Privacy Policy

Buildwright provides documentation, filing, and compliance facilitation for early-stage businesses in India, through this website at buildwright.co.in. In this policy, “we” and “us” mean BuildWright Consultants, operating as Buildwright, with its registered office at Hargovind Enclave, Chhatarpur, Delhi 110068.

Under the Digital Personal Data Protection Act, 2023, we are the Data Fiduciary for the personal data described here, and you are the Data Principal. This policy covers the website and the free tools on it. If you engage us for a service, the engagement terms you sign govern that work, and they take precedence over this page where the two differ.

We collect only what you give us, plus basic technical information about your visit.

When you use the contact form, we collect your name, email address, phone number, your message, the service you said you were interested in, and your company name if you give one.

Alongside a contact form submission, we store the page you first landed on, the site that referred you, and any campaign tags in the link you followed (the utm_source, utm_medium, utm_campaign and utm_content parameters). This tells us which of our work actually reaches people. It is captured once, on your first visit.

When you subscribe to the newsletter, we collect your email address, a note of where on the site you subscribed, and a unique token that powers your unsubscribe link.

When you use one of our tools, we store the answers you enter and the report the tool generates, so you can come back to it and so we can support you if something goes wrong. Please do not paste anything into a tool that you would not want stored, and see section 5 for who processes it.

Automatically, our hosting provider records standard server logs, including your IP address, browser type, and the pages you requested. If website analytics are switched on, we also collect the usage data described in section 4.

When you become a client, we keep a record of your identity details, your business, and the business activities that shape your compliance position, such as the registrations you hold and the filings that fall due for you. We collect this only after you have engaged us and given your consent under the engagement terms, and we use it to keep your compliance tracking current and to do the work you hired us for.

We do not ask for and do not want government identity numbers, financial account details, or any of the sensitive categories of personal data through this website. When a service we are engaged for genuinely requires identity documents, we collect those separately under a signed engagement, not through this site.

• To reply to you, and to understand what you need before we quote for it.
• To deliver a service you have engaged us for, including preparing and filing documents on your instructions.
• To track the compliance deadlines and obligations of your business once you are a client, using the details collected under your engagement.
• To send you the newsletter, but only if you subscribed to it.
• To generate the output of a tool you chose to use.
• To keep our own statutory books and records, and to deal with a dispute or a legal claim if one arises.
• To understand which pages and campaigns bring people to the site, so we can write more of what helps.

We do not use your personal data to make automated decisions that produce legal or similarly significant effects about you. A tool's output is information for you to act on, and it is not a decision we make about you.

The website runs without cookies for its core functions. We do not use advertising cookies, and we do not run cross-site tracking or remarketing pixels.

Where website analytics are enabled, we use Google Analytics 4, which sets its own cookies to count visits and to tell a returning visitor from a new one. Analytics is configured to be off unless it has been deliberately switched on, so it may not be running when you visit. You can block these cookies in your browser settings, or with Google's opt-out browser add-on, and the site will work normally either way.

We do not sell your personal data, and we do not share it for anyone else's marketing. We do rely on a small number of service providers to run the site, and they process data on our instructions:

• Google. The site, its database, and its file storage run on Google Firebase and Google Cloud. Our email is on Google Workspace, so anything you email us sits there too. Google Analytics, where enabled, is also Google.
• Anthropic. When you use one of our tools, the answers you enter are sent to Anthropic's Claude API to generate the output. Do not enter anything into a tool that you are not comfortable being processed this way.
• A payment provider. Paid tools and services are not live yet. When they are, card and payment details will be handled directly by the payment provider, and we will not receive or store your full card details.

Separately, when you engage us to make a filing, we submit the documents and details you give us to the relevant authority, such as the Ministry of Corporate Affairs or a GST or other registration portal. That is the entire point of the engagement, and we do it on your instructions.

We will also disclose personal data where the law requires it, for example in response to a valid order from a court or a regulator.

Your data is stored on Google Cloud infrastructure in [to be confirmed: Firestore/hosting region]. Some of our providers, including Anthropic, process data outside India, so using our tools involves a transfer of that data abroad.

Access to the admin side of the site is restricted to authenticated Buildwright accounts, and traffic to the site is encrypted in transit. No system is perfectly secure, and we cannot guarantee absolute security, but if a breach affects your personal data we will notify you and the Data Protection Board as required.

We keep enquiry and client records for [to be confirmed: retention period for lead and client records], and tool submissions for [to be confirmed: retention period for tool submissions]. Newsletter subscriptions are kept until you unsubscribe. Where a law requires us to keep something for longer, such as records connected to a filing we made for you, we keep it for that period.

Under the Digital Personal Data Protection Act, 2023, you can ask us to:

• tell you what personal data of yours we hold and what we have done with it;
• correct anything inaccurate, or complete anything missing;
• erase your personal data, where we are not required to keep it;
• nominate someone to exercise these rights if you die or become incapacitated.

You can withdraw consent at any time, and withdrawing it is as easy as giving it. Every newsletter has a one-click unsubscribe link, and you can also email us. Withdrawing consent does not undo anything we did lawfully before you withdrew it.

If you are unhappy with how we have handled your data, you can complain to our grievance officer using the details in section 11, and you have the right to escalate to the Data Protection Board of India.

This site is meant for people running or starting a business, and it is not directed at children. We do not knowingly collect the personal data of anyone under 18. If you believe a child has given us personal data, tell us and we will delete it.

We will update this page when what we collect or how we use it changes. The date at the top always shows the current version. If a change materially affects your rights, we will say so on the site, and we will email newsletter subscribers.

For anything about this policy, or to exercise any of the rights in section 8, email connect@buildwright.co.in.

Our grievance officer under the Digital Personal Data Protection Act, 2023 is [to be confirmed: grievance officer name and contact details]. We aim to respond to every request within [to be confirmed: grievance response time commitment].