Privacy policy

This notice explains how Aarav Sheth (the “Data Fiduciary”) collects and processes your personal data, in line with India's Digital Personal Data Protection Act 2023 (“DPDP Act”). It tells you exactly what each form collects, who processes it and where, how long it is kept, and the rights you can exercise.

Who is the Data Fiduciary

The Data Fiduciary responsible for your data is Aarav Sheth, an independent AI builder operating as a sole proprietor in Mumbai, Maharashtra, India. For all data-protection matters, including an address for service of notices, contact Aarav Sheth, Mumbai, Maharashtra, India, by email at aaravshethh@gmail.com or on WhatsApp at +91 83559 58551.

What we collect, per form

We only collect what a given form needs. Every form also records a consent record — the consent flag you tick, the timestamp it was given, and the version of this policy in force at the time — so we can evidence the lawful basis for processing under the DPDP Act.

Book a call collects your name, email, WhatsApp number (optional), the services you select, a project description / note, the chosen slot time and your visitor timezone (so the slot is shown and stored correctly).

Send a message / contact collects your name, email, WhatsApp number (optional), the message body you write, and the source page you submitted from.

Klyft waitlist collects your name, email, WhatsApp number, your Shopify store URL (optional), and your monthly order volume (optional).

Newsletter collects your email address only. Content gatecollects your name, email, WhatsApp number, and the source page, and stores a device-local unlock flag (see Cookies & local storage).

Across all forms we also briefly process the IP address of the submission for rate-limiting and abuse prevention. This is held only transiently and not stored as part of your record.

How we use it

Your data is used solely for the specified purpose you provided it for: to respond to your enquiry, to schedule and manage a consultation call, to deliver the newsletter or Klyft updates you asked for, or to unlock gated content. We do not sell, rent, or use your data for advertising, profiling, or any unrelated purpose.

Who processes your data, and their role

We engage the following Data Processors, each under contract and only for the purposes above:

• Resend — transactional email delivery (form notifications and booking confirmations). Region: United States.
• Google Calendar / Meet / Apps Script — scheduling, the video-call link, and writing booking and form rows to a private, access-controlled sheet. Region: United States.
• Neon (Postgres) — durable, access-controlled storage of booking records so calls can be managed and reschedule / cancel links kept valid; also holds short-lived, IP-based rate-limit counters for abuse prevention. Encrypted with AES-256 at rest.
• Vercel — hosting and serving of this website and its API routes.

Where your data is processed

This is an Indian Data Fiduciary, but the processors above operate outside India — primarily in the United States and other regions. Submitting a form therefore involves a cross-border transfer of your personal data to those processors. Consistent with section 16 of the DPDP Act, we transfer data only to processors that are not in a country restricted by the Central Government, and we rely on contractual safeguards and access controls to protect it wherever it is processed.

How long we keep it

We keep personal data only as long as the purpose requires:

• Booking records (Neon Postgres): retained while a call is upcoming; non-confirmed bookings are purged within 30 days of their scheduled slot, and confirmed-call records are deleted on request after the call is complete. Confirmed booking details are anonymized after 12 months — name, email, and contact number are removed, while the consent record itself is retained.
• Rate-limit counters:transient — they expire automatically within minutes. Any operational logs are retained per our hosting provider's standard policy and are not used to profile you.
• Email and sheet records: kept only as long as needed to handle your enquiry or deliver the updates you requested, and deleted on request.

Cookies & local storage

This site does not use tracking cookies. We use localStorage only for the content gate, which stores a small device-local unlock flag after you submit. There are no third-party analytics, advertising pixels, or session cookies.

Your rights under the DPDP Act 2023

As a Data Principal, you have the right to access a summary of your personal data and how it is processed, the right to correction and erasure of your data, the right to grievance redressal, and the right to nominate another individual to exercise your rights in the event of your death or incapacity. You also have the right to withdraw your consent at any time — as easily as it was given — by emailing the address below; withdrawal does not affect processing already carried out lawfully before the withdrawal. To exercise any of these rights, email aaravshethh@gmail.com. We will respond within 15 business days.

No minors

This site and its forms are intended for users aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you are under 18, please do not submit any form. If we learn that we have collected data from a minor without verifiable parental or guardian consent, we will delete it.

Grievance Officer

For any data-protection concern or complaint under the DPDP Act 2023, the Grievance Officer is Aarav Sheth, reachable at aaravshethh@gmail.com. Complaints are acknowledged and addressed within 15 business days.

Contact

Questions about this policy: aaravshethh@gmail.com