Privacypolicy. — how Araskova Labs handles personal data under India's DPDP Act

Araskova Labs (“we”, “us”) is a founder-owned, fully remote lab in Kerala, India. We run www.araskova.com and decide how the personal data described here is used. Under India's Digital Personal Data Protection Act, 2023 (the DPDP Act), that makes us the data fiduciary.

Contact for anything in this policy: hello@araskova.com.

• You can read the whole site without telling us who you are.
• We only collect what you choose to send: a contact message, a newsletter sign-up, or an application you email us.
• No analytics, no advertising trackers, no tracking cookies.
• We don't sell or rent personal data, and we don't use it to train AI models.

The contact form. Your name, email address, and the message you write, plus your company and budget range if you choose to add them. They come to us as an email so we can reply about your project. We keep that email for as long as the conversation and any work that follows need it, and no longer than our records require.

The newsletter. Your email address. We add it to our mailing list and send you one welcome email, then occasional research notes and releases. You can leave at any time: reply to any email or write to hello@araskova.com and we'll remove you.

Applications. The careers form opens your own email app with a drafted message to careers@araskova.com. Nothing passes through our servers until you send that email yourself. We use what you send to consider your application.

WhatsApp. “Start on WhatsApp” links open WhatsApp with a drafted message. If you send it, WhatsApp (Meta) handles that conversation under its own privacy policy, and we see what you send us there.

Serving the site. Like any website, our host (Vercel) receives standard request data, such as your IP address, browser type and the page asked for, to deliver pages and protect the service. It keeps these logs for a short period under its own terms.

Keeping the forms free of abuse. When you send a form, we count requests from your IP address and email address so one sender can't flood us. These counters hold no message content and expire on their own: after an hour for the contact form, and after an hour (IP) or a day (email address) for the newsletter.

The forms also carry a hidden field and note when the form was shown, so they can tell a bot from a person. That information is only checked when you send, and never stored.

Typefaces. The site's fonts are delivered with the page and aren't used to recognise you.

We set no tracking cookies. A few small settings stay in your browser's local storage, on your device only:

• araskova-theme-v2: light or dark mode.
• araskova-cookie-consent: the choice you made on the storage notice, and when.
• araskova-paper-scale: the text size you picked in the research reader.
• araskova-loaded (session storage, cleared when you close the tab): whether the opening animation has already played.

“Accept all” and “Essential” on that notice currently store the same settings, because the site sets nothing beyond them. Clearing your browser's site data removes them all.

We use a few service providers, each only for the job described:

• Vercel: hosts the site.
• Resend: delivers contact-form emails to us and newsletter emails to you, and holds the newsletter list.
• Upstash: holds the short-lived request counters described above.

These providers may process data outside India. When they do, we rely on their contractual commitments to protect it, and we transfer data only as the DPDP Act and Government of India notifications allow.

We process what you send on the basis of your consent, given when you submit a form, sign up, or write to us. You can withdraw that consent at any time by emailing hello@araskova.com. Withdrawing consent doesn't affect anything we processed before. We may still keep what the law requires us to keep.

Under the DPDP Act you can ask us to:

• tell you what personal data of yours we hold and how we use it;
• correct, complete or update it;
• erase it, where we no longer need it or you withdraw consent;
• nominate someone to exercise these rights for you if you die or become unable to do so.

Email hello@araskova.com from the address concerned, or tell us how to confirm it's you. We respond within the timelines the Act and its rules set.

If something here concerns you, write to us first at hello@araskova.com with the subject “Privacy grievance”. We'll acknowledge it and respond within the period the DPDP Act and its rules require. If you're not satisfied with our response, you can complain to the Data Protection Board of India.

The site is meant for adults and organisations. We don't knowingly collect data from anyone under 18. If you believe a child has sent us personal data, tell us and we'll delete it.

The site is served only over HTTPS with strict security headers. Form input is validated and cleaned on the server, and messages reach us as plain text. No system is perfectly secure. If we ever learn of a breach affecting your data, we'll inform you and the Data Protection Board as the law requires. To report a vulnerability, see security.txt.