Privacy Policy

This policy applies to information collected through our official digital channels, including:

• Visitors to our website at https://stynaco.com.
• Individuals submitting project inquiries, quote requests, or free digital audit forms.
• Prospective, current, and past clients engaging our design, software engineering, or consulting services.
• Registered account users accessing our client portals or authentication platforms.

We only collect information that is strictly relevant and necessary to fulfill your requests, execute contracts, or operate our platform securely. We do not collect personal data indiscriminately.

We collect personal information through the following factual touchpoints:

• Website Form Submissions: When you complete the Contact Form (/contact) or the Free Digital Audit form on our homepage.
• Direct Electronic Communication: When you email our studio or initiate a WhatsApp conversation via our verified links.
• Account Registration & Authentication: When you register an account, request a login OTP, or sign in via Google OAuth.
• Automated Infrastructure Telemetry: Standard server logs captured by our edge servers and application runtime during web requests.

Stynaco processes your information exclusively for legitimate, defined, and transparent business purposes:

• Responding to Enquiries: Answering questions, reviewing project scope, providing software architecture recommendations, and delivering tailored fee proposals.
• Service Delivery & Contract Execution: Developing, testing, deploying, and maintaining digital software applications, SaaS systems, and digital assets.
• Authentication & Account Maintenance: Verifying user identity, managing secure sessions, and delivering authentication one-time passwords (OTPs).
• Platform Security & Abuse Prevention: Mitigating denial-of-service (DDoS) threats, preventing automated spam submissions, enforcing rate limits, and securing our API endpoints.
• Legal & Regulatory Compliance: Satisfying statutory bookkeeping, tax filing (GST/Income Tax in India), and legal obligations under applicable law.

Notice: We do not sell, rent, or trade your contact details to third-party marketing firms or data brokers. We do not send unsolicited bulk promotional emails.

Under India’s Digital Personal Data Protection Act, 2023 (DPDP Act 2023) and comparable global data protection frameworks, our processing activities rest on the following lawful bases:

• Consent (Section 6, DPDP Act 2023): When you explicitly submit an inquiry or audit request, you consent to our collecting your contact information to communicate with you about your request.
• Contractual Necessity: Processing required to prepare formal service agreements or fulfill contractual obligations for software engineering engagements.
• Certain Legitimate Uses (Section 7, DPDP Act 2023): Processing necessary for system security, fraud mitigation, incident response, and statutory compliance.
• Legal Obligations: Compliance with applicable Indian laws, tax regulations, and lawful orders from judicial or regulatory bodies.

We believe in privacy by design. Our website avoids invasive tracking cookies and respects user autonomy:

No Third-Party Advertising Pixels: We do not deploy third-party advertising tracking pixels (such as Meta Pixel or cross-site tracking beacons) on this website. Third-party marketing cookies are not utilized. You may configure your browser to reject cookies, though certain authenticated account features may not function as intended without essential session cookies.

To host, operate, and maintain our systems reliably, Stynaco engages reputable infrastructure and service providers. Each provider processes personal data strictly as necessary to execute their assigned technical role:

Stynaco will not disclose or transfer your personal data except under the following specific, vetted circumstances:

• With Contracted Service Providers: Specialized infrastructure partners (e.g. Resend, cloud hosting) bound by strict confidentiality and data protection covenants.
• Client-Directed Integrations: When you contract our studio to integrate third-party payment gateways, CRM systems, or cloud APIs on your behalf.
• Compliance with Legal Process: In response to valid legal requests, subpoenas, court orders, or statutory obligations under Indian or applicable international law.
• Protection of Rights & Security: When necessary to investigate fraud, enforce agreements, or protect the safety and integrity of Stynaco systems and users.

