transfer takes effect and it will remain subject to this policy or one no less protective.

13. Future paid features and marketing

The platform is currently free and we process no payments.

If paid features are introduced — for example paid or promoted vendor listings, or enhanced profiles — payment details will be handled directly by a third-party payment processor. We will not receive or store card numbers. This policy will be updated to name that processor before any paid feature launches.

Marketing. We send optional updates only to people who have separately opted in — never bundled with account terms. You may withdraw at any time from your account settings or by using the unsubscribe link in any such message. We do not send marketing email to an address given only as a parent or guardian contact, and we do not send marketing to artists recorded as being under 18.

Advertising. We do not display third-party advertising and do not provide personal information to advertisers. If that ever changes it will require a new consent, not a policy update.

14. Security

• Passwords are hashed with bcrypt and cannot be recovered by anyone, including us
• Guardian email addresses are encrypted at rest
• Certificates are served only to their owner and our review team; the directory is closed to direct web access
• Uploaded images — artist, guru and vendor — are re-encoded to remove embedded metadata including GPS coordinates
• Access to sensitive fields is logged
• Repeated failed sign-in attempts trigger a temporary lock, and a sign-in from a new location prompts an email notice, so that you can act if it was not you
• The site is served over HTTPS throughout

No system is perfectly secure and we do not claim otherwise. If a breach occurs that is likely to put you at risk, we will notify you and the relevant authorities as the law requires.

15. How long we keep things

What	How long
Account and profile	Until you delete it. Deletion removes the profile, its photograph, certificate, links and announcements permanently — there is no recovery period
Vendor account and listing	Until you delete it. Deletion removes the listing, its logo and portfolio photographs, and the account, permanently
Certificates	With the profile; deleted when it is
Announcements	Until deleted by the artist; removed from public listing after the date
Approved contact messages	12 months
Declined or spam messages	90 days
Sensitive-field access logs	12 months
Analytics data	Per Google Analytics retention settings
Age band flags	With the account. The underlying year is discarded at signup and never retained
Consent records and moderation decisions	Retained after deletion as evidence that notice was given and that submissions were reviewed properly. They hold no profile content, photographs or biography

16. International transfers

We are based in the United States and our servers are located there. If you use the platform from elsewhere, your information is transferred to and stored in the United States, which may not offer the same protections as your own jurisdiction.

17. Changes

If we change this policy materially we will update the date above and notify registered users. We keep a record of which version each user accepted.

18. Governing law

This policy is governed by the laws of the State of California, without regard to conflict of law principles. This does not deprive you of any protection under the mandatory law of your own country of residence.

19. Contact

Deletion you can do yourself. Sign in and use the delete option on a profile, or close your whole account — artist, guru or vendor — from your dashboard. We email you a confirmation link and ask for your password before anything is removed — two steps, because deletion cannot be undone. Where the artist is under 18, their parent or guardian is copied on that email.

To exercise any other right described here, or for any privacy question:

Ethos Agora LLC, dba Arangetram Registry
Attn: Privacy & Legal
privacy@arangetramregistry.com
General enquiries: contactus@arangetramregistry.com

We respond within 30 days. We may ask you to verify your identity first, so that we do not disclose someone’s information to the wrong person.