Privacy Policy

AutodidactLabs (Sagar Kapasi) (“we”, “us”) operates sagarkapasi.com and related client workspaces for approved projects.

Registered / operating location: Pune, Maharashtra, India.

Privacy & grievance contact: contact@sagarkapasi.com

Grievance Officer (India DPDP): contact@sagarkapasi.com — we aim to respond within 90 days.

This Policy is a standalone notice. It can be read without reference to other documents, though our Terms of Service also apply to use of the service.

Identity & contact: name, email, mobile/phone, company name (optional).

Account & authentication: password (stored only as a secure hash), session identifiers, login timestamps.

Billing (where applicable): invoice numbers, amounts, payment status, and plan details. Card/UPI/bank details are processed by our payment provider — we do not store full payment credentials.

Technical & project data: domains, deployment metadata, resource usage, and server logs generated by services you use.

Support & communications: support messages, meeting requests, contact-form submissions, admin correspondence.

Security & compliance: IP address, browser/device type, audit and security event logs for fraud prevention and legal compliance.

Cookie/consent preferences: session cookie and localStorage consent choice (see Cookie Policy).

Provide, operate, and support your account and any engaged client services (contract).

Authenticate you and keep your session secure (contract / legitimate interests).

Process payments via our payment processor (contract / legal obligation).

Prevent abuse, fraud, and attacks on our infrastructure (legitimate interests / legal obligation).

Comply with tax, accounting, and lawful government requests (legal obligation).

Communicate about invoices, service changes, security incidents, and support replies (contract / legitimate interests).

Improve reliability and fix errors using aggregated or pseudonymised technical data where possible (legitimate interests).

We do not sell your personal data. We do not use your data for third-party advertising on this platform.

Contract (Art. 6(1)(b)): processing necessary to deliver services you requested.

Legitimate interests (Art. 6(1)(f)): security, fraud prevention, and proportionate operational improvement — balanced against your rights.

Legal obligation (Art. 6(1)(c)): tax, accounting, and lawful regulatory requests.

Consent (Art. 6(1)(a)): where required — e.g. non-essential cookies if enabled, or where Indian law requires consent for specific processing.

You may withdraw consent at any time where processing is consent-based (see section 8). Withdrawal does not affect lawfulness of processing before withdrawal.

We process digital personal data as a Data Fiduciary when you use our services from India or when Indian law applies.

Notice & consent: we provide this notice before or at collection. Sign-up requires affirmative acceptance of this Policy and our Terms.

Your rights as a Data Principal include: right to access information about your personal data; correction of inaccurate data; erasure when no longer necessary (subject to legal retention); grievance redressal; and nomination of another individual to exercise rights in the event of death or incapacity (contact us to register a nominee).

Grievance redressal: email contact@sagarkapasi.com. We will acknowledge and endeavour to resolve grievances within 90 days.

Complaint to the Data Protection Board of India: if you are not satisfied with our response, you may lodge a complaint with the Board when it is fully operational and where you have a right to do so under applicable law.

Children: our services are not directed at anyone under 18. We do not knowingly collect personal data from children. If you believe a child has provided data, contact us for deletion.

Cross-border transfers: your data may be processed in India and in countries where our subprocessors operate. We implement contractual and technical safeguards appropriate to the transfer.

Access & portability: Dashboard → Settings → Privacy & data → Export (JSON).

Rectification: update your profile in Settings or contact us.

Erasure: request account deletion in Settings (manual operator review — see section 7).

Restriction / objection: contact us to limit certain processing where applicable law provides these rights.

Withdraw consent: where processing is consent-based, use the same channels as at sign-up — email us, decline cookies, or request deletion. Withdrawal must be as easy as giving consent.

Complaint: you may complain to your supervisory authority (e.g. ICO in the UK, EU member-state DPA, or India's Data Protection Board when operational).

You may request deletion from Dashboard → Settings → Privacy & data.

Deletion requests are queued for manual operator review. We do not automatically delete accounts or project data on a fixed schedule.

No suspension or deletion of client resources occurs without explicit manual review.

We retain data where required for tax (typically up to 8 years in India), fraud prevention, dispute resolution, or legal claims.

Security logs: typically up to 12 months unless needed for an investigation.

After verified deletion, personal identifiers are removed or anonymised where retention is no longer required.

Where we rely on consent, you may withdraw it at any time with comparable ease to how you gave it:

Email contact@sagarkapasi.com with subject “Withdraw consent”.

Decline non-essential cookies via the site banner (see Cookie Policy).

Request account deletion in Settings if you no longer wish us to process your data for service delivery.

Withdrawal may mean we cannot continue to provide some or all services. We will explain the consequences before you withdraw where required by law.

We use trusted processors who process data only on our instructions:

Payment processors — for invoice payments where applicable.

Email delivery providers — for transactional email.

Infrastructure providers — for systems that run client services.

We require appropriate contracts and security measures. A detailed subprocessor list is available on request at contact@sagarkapasi.com.

We use HTTPS, hashed passwords, access controls, rate limiting, and audit logging. No method is 100% secure.

If a personal data breach is likely to affect your rights, we will notify you and relevant authorities as required by applicable law (including, where applicable, India's DPDP Act and GDPR's 72-hour notification framework).

We do not make decisions based solely on automated processing that produce legal or similarly significant effects about you.

Version 2026-08-29 is current.

If we make a material change to what personal data we collect, why we use it, who we share it with, or your rights, we will provide at least 30 days' notice on this page and by email (if we have your address) before the change takes effect. You may withdraw consent or request deletion if you do not agree. Non-material updates may be posted without individual notice where permitted by law.

The effective version is always published on this page with the version date shown.

Privacy: contact@sagarkapasi.com

Grievance Officer (India): contact@sagarkapasi.com

We are not a law firm. This Policy is provided for transparency; seek independent legal advice for your specific situation.