Privacy notice

Six fields, and only if you send them

The enquiry form asks for:

• Name — so we know who we are replying to
• Email address — so we can reply
• Phone number — so we can call you back about the enquiry
• Company — optional, and only helps us come prepared
• Which line of business — optional — one of four choices, or nothing
• Your message — the problem in your own words

That is the whole set. We ask for nothing the DPDP Act treats as sensitive. We use no advertising cookies and no tracking pixels, and we do not build a profile of you.

We do count visits, and measure how quickly pages load. What that records is which page was opened, which site you arrived from, roughly what device and country it was, and how long the page took to become usable. It is cookieless, carries no identifier, and follows you nowhere else. We look at the first part to learn which pages are worth writing more of, and the second to find pages that are slow, and there is no way for us to work back from either to a person. If you would rather not be measured at all, any tracker blocker stops it, and nothing on this site breaks when it does. Our hosting provider does both, and is named below.

One thing happens that you cannot see: to stop the form being used to send bulk spam, we count recent submissions against a one-way cryptographic hash of your IP address. The address itself is never written down anywhere, the hash cannot be turned back into it, and it is discarded automatically after about two hours.

To reply to your enquiry — with your consent

The purpose is answering the enquiry you sent and, if it goes further, scoping the work. The legal basis is your consent, given when you submit the form, and the notice beside the send button states this at the point of collection as the Act requires. We will not repurpose the data for marketing — there is no mailing list. You may withdraw consent at any time, at no cost, by emailing hello@kordian.in. Withdrawal does not affect anything already done while consent was in force.

24 months, then erasure

Each enquiry is stored with a deletion date 24 months ahead, and a job runs every night that removes everything past it. That is a mechanism rather than an intention: nobody has to remember to do it.

If we end up working together, the enquiry becomes part of the client record and is kept for as long as the contract and Indian tax and accounting rules require, then deleted. Ask us to delete sooner and we will, unless a legal obligation says otherwise — in which case we will tell you which one.

A separate form, kept for 12 months

The careers page has its own form, and what it collects is held separately from enquiries — a different table, a different purpose and a shorter life. It asks for:

• Name — so we know who we are writing to
• Email address — so we can write when a role opens
• What you do — one line, in your own words
• A link — optional — something you have built
• Anything else — optional

We hold it to contact you when we open a role. We do not use it for anything else, we do not share it, and there is no mailing list. We keep it for 12 months, then the same nightly job deletes it. Ask us sooner and we will delete it sooner — write to hello@kordian.in.

Four suppliers, named, and nobody else

Running a website means using suppliers, so here they are rather than described vaguely:

• Vercel — hosts this website, counts its visits and measures its speed — Mumbai, India
• Supabase — stores your enquiry — Mumbai, India
• Upstash — rate-limits the form — Mumbai, India
• Resend — delivers the notification email to us — Tokyo, Japan

Each processes the data on our instructions only, under contract, and cannot use it for anything of their own. We sell nothing, share nothing with advertisers, and pass nothing to anyone else unless the law compels us.

India, except the email, which goes via Japan

We chose Indian regions for the site, the database and the throttle, so your enquiry is stored in Mumbai. The one exception is the notification email that tells us you have written in: our email provider processes that in Tokyo, which means the contents of your message pass through Japan on the way to us. Any such transfer is made under the conditions the DPDP Act allows. We would rather state this plainly than let you assume otherwise.

Access, correction, erasure, complaint

You can ask what we hold about you, have it corrected or completed, have it erased, withdraw consent, and nominate someone to exercise these rights if you cannot. Email hello@kordian.in and we reply within 30 days, usually within one working day. If our answer does not satisfy you, you may complain to the Data Protection Board of India.

We tell you what happened, not what we would prefer

If personal data we hold is exposed, we will tell the people affected and the Data Protection Board within the time the law requires, and we will describe what actually happened rather than the version that reads better.

One address for all of it

Data protection queries, requests and grievances: hello@kordian.in. We will publish a named grievance officer and a postal address here before we take on data from anyone other than direct enquirers.

If this notice changes, the date at the top changes with it. We do not make material changes quietly. See also our terms.