Based in India, working worldwide contact@codeclays.com
Code Clays
Call now+91 81308 53178

Legal

Privacy Policy

Last updated:

This policy explains what personal data Code Clays collects through this website and when you email, call or message us, why we use it, who else handles it, how long we keep it and what your rights are. It is written for India's Digital Personal Data Protection Act 2023 and Digital Personal Data Protection Rules 2025, the Information Technology Act 2000 and its 2011 rules on sensitive personal data, and, for visitors in Europe and the UK, the GDPR.

In Short

  • We use your details only to reply to your enquiry, prepare a quote and, if we work together, run the project.
  • The contact form sends your details to our inbox by email. The website itself keeps no copy.
  • We never sell your details or use them for marketing.
  • Enquiries that do not become projects are deleted 12 months after our last contact.
  • No analytics, no advertising trackers and no cookies of our own.
  • You can see, correct or delete your details, or withdraw consent, by emailing contact@codeclays.com.

Who We Are

Code Clays is run by a team of six independent developers based in Ghaziabad, Uttar Pradesh, India. For your personal data we are the "Data Fiduciary" under the DPDP Act and the "controller" under the GDPR.

What We Collect

Through the Contact Form

  • Your name and email address.
  • Your phone or WhatsApp number, if you choose to give it.
  • The service you need, your budget range if you choose one, and your message.
  • A record that you agreed to this policy, with the date and time, so we can show you gave consent.

When You Email, Call or Message Us

Your name, email address or phone number, and whatever you choose to send us.

Technical Data

To deliver the website and run the spam check on the form, Cloudflare (our hosting provider) processes your IP address, browser type and similar connection details. We do not keep this data ourselves and we do not use it to identify you.

What We Do Not Ask For

We do not ask for sensitive personal data such as passwords, bank or card details, health, biometric or identity document details. Please do not include them in your message.

Why We Use It

  • To reply to your enquiry and prepare a quote. We rely on your consent, given with the tick box on the form or by contacting us yourself (DPDP Act section 6; GDPR article 6(1)(a)), and, under the GDPR, on taking the steps you asked for before a contract (article 6(1)(b)).
  • To run a project if we work together, and to keep the invoices and records the law requires (GDPR article 6(1)(b) and (c); the DPDP Act's legitimate uses for meeting legal duties).
  • To keep the form free of spam and abuse, using Cloudflare Turnstile (under the GDPR, our legitimate interest in a working, secure website, article 6(1)(f)).

We do not sell or rent your details, share them for anyone's marketing, add you to a mailing list, or use them for profiling or automated decisions.

How the Contact Form Works

When you send the form, your details pass over an encrypted connection to a small program on Cloudflare. It checks them and hands them to Resend, an email delivery service, which delivers them as one email to our inbox at Zoho Mail. The website has no database and keeps no copy. You may also receive one short automatic email confirming that we received your enquiry; apart from that, we answer you personally.

WhatsApp and Phone

If you contact us on WhatsApp, WhatsApp is run by Meta and its own terms and privacy policy apply to how WhatsApp handles your messages and account. If you call us, your phone network handles the call. Whichever way you contact us, we use what you share only to reply to you and, if we work together, for the project. We do not use your number for marketing, and the same 12-month deletion rule applies to these chats.

Who Can See Your Details

Everyone on our team who has access to the studio inbox can read enquiries. They may use them only to reply to you and to work on your project.

We also use a few service providers. They handle your data only to provide their service to us, under their own terms and privacy policies:

  • Cloudflare, Inc.: website hosting and the Turnstile spam check.
  • Resend: sends the contact form email to our inbox. It keeps a record of each email it sends, including its content, for a limited period under its own policy (currently up to 30 days on our plan).
  • Zoho Mail (Zoho Corporation): our email inbox, where form enquiries and emails you send us are kept.
  • Meta Platforms (WhatsApp): only if you choose to message us on WhatsApp.

We may also share data when the law requires it, for example in answer to a valid court order or a lawful request from a government authority in India.

Data Sent Outside India or Your Country

Cloudflare and Resend may process your data outside India, for example in the United States or Europe, and Zoho may store our inbox in data centres outside India. The DPDP Act allows this except to countries the Government of India restricts, and we will follow any such restriction. If you are in the European Economic Area or the UK, your enquiry comes to us in India, which does not have an EU adequacy decision. We receive it because it is needed to answer the request you made (GDPR article 49(1)(b)). Each provider explains in its own terms how it protects international transfers.

How Long We Keep It

  • Enquiries that do not become a project (form messages, emails and WhatsApp chats): deleted 12 months after our last contact with you.
  • Projects: kept while the project runs, then only what Indian tax and accounting law requires us to keep (such as invoices), for as long as it requires.
  • If you withdraw consent or ask us to delete your data: we delete it, unless the law requires us to keep something, and tell you in our reply what we deleted and anything we had to keep.

How We Protect It

The site is served over an encrypted (HTTPS) connection. The website stores no personal data, so there is no website database to leak. Our inbox is protected with 2-step login. If a personal data breach ever affects your data, we will tell you and India's Data Protection Board as the DPDP Rules require, and, where the GDPR applies, the relevant supervisory authority.

Your Rights

Under India's DPDP Act you can:

  • ask for a summary of the personal data we hold about you, how we use it and who we have shared it with;
  • ask us to correct, complete or update it;
  • ask us to delete it;
  • withdraw your consent at any time, as easily as you gave it (just email us);
  • have a grievance about how we handle your data addressed;
  • nominate someone to use these rights for you if you die or become unable to.

If you are in the European Economic Area or the UK you also have the right to restrict or object to our use of your data, to receive it in a portable format, and to complain to your local data protection authority.

To use any of these rights, email contact@codeclays.com with "Privacy request" in the subject. We may ask you to confirm it is you, using only what we need for that. It is free, and we reply within 30 days. Withdrawing consent does not affect anything we did before, but we will stop using your details and delete them unless the law requires us to keep them.

Complaints

Please email Atul Kumar Pandey at contact@codeclays.com first. We will acknowledge your complaint within 7 days and respond within the time the DPDP Rules allow. If you are not satisfied, in India you can complain to the Data Protection Board of India once our grievance process is complete. In Europe or the UK you can complain to your local data protection authority at any time.

Cookies

This website sets no cookies of its own and uses no analytics, advertising or tracking tools. Fonts, images and video are served from our own site. When the contact form is on screen, the Cloudflare Turnstile spam check loads from challenges.cloudflare.com and may use strictly necessary signals from your browser to tell people from bots; Cloudflare may also use strictly necessary security cookies to protect the site. Because nothing optional is used, there is no cookie banner.

Children

Our services are for businesses and adults. We do not knowingly collect personal data from anyone under 18. If you are under 18, please ask a parent or guardian to contact us for you. If we learn that we hold a child's data without a parent's or guardian's consent, we delete it.

Other Websites

Links to other sites, such as social networks or WhatsApp, take you to services with their own privacy policies. We are not responsible for how they handle your data.

Changes to This Policy

If we change this policy we will update the date at the top, and tell you directly where the law requires it.