Privacy policy.

The short version

This website has no accounts, no advertising trackers and no marketing cookies. We do not build profiles of visitors. Apart from what you send us through the enquiry form and standard server logs, the only other data we collect is anonymous-style visit statistics through Google Analytics, and only if you opt in. The analytics box and the map box in the consent panel both start unticked, and you can change either at any time.

Who is responsible

Shadowtrace Solution Private Limited (CIN U63999MH2025PTC439586) is the data controller.

1st Floor, Vaswani Mansion, Dinshaw Vacha Rd, Churchgate, Mumbai, Maharashtra 400020, India
Data protection contact: yash.kute@shadowtrace.in, or use the contact form and choose "Privacy or data request". This address is published for questions about how we process personal data, as Rule 9 of the DPDP Rules 2025 requires. For anything else, please use the form.

What is collected automatically

Our web host records standard server logs when a page is requested: IP address, timestamp, the page requested, referring page and browser user-agent. These logs exist to keep the site running and to detect abuse. They are not used to identify you or to build a profile, and they are not shared for marketing. Legal basis: legitimate interest in operating and securing the service (GDPR Art. 6(1)(f)).

Fonts

Typefaces are served from this domain. No request is made to Google Fonts or any other font CDN, so your IP address is never disclosed to a font provider.

The enquiry form

When you submit the form on our contact page we collect your name, email address, company name if you give one, the subject you choose, and your message. We use them for one purpose: to answer you. We do not use them for marketing, and we do not sell or share them.

The form is processed on our own server and the emails are sent through Google Workspace, which hosts our mail. No form-handling service, analytics tool or advertising network sees your submission.

What happens when you submit. You get a confirmation email containing a reference number. A copy of the enquiry goes to our inbox. We reply within 7 days.

How long we keep it. Enquiries are retained for 24 months from the last contact about them, so we can pick up an earlier conversation, then deleted. If an enquiry becomes a contract, the record is kept for as long as the engagement and the statutory record-keeping period that follows it require.

Legal basis. Your consent, which you give with the checkbox on the form (GDPR Art. 6(1)(a)), and steps taken at your request before entering a contract (Art. 6(1)(b)). Under India's DPDP Act 2023 the basis is the consent you give at the point of submission. You can withdraw consent at any time through the contact form, and we will delete the enquiry.

Abuse prevention. To stop automated spam we record a one-way hash of your IP address with each submission and limit how many messages one connection can send in an hour. The hash cannot be reversed to recover your IP address, and it is deleted with the enquiry.

Who we are under Indian law

Under the Digital Personal Data Protection Act 2023, Shadowtrace Solution Private Limited is a Data Fiduciary for the personal data described on this page, and you are a Data Principal. You may access, correct, update or erase your data, nominate someone to exercise your rights, and raise a grievance with us. To raise a grievance, use the contact form and choose "Privacy or data request". We will respond within 30 days. If you are not satisfied you may escalate to the Data Protection Board of India.

Analytics (Google Analytics 4), only if you opt in

What it is. If you tick "Analytics" in the consent panel, we load Google Analytics 4, a service of Google LLC. Before you opt in, the Google Analytics script is not loaded and no request is sent to Google for this purpose.

What is collected. Pages viewed, time on page, approximate location (city level, derived from your IP address by Google), browser, device and screen details, referring site, and a random identifier stored in a first-party cookie (_ga and _ga_*). Your IP address is sent to Google as part of the request; Google does not log or store it in Analytics. We do not send names, email addresses or enquiry contents to Analytics.

Purpose. Only to understand how many people visit and which pages are useful, so we can improve the site. We do not use it for advertising. Google signals and ad personalisation are switched off, and we do not link Analytics to any advertising account.

Legal basis. Your consent, given by ticking the box and saving or accepting. Under India's DPDP Act 2023 this is consent for that single, specified purpose. You can say no and still use every part of the site.

Who receives it. Google acts as our processor for Analytics. Data may be processed on Google's servers outside India, including in the United States, under Google's own terms and safeguards.

How long we keep it. Analytics event data is kept for 2 months and then deleted automatically by Google. The cookies expire after at most 2 years, or sooner if you withdraw consent, which removes them.

Withdrawing. Open "Privacy choices" in the footer, untick Analytics and save, or choose "Reject all". Withdrawal is as easy as giving consent: the Analytics script stops loading and the cookies are deleted straight away. Data already collected is deleted at the end of the retention period above, or earlier if you ask us through the contact form.

Children. This website is for businesses and is not aimed at anyone under 18. We do not knowingly track children.

Google Maps

The contact page embeds a Google Maps frame so you can find our office. When that frame loads, Google receives your IP address and may set cookies under its own terms. If you do not tick "Map" in the consent panel, the map is not loaded and no request reaches Google. You can change that choice at any time from the link in the footer.

Google's handling of that data is described in the Google Privacy Policy.

Links out

Pages link to LinkedIn, Discord and to products we run (PC Part Hunt, DineSlip, Rust Samrajya). Following a link puts you under that site's own privacy policy. We have no control over what they collect and no access to it.

Other messages

The form is the way to reach us about work. If you contact us some other way, for example by emailing the data protection contact above or replying to our confirmation email, we keep that message on the same terms as an enquiry: used only to answer you, kept for 24 months from the last contact, then deleted. Legal basis: steps taken at your request before entering a contract, or our legitimate interest in answering you.

Storage on your device

We store one entry in your browser's local storage, st-consent-v2, recording your analytics and map choices and the time you made them. It contains no identifier, is never transmitted to us, and you can clear it from your browser at any time. If you opt in to Analytics, Google also sets the cookies described above on this domain.

Your rights

If you are in the EU or UK, the GDPR gives you the right to access, correct, erase, restrict and port your data, to object to processing based on legitimate interest, and to complain to your national supervisory authority. If you are in India, the Digital Personal Data Protection Act 2023 gives you comparable rights of access, correction, erasure and grievance redressal.

To exercise any of these, send a request through the contact form and choose "Privacy or data request". We will respond within 30 days.

International transfers

We are based in India. If you opt in to Analytics or load the map, those requests go to Google and may be processed outside India, including in the United States, under Google's own transfer safeguards. The Government of India can restrict transfers to particular countries; we will stop using a service in any country that is restricted.

Changes

If this policy changes materially we will update the date at the top of this page.