Privacy Policy — Kainodos

The short version

We collect what you choose to send us (mostly through the contact form) and basic technical logs.
We use it to reply, to discuss and deliver work you ask for, and to keep the site secure.
We don't sell or rent personal data, show ads, or use analytics or advertising cookies.
You can ask to see, correct or delete your data at any time by writing to info@kainodos.com.

Who we are

Kainodos (“Kainodos”, “we”, “us”) is a software engineering and technology consultancy based in India, led by Abhishek Singh. We decide how and why the personal data described here is used, which makes us its Data Fiduciary under India's Digital Personal Data Protection Act, 2023 (DPDP Act) and its controller under the EU and UK GDPR.

This policy covers kainodos.com and the enquiries and conversations that start here. It is published as required by the Information Technology Act, 2000 and the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (SPDI Rules), and is written to meet the DPDP Act and Digital Personal Data Protection Rules, 2025, the EU and UK GDPR, and the California Consumer Privacy Act as amended by the CPRA.

Contact: info@kainodos.com
Legal entity: Kainodos, India

What we collect

What you give us

Contact form: your name, work email, company (optional), project type, budget range, timeline (optional) and the project details you write.
Email and calls: whatever you choose to share when you write to us or speak with us, including the contact details in your email signature.
If we work together: billing and contract details, and information needed to deliver the project, under a separate agreement.

What is collected automatically

When you visit, our hosting and security provider processes technical data needed to deliver the page and protect it: IP address, browser and device type, the page requested, the referring page and the time. We don't run analytics or tracking tools, and we don't build profiles of visitors.

What we don't want

Please don't send passwords, financial account details, health information or other sensitive personal data through the form. If a project needs access to such data, we agree how to handle it in writing first.

Why we use it, and on what basis

Purpose	Data	Legal basis
Replying to your enquiry, and preparing a scope or proposal you asked for	Contact form, email	India: data you gave voluntarily for this purpose (DPDP Act s.7(a)), and your consent. EU/UK: steps you asked for before a contract (Art. 6(1)(b)) and our legitimate interest in answering enquiries (Art. 6(1)(f)).
Delivering and invoicing work under a contract	Contact, billing and project data	Performing our contract with you (Art. 6(1)(b)); your consent under the DPDP Act.
Keeping the site secure and stopping spam and abuse	Technical logs	Our legitimate interest in security (Art. 6(1)(f)); the security safeguards the DPDP Act and SPDI Rules require.
Meeting legal, tax and accounting obligations	Billing and contract records	Legal obligation (Art. 6(1)(c)); compliance with law (DPDP Act s.7).

We use your data only for these purposes. We don't send marketing emails unless you ask for them, we don't sell or rent personal data, and we make no decisions about you by automated means alone.

When you submit the form or write to us, you agree to our using what you sent to respond, as this policy describes. You can withdraw that consent at any time, as easily as you gave it: email info@kainodos.com and we will stop using your data and delete it, unless the law requires us to keep it. Withdrawing doesn't affect anything done lawfully before you withdrew.

We share personal data only with service providers who process it for us, under contracts that limit its use to the services they provide, and with authorities where the law requires it:

Cloudflare, Inc.: hosts the website, delivers it through its global network and protects it from attacks.
Form delivery and messaging: the service that passes your form submission to our inbox or workspace.
Email and document storage: the provider that runs our email and stores project correspondence.
Professional advisers: accountants and lawyers, where needed, under a duty of confidentiality.

You can ask us for the names of the providers that hold your data. Links to Upwork, LinkedIn and other sites go to services with their own privacy policies.

International transfers

We are based in India, and some of our providers process data in other countries, including the United States and the EU. Under the DPDP Act, personal data may be transferred abroad except to countries the Government of India restricts; we don't use providers in restricted countries.

If you are in the EU or UK, sending us an enquiry transfers your data to India, which doesn't have an adequacy decision. We protect transfers to providers with the European Commission's Standard Contractual Clauses (and the UK Addendum) or an equivalent safeguard. Where none applies, the transfer is necessary to answer the request you made (GDPR Art. 49(1)(b)).

How long we keep it

Enquiries that don't lead to a project: deleted within 2 years of our last contact.
Client contracts, invoices and related correspondence: kept for up to 8 years after the engagement ends, as Indian tax and company law require.
Technical logs: kept by our hosting provider for its standard, limited period.

We delete data sooner if you ask and the law doesn't require us to keep it. When a purpose has been served, we erase the data and ask our providers to do the same.

How we protect it

We protect personal data with reasonable security practices proportionate to the risk, as the SPDI Rules and the DPDP Act require: encrypted connections (HTTPS/TLS) across the site, two-factor authentication and least-privilege access to the accounts that hold enquiries, reputable providers with their own security certifications, and deleting data we no longer need.

No system is perfectly secure. If a breach affects your personal data, we will tell you and notify the Data Protection Board of India, CERT-In, or the relevant EU/UK authority within the time the law requires.

Your rights

Wherever you are, you can ask us to:

Access a summary of the personal data we hold about you, how we use it, and who we have shared it with.
Correct, complete or update it.
Erase it, unless we must keep it by law.
Withdraw consent to any use that relies on it.
Nominate someone to exercise these rights for you in the event of your death or incapacity (DPDP Act s.14).
Have a grievance resolved by our Grievance Officer, below.

In the EU and UK you can also ask us to restrict or stop processing, object to processing based on legitimate interests, and receive your data in a portable format. You can complain to your local data protection authority (in the UK, the Information Commissioner's Office).

To use any of these rights, email info@kainodos.com. We may ask you to confirm your identity. We reply within 30 days and don't charge for reasonable requests.

California residents

If you live in California, the CCPA as amended by the CPRA gives you the right to know what personal information we collect, use and disclose, and to delete or correct it. In the last 12 months we collected the categories described above: identifiers (name, email), professional information (company, project details) and internet activity on this site (technical logs), for the purposes described above.

We do not sell or share personal information for cross-context behavioural advertising, and we don't use sensitive personal information. We won't treat you differently for exercising your rights. You can make a request yourself, or through an authorized agent, by emailing info@kainodos.com.

Children

Our services are for businesses, and this site isn't meant for anyone under 18. We don't knowingly collect children's personal data. Processing it under the DPDP Act would need verifiable consent from a parent or guardian, so if we learn we have, we delete it.

Cookies

We don't use analytics, advertising or tracking cookies, and we don't set cookies of our own. Our hosting provider, Cloudflare, may set a strictly necessary security cookie (__cf_bm, which expires after 30 minutes) to tell people from automated bots. It doesn't identify you and isn't used for tracking, so it doesn't need your consent.

If we ever add analytics or other non-essential cookies, we will update this policy first and, where the law requires it, ask for your consent before setting them.

Grievance Officer and complaints

Questions, requests and complaints about personal data go to our Grievance Officer, who is also the person to contact about how we process personal data under the DPDP Act:

Grievance Officer: Abhishek Singh
Email: info@kainodos.com

We acknowledge grievances within 72 hours and resolve them within 30 days. If you are in India and aren't satisfied with our response, you can complain to the Data Protection Board of India once our process is complete. In the EU or UK, you can complain to your data protection authority at any time.

Changes to this policy

We will update this policy when our practices or the law change. The effective date at the top always shows the current version. If a change materially affects data we already hold about you, we will tell you by email before it takes effect.

Effective 25 October 2026.