Privacy policy
Last updated
Short version: I collect as little as possible, never sell your data, and delete it when you ask. The details are below.
Who is responsible
This website is run by Kartikeya Mishra, an individual based in Lucknow, India (“I”, “me”). I am the data fiduciary under India's Digital Personal Data Protection Act, 2023 (DPDP Act) and the controller under the EU and UK General Data Protection Regulation (GDPR). Contact for all privacy matters, including grievances: workmailkartikeya@gmail.com.
What I collect and why
| Where | Data | Purpose | Legal basis |
|---|---|---|---|
| Early-access list | Email, optional role and interests, approximate country, a one-way hash of your IP address | Send invites and launch news; prevent fake and duplicate sign-ups; measure interest in each project | Your consent (DPDP s.6; GDPR art. 6(1)(a)); fraud prevention as a legitimate interest |
| Project and contact forms | Name, email, optional company, budget and timeline, your message | Reply to you and, if we work together, prepare a proposal | Your consent; steps before a contract (GDPR art. 6(1)(b)) |
| Mitra chat | The messages you type | Answer your question. Unanswered questions are stored as text only, without any identifier, to improve the answers | Legitimate interest in running the site |
| Cost calculator | Nothing. It runs in your browser | — | — |
| Server logs | IP address, browser type, pages requested | Security, abuse prevention and debugging; kept by the hosting provider for as long as security needs and the law require | Legitimate interest |
Please don't send passwords, payment details or government ID numbers through any form or the chat.
Storage on your device
The site itself uses browser storage only for things you'd expect it to remember:
theme: light or dark mode, if you choose onemitra_lang: the language you picked in the chatea_refandea_code: the invite code that referred you, and your own code after you join
These never leave your device unless you submit a form. Clearing your browser data removes them.
Advertising
Some articles and the calculator page may show ads served by Google AdSense. Google and its partners may use cookies or similar technologies to show ads based on your visits to this and other sites. In the EEA, the UK and Switzerland you will be asked for consent first through a Google-certified consent message, and you can change your choice at any time from the privacy link it provides. Elsewhere you can manage personalised advertising at Google Ad Settings and learn more at how Google uses information from sites that use its services. No ads appear on the early-access, contact or project pages, and no personal data from forms is shared with advertisers.
Service providers
I use a small number of processors, each bound by its own data-protection terms:
- Vercel: website hosting and delivery
- Google Firebase (Firestore): storage of sign-ups and messages
- Resend: sending confirmation and notification emails
- Upstash: short-lived counters used for rate limiting
- An AI model provider (such as Anthropic or OpenAI): generating chat answers when Mitra's built-in answers don't cover a question. Only the conversation text is sent
- Google AdSense: advertising, as described above
Some of these providers process data outside India and the EU. Where that happens, transfers rely on the provider's safeguards such as standard contractual clauses, and on the transfer rules of the DPDP Act.
How long I keep it
- Early-access records: until you unsubscribe or ask for deletion, or 12 months after the last related launch, whichever comes first.
- Unconfirmed sign-ups: deleted after 30 days.
- Project and contact messages: up to 24 months, or longer if they become part of a contract and the law requires it.
- Anonymous chat questions: up to 24 months.
Your rights
Under the DPDP Act and the GDPR you can ask to access, correct, update or erase your data, withdraw consent at any time (this doesn't affect what happened before), nominate someone to act for you, and raise a grievance. Under the GDPR you can also object to processing, ask for restriction or portability, and complain to your local supervisory authority. In India, if you're not satisfied with my response you may approach the Data Protection Board of India.
Every email has a one-click unsubscribe link that deletes your early-access record. For anything else, email workmailkartikeya@gmail.com with the subject “Privacy request”. I reply within 30 days, usually much sooner.
Children
This site is intended for adults. I don't knowingly collect data from anyone under 18. If you believe a child has signed up, contact me and I'll delete it.
Security
Data is encrypted in transit (HTTPS with HSTS) and at rest by the storage provider. The database can't be reached from browsers at all; only the site's server can read it. IP addresses are stored only as salted one-way hashes.
Changes
If this policy changes in a meaningful way, the date at the top will change and, for material changes affecting early-access members, I'll email you. See also the terms of use.