legal
Privacy notice.
Version 2026-10-09.3 · last updated 9 October 2026
In short: we collect only what you send us and, if you allow it, how you use this site. We use it to reply to you, and for nothing else without asking. You can see, correct or erase it, or withdraw your consent, at any time through our privacy request form.
Who we are
Brandstac Private Limited (CIN U73100DL2026PTC470130), 5/36, 2nd Floor, Lajpat Nagar 4, New Delhi 110024, India(“Brandstac”, “we”). For the personal data of visitors and people who contact us through brandstac.com, Brandstac is the Data Fiduciary under India’s Digital Personal Data Protection Act, 2023 (the “DPDP Act”).
When we build or run something for a client, the client decides why and how its own customers’ data is processed, and we process it on the client’s instructions under our contract with them. That data is not covered by this notice; ask the client.
What we collect and why
| When | What | Why | Basis |
|---|---|---|---|
| You send the contact form | Name, email, company (optional), what you need, your message | To reply to your enquiry and discuss a possible project | Your consent (the required box on the form) |
| You tick “studio updates” | Occasional studio updates by email | Your separate, optional consent | |
| You allow marketing cookies and later send the form | The campaign or site that brought you here (UTM tags, ad click id, referring site, landing page) | To know which campaigns bring enquiries | Your consent (cookie choice) |
| You allow analytics cookies | Pages viewed, device and browser, approximate location, a random identifier | Visit statistics | Your consent (cookie choice) |
| You make a privacy request | Name, email, your request | To act on your rights and keep a record that we did | Our legal obligation under the DPDP Act |
| You make any choice above | A record of the choice, the notice version and the time, keyed by a one-way fingerprint of your email or a random id, never the email itself | To show what you agreed to, and to honour a withdrawal | Our legal obligation to demonstrate consent |
| Any visit | Server logs: IP address, browser, page, time | To run and secure the site | Necessary to provide the site you asked for |
We do not sell personal data, we do not use it for automated decisions about you, and we do not buy data about you from others.
Who receives it
A few service providers process data for us, only to run this site and our email. The full list, with what each receives and where, is on our subprocessors page: Vercel, Neon, Resend, Zoho, Google.
We share personal data with authorities only when the law requires it.
Where it is stored and processed
Our mailbox is in India (Zoho’s India data centre) and the site’s server functions run in Mumbai. Email delivery (Resend), analytics (Google, only if you allow it), hosting logs (Vercel) and our database (Neon) are outside India, as listed on the subprocessors page. The DPDP Act allows these transfers except to countries the Government of India restricts; we will stop any transfer to a restricted country.
How long we keep it
- Form rate-limit counters (fingerprinted IP): 1 day. Deleted daily by the retention job.
- Consent records: 3 years after your last choice. Deleted by the retention job; deleted at once on an erasure request.
- Privacy requests and our replies: 3 years after the request is closed. Deleted by the retention job.
- Audit log (ids and counts only): 3 years. Deleted by the retention job.
- Suppression list (fingerprint of an email that withdrew consent or asked for erasure): For as long as we send optional email. Kept so we never contact you again; holds no readable email.
- Enquiries in our mailbox (Zoho) and email delivery logs (Resend): 24 months after the last message, or the length of an engagement plus the period tax and company law require. Deleted by hand in a quarterly mailbox review; Resend logs expire on Resend's own schedule.
- Job or application forms: Not applicable: the site has none. Add a row here before adding such a form.
- Hosting logs (Vercel): Vercel's plan default (short; see the project's log settings). Expire automatically at Vercel.
- Database backups (Neon point-in-time restore): Neon's restore window for the project (its "history retention" setting). Expire automatically; a deleted row disappears from backups when the window passes.
Your rights and how to use them
- Access: a summary of the personal data we hold about you, what we do with it, and who we have shared it with.
- Correction: correct, complete or update it.
- Erasure: delete it, unless the law requires us to keep it.
- Withdraw consent: as easily as you gave it, with the withdrawal form. It stops what you consented to from then on; it does not undo what was done before.
- Nomination: name someone to use these rights for you if you die or cannot act.
- Grievance: complain to us about how we handled your data.
Use the privacy request form (no account needed) or email privacy@brandstac.com. A person replies within 30days. Before showing or changing anything we confirm the email address is yours. Withdrawing consent through the form takes effect immediately; cookie choices change at once through “Cookie settings”.
Security and breaches
The site is served only over HTTPS. Secrets live in environment variables, consent records hold a one-way fingerprint instead of your email, our logs do not record what you type into forms, and only named people can read enquiries and requests.
If a personal data breach affects you, we will tell you without delay what happened, what it could mean for you, what we have done and what you can do, and we will report it to the Data Protection Board of India as the DPDP Rules require.
Children
This site is for adults (18 and over). We do not knowingly collect children’s data and have no process for verifiable parental consent. If you believe a child has sent us personal data, tell us and we will delete it.
Grievance officer and the Data Protection Board
Our grievance officer is Lakshay Handa, Founder, at privacy@brandstac.com. We reply within 30 days. If you are not satisfied once we have answered, you can complain to the Data Protection Board of India.
Changes to this notice
When this notice changes we publish the new version here and say what changed:
- 2026-10-09.3: Email delivery (Resend) is processed in Japan (Tokyo), not the USA.
- 2026-10-09.2: Direct link to the consent withdrawal form.
- 2026-10-09.1: Rewritten for the DPDP Act 2023 and Rules 2025: named grievance officer, per-purpose consent, rights-request form, retention periods, subprocessors and cross-border transfers.