Privacy policy

This website is run by Envisstack India Private Limited (in formation), trading as Envisstack (“we”, “us”). Until the company is incorporated, the website is run by its founders on its behalf.

Registered office: Mumbai, Maharashtra, India Privacy contact: privacy@envisstack.com

For the purposes of the Digital Personal Data Protection Act, 2023 (“DPDP Act”), we are the data fiduciary for the personal data described in this policy.

This policy covers this website only. When we work for a client, the client is usually the data fiduciary for its own customers’ data, and our handling of that data is governed by our contract with the client.

We follow the DPDP Act and the Digital Personal Data Protection Rules, 2025. These come into force in phases. Most core duties on data fiduciaries apply from 13 May 2027. We apply them now, as good practice.

Until then, and to the extent they still apply, we also follow the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.

We collect personal data mainly when you give it to us. We also count visits to the site on our own server, without cookies, as described in the row “Browse the site” below and in section 7.

Reading our articles does not require you to give us any personal data.

• We do not ask for Aadhaar, PAN, bank, card or health details through this website. Please do not send them.
• We do not use advertising cookies, analytics cookies, third-party analytics tools, cross-site tracking or social media pixels.
• We do not buy personal data from third parties.
• We do not knowingly collect data from children.

Where we rely on your consent, we ask for it clearly, for a specific purpose, before we collect the data. Every form tells you what we will do with what you enter.

You can withdraw consent at any time, and it is as easy as giving it:

• Newsletter emails: click “Unsubscribe” in any email, or write to privacy@envisstack.com.
• Website analytics: turn on Do Not Track or Global Privacy Control in your browser and we stop counting your visits from that moment. We set no analytics cookies, so there is nothing to switch off on the site itself.
• Contact form or job application: write to privacy@envisstack.com and ask us to delete your data. For a job application you can also reply to the confirmation email or write to careers@envisstack.com. We delete the application and the CV together.

Withdrawing consent does not affect what we did lawfully before you withdrew it. Once you withdraw, we stop the processing and delete the data within 30 days, unless the law requires us to keep it.

We do not currently use a registered consent manager. If we do in future, we will update this policy.

We set no cookies for analytics or advertising. To understand how the site is used, we count visits with our own system, on our own server in Mumbai, without cookies and without storing any identifier in your browser:

• Each visit is counted with a one-way code made from your IP address and browser details and a random value that changes every day. The random value is held only in memory and never stored, so the code cannot be turned back into your IP address, and visits on different days cannot be linked to each other.
• We do not store your IP address, your full browser details or anything you type into a form.
• If your browser sends a Do Not Track or Global Privacy Control signal, we do not record your visit at all.
• Individual events are deleted after 90 days. We keep only daily totals, which identify no one.
• No third party receives this data. It is not used for advertising or to build a profile of you.

Full details, including the small items the site keeps in your browser, are in our cookie notice.

We do not sell personal data. We share it only with service providers who process it on our behalf, under written contracts that require them to keep it secure and use it only for our instructions.

We may also disclose personal data if the law requires it, for example to comply with a lawful order from a court or government authority.

We prefer providers that store data in India. Some of the providers above may store or process data outside India. The DPDP Act allows this except to countries the Government of India has restricted. We do not transfer personal data to any restricted country, and we will update this section if the list changes.

We use reasonable security safeguards, including:

• Encryption in transit (HTTPS) across the site, and encryption at rest with our providers.
• Access limited to the people at Envisstack who need it, with multi-factor authentication.
• Logs of who accessed form and application data.
• Contracts with every provider that require security safeguards and breach notification.
• Deleting data when the retention period ends.

No system is perfectly secure. If something goes wrong, see section 13.

If a personal data breach affects you, we will tell you without delay, in plain language: what happened, what data was involved, what it may mean for you, what we are doing about it and what you can do. We will also inform the Data Protection Board of India as the DPDP Rules require, including a detailed report within 72 hours of becoming aware of the breach, and CERT-In where required.

This website is for businesses and professionals. It is not directed at anyone under 18, and we do not knowingly collect their data. If you believe a child has given us personal data, write to privacy@envisstack.com and we will delete it.

We will update this policy when our practices or the law change. The date at the top shows the latest version. If a change affects how we use data you have already given us, we will tell you by email before it takes effect and, where needed, ask for your consent again.

This policy is in English. If you would like it in Hindi, Marathi or another of the languages in the Eighth Schedule to the Constitution of India, write to privacy@envisstack.com and we will send it to you.