Privacy policy.

When you send us an enquiry. The contact form asks for your name, email address, phone number, company name, the service you are interested in, an indicative budget range, and your message. Only the fields you fill in are collected. With the enquiry we also store the first page of this site you visited, the name of the site that linked you here, and any campaign tag in the link you followed, so we know which page an enquiry came from. If you email, call or message us on WhatsApp instead, we hold whatever you chose to send.

When you buy a guide. The checkout asks for your name and email address. We keep them with a record of what you bought, and use them to send your receipt and your download link, and to send the link again if you ask. The payment itself is taken by the payment gateway, PhonePe, and your payment details go to it and never to us.

When you visit any page. We use Google Analytics 4 to count visits and understand which pages are read. It sets first-party cookies on your device and records your approximate location, device type, browser, the pages you view and how you arrived. We have configured it to anonymise IP addresses and to disable Google Signals and ad personalisation, so your visit is not used to build an advertising profile and is not shared with Google’s advertising products.

If you are a client we invite to leave a review. A review invitation is a private, expiring link. Submitting one sends us your name, role, company, your written review and, if you add one, a photograph. Nothing is published until you submit it, and a review is published only in the form you wrote it.

If you are a client paying us. Payment is made by bank transfer or through a payment gateway. We never ask for and never receive card numbers, UPI PINs, CVVs, net-banking credentials or OTPs. Where a gateway is used, those details go to the gateway and not to us. A private, expiring payment link lets you send a reference number and a receipt as proof of a transfer you made.

Automatically, by our servers. Ordinary server logs — IP address, timestamp, requested URL — which exist to keep the service running and secure.

What we do not do: we do not buy personal data, we do not sell or rent yours, we do not run advertising on this site, and we do not use your data to train any machine-learning model.

Under the DPDP Act our basis is your consent, given when you submit a form. For an enquiry you send us directly it is the legitimate use of responding to a request you made of us.

Analytics cookies are currently set when you arrive, before you have been asked. We would rather tell you that than imply otherwise. Google Analytics loads on every visit to codkrafters.com; it does not load on previews or local copies of the site.

The DPDP Act expects consent to be obtained before processing, not disclosed afterwards. A consent banner that actually holds the script back is being built, and until it ships this section describes a gap rather than a design. The mitigations already in place — anonymised IPs, no Google Signals, no ad personalisation — reduce what is collected but do not replace asking.

In the meantime you can block or clear cookies in your browser, or use its do-not-track/blocking features, and this site works identically. Nothing on it is gated behind analytics.

One thing that is not a cookie: the site remembers whether you switched its interface sounds on or off. That is stored in your own browser, is not personal data, and is never sent to us.

We keep the number of parties deliberately small.

We do not share your data with anyone else. We may disclose it if legally required to — a court order, or a lawful request from an authority.

Your enquiry and client records stay in India. The backend that holds them and every backup of it run in Mumbai, India. The website itself is served from outside India, and analytics is processed outside India; the DPDP Act permits such transfers except to countries the Government restricts by notification.

You can ask us to delete your data sooner — see below.

Under the DPDP Act you have the right to:

• Know what personal data of yours we hold and who we have shared it with;
• Correct anything inaccurate, and complete anything incomplete;
• Erase your data, where we no longer need it for the purpose you gave it;
• Withdraw consent at any time, for future processing — it does not undo processing already carried out lawfully;
• Nominate another person to exercise these rights if you die or become incapacitated;
• Complain — first to us, and then to the Data Protection Board of India if you are not satisfied with our response.

To exercise any of these, email info@codkrafters.com. We respond within 30 days. There is no charge.

As required by the DPDP Act, a named person is answerable for complaints about your data:

If your complaint is not resolved, you may escalate it to the Data Protection Board of India.

This site is aimed at businesses, not children. We do not knowingly collect data from anyone under 18. The DPDP Act requires verifiable parental consent for a child’s data; if you believe a child has sent us personal data, email us and we will delete it.

Enquiries and client records are held in our own backend rather than a third-party CRM. Data is encrypted in transit and personal data is encrypted at rest. Access is limited to the people who need it, behind individual accounts with role-based permissions.

No system is perfectly secure and we will not claim otherwise. If a breach occurs that affects you, we will notify you and the Data Protection Board as the DPDP Act requires.

If this policy changes materially we update the date at the top and, where the change affects how we use data you have already given us, we tell you directly. The terms govern the work itself.