We retain personal data only for as long as reasonably necessary to fulfill the purposes for which it was collected, including satisfying legal, accounting, or reporting requirements. Our retention practices include:

• Client Inquiries & Audit Requests: Retained for up to 24 months from submission to facilitate follow-up discussions and project scoping, unless converted to active contracts or earlier deletion is requested.
• User Account Information: Retained for the active lifespan of the account. Account holders may request closure and data deletion at any time.
• Verification OTPs: One-time authentication codes expire automatically after 10 minutes and are purged from active memory.
• Financial & Contractual Records: Invoices, contracts, and tax-relevant documentation are retained for up to 8 years in compliance with statutory Indian commercial and taxation laws.
• Server Logs: Operational access and diagnostic logs are typically retained for 30 to 90 days before automated rotation and deletion.

Stynaco enforces comprehensive administrative, physical, and technical safeguards designed to protect personal information against unauthorized access, alteration, disclosure, or destruction:

• Encrypted Transport (TLS/HTTPS): All data transmitted between your browser and our servers is encrypted using modern TLS (Transport Layer Security) protocols.
• Cryptographic Password & OTP Hashing: Passwords are never stored in plain text; they are hashed using salted bcrypt algorithms. One-time passcodes are stored as secure hashes.
• Defensive HTTP Headers: Implementation of HTTP security headers (Helmet, Content-Security-Policy, anti-clickjacking) across our application servers.
• Rate Limiting & Input Sanitation: Automated abuse detection and strict API rate limits to prevent brute-force attacks and credential stuffing.
• Role-Based Access Control: Administrative and database access is restricted to verified personnel on a strict need-to-know basis.

Disclaimer: While we implement rigorous, industry-recognized security measures, no electronic transmission or storage system is completely impervious. We cannot guarantee absolute, invulnerable security.

Stynaco serves Indian and international customers. While our studio operations are located in Maharashtra, India, our infrastructure utilizes globally distributed providers (e.g. Resend for email routing and cloud edge networks). As a result, your information may be transferred to, stored, and processed in jurisdictions outside your country of residence.

Where cross-border transfers occur, we verify that our service providers adhere to recognized data protection standards and provide appropriate technical and contractual safeguards.

Under applicable privacy legislation, including India’s Digital Personal Data Protection Act, 2023, you have defined rights regarding your personal information:

• Right to Access Information: You may request confirmation of whether we process your personal data and obtain a summary of the data held.
• Right to Correction & Updating: You may request the correction of inaccurate or incomplete personal information.
• Right to Erasure (Deletion): You may request the deletion of your personal data when it is no longer required for the purpose for which it was collected, subject to statutory retention obligations.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw your consent at any time without affecting the lawfulness of processing undertaken prior to withdrawal.
• Right of Grievance Redressal: You have the right to register a grievance with our designated privacy point of contact regarding the handling of your data.

To exercise any of these rights, please email us at [email protected] or contact us via the details in Section 17. We will acknowledge your request promptly and respond within the statutory timeframe prescribed by applicable law after verifying your identity.

Our website, digital consulting, and software development services are directed exclusively at business representatives, founders, and adult individuals capable of entering into binding commercial contracts. We do not knowingly solicit or collect personal information from individuals under the age of 18 (defined as children under Indian data protection law).

If you believe a minor has submitted personal data to our studio without parental or guardian consent, please notify us immediately at [email protected] and we will take swift steps to delete the information permanently.

Our website may include links to third-party services, social media networks (such as X, LinkedIn, Instagram, Facebook, YouTube, GitHub), or external resources. Clicking those links or enabling those connections may allow third parties to collect or share data about you.

Stynaco has no control over and assumes no responsibility for the content, privacy policies, or practices of any third-party sites. We encourage you to inspect the privacy statements of any external platform you visit.

We may modify or update this Privacy Policy from time to time to accommodate changes in our operational practices, service offerings, technology architecture, or statutory legal obligations.

Any revisions will be posted directly to this page with an updated “Last Updated” date at the top of this document. We recommend reviewing this page periodically. Continued engagement with our studio following the posting of changes constitutes acknowledgment of the revised terms.