Privacy Policy
Last Updated: November 9, 2026 · Effective Immediately
At apnafoundrys ("apnafoundrys", "we", "us", or "our"), we respect the intellectual confidentiality, privacy, and proprietary nature of the software ideas, client materials, and personal information shared with our digital product studio.
01. Scope & Commitment
This Privacy Policy outlines our transparent standards for collecting, processing, securing, and retaining information when you visit apnafoundry.com, submit project inquiries, book technical discovery calls, or collaborate inside our authenticated client workspaces.
We operate as a high-integrity engineering studio. We never sell, rent, monetize, or broker personal contact information or client intellectual property to third-party data brokers, ad networks, or AI scrapers.
02. Information We Collect
A. Information You Voluntarily Provide
- Inquiry Details: Name, work email address, company or startup name, budget bracket, target delivery timeline, and high-level project description.
- Discovery Call Scheduling: Preferred consultation slot, founder role, and discussion agenda topics.
- Client Portal Authentication: Client business email, authorized workspace credentials, and project milestone approvals.
- Communication Records: Emails, Slack/WhatsApp correspondence, and meeting notes conducted during project scoping.
B. Technical & Operational Telemetry
- Device operating system, browser engine version, screen resolution, and language settings.
- Aggregated, privacy-anonymized site performance metrics (Core Web Vitals, page latency, and error boundary digests).
- IP address and broad geographic region (country/city level) strictly for DDoS prevention, rate limiting, and bot mitigation.
03. Purpose & Legal Basis
We process data under lawful bases recognized by the Digital Personal Data Protection Act (DPDP Act 2023, India), the General Data Protection Regulation (GDPR, EU/UK), and applicable international data privacy standards:
- Contractual Execution: Preparing architectural proposals, scoping delivery sprints, issuing tax-compliant milestone invoices, and delivering agreed software codebases.
- Direct Communication: Sending transactional booking confirmations, sprint status digests, and technical architecture recommendations.
- Security & Integrity: Preventing automated bot spam (via honeypot validation), protecting authenticated workspaces via PostgreSQL Row-Level Security, and investigating unauthorized access attempts.
04. Strict Client Confidentiality
We understand that early-stage product concepts and proprietary algorithms represent enterprise value. All project disclosures submitted through our forms or discovery calls are treated as confidential by default.
We gladly sign mutual Non-Disclosure Agreements (NDAs) prior to in-depth technical scoping. We never publish project details, case studies, or architectural blueprints without explicit, written client approval.
05. Security & Infrastructure
We apply defense-in-depth security principles across all layers of our digital operating stack:
Encryption at Rest & Transit
All web traffic is forced through TLS 1.3 encryption with strict HTTPS headers. Database records and storage backups are encrypted at rest using industry-standard AES-256.
Row-Level Security (RLS)
Our PostgreSQL database enforces protocol-level tenancy. Client users are strictly constrained by cryptographic JWT tokens from viewing any other client's milestones or assets.
06. Third-Party Infrastructure Providers
To operate our platform, we partner with vetted, SOC 2 / ISO 27001 compliant cloud infrastructure providers:
- Supabase Inc. — Managed PostgreSQL database hosting, authenticated identity management, and secure file storage.
- Vercel Inc. — Global edge application hosting, CDN caching, and serverless compute.
- Resend Inc. — Transactional email delivery for inquiry alerts and calendar confirmations.
- Google LLC — Privacy-friendly Google Analytics 4 (only activated when opted in for aggregate traffic evaluation).
07. Data Retention & Your Rights
We retain inquiry records and client project telemetry only for as long as necessary to fulfill the engagement objectives, comply with statutory tax reporting requirements (GST / Corporate Law), or resolve legal obligations.
Under applicable data protection legislation, you have the right to:
- Request confirmation and copies of personal data we maintain about you.
- Request correction of inaccurate or incomplete records.
- Request erasure ("Right to be Forgotten") of contact records when no active contract or statutory tax retention applies.
- Withdraw consent for optional communications at any time.
08. Contact Our Data Protection Lead
For privacy inquiries, data deletion requests, or NDA execution requests, reach out directly to our privacy desk:
apnafoundry Studio — Privacy & Legal Desk
Direct response guaranteed within 24–48 business hours.