# Privacy Policy

> What we collect through this website and our correspondence, why we collect it, who sees it, how long we keep it, and the choices you have. We collect little, and we say exactly what.

Last updated October 26, 2026.

## Overview

This policy explains how CodeScapes (“we”, “us”, “our”) handles personal information when you visit this website, send us a message, or correspond with us about our services or careers.

- We collect only what we need to reply to you and to run and protect this website.
- We do not sell personal information, and we do not use it for third-party advertising.
- Client project data is a different matter: it is governed by the agreement we sign with each client, not by this policy.

## Who is responsible

CodeScapes is the data controller (in India, the “data fiduciary”) for personal information collected through this website. For anything in this policy, write to hello@codescapes.io. Questions are answered by a person, normally within one business day.

## Information we collect

Information you give us:

- Contact form: your name, work email, company (optional), the topics you select and the message you write.
- Email and calls: whatever you share when you write to us or book a call, including your contact details and role.
- Careers: any introduction, CV or links you send us.

Information collected automatically when you visit:

- Technical data: IP address, browser and device type, operating system, language and the pages and referring page of each request. Our hosting provider records this in standard server logs.
- Usage data: which pages are viewed and how visits flow through the site, collected in aggregate by privacy-focused analytics (see “Cookies and analytics”).
- Approximate location derived from your IP address, used only to understand where traffic comes from and to detect abuse.

> Please do not send passwords, access keys, health or financial account details, or other sensitive information through the contact form or by email. We will tell you how to share anything sensitive securely once an agreement is in place.

## How we use it, and why

| Purpose | Information used | Basis |
| --- | --- | --- |
| Replying to enquiries and scheduling calls | Contact details, message | Legitimate interests; steps before a contract |
| Preparing and performing a client engagement | Contact details, role, company | Contract |
| Running, securing and fixing this website | Technical data, logs | Legitimate interests |
| Understanding aggregate site usage | Usage data | Legitimate interests or consent, where required |
| Considering a careers introduction | What you send us | Legitimate interests; your consent |
| Meeting legal obligations and defending claims | Any of the above | Legal obligation; legitimate interests |

We do not make decisions about you using automated profiling.

## Legal bases and consent

Where the GDPR or UK GDPR applies, we rely on the bases in the table above: legitimate interests (running and securing our business, with your interests weighed against ours), contract, legal obligation and, where we ask for it, consent.

Where India’s Digital Personal Data Protection Act, 2023 (DPDP Act) applies, we process your personal data on the basis of your consent, which you give when you submit the contact form or write to us, or for the legitimate uses the Act permits, such as responding to a request you have made. You can withdraw consent at any time by emailing us; withdrawing does not affect processing that has already happened.

## Cookies and analytics

We keep cookies to a minimum. You can block or delete cookies in your browser at any time; the site will keep working.

| Category | What it does | Your choice |
| --- | --- | --- |
| Strictly necessary | Keeps the site secure and working, including the captcha on the contact form, which may set technical cookies or local storage on that page | Always on |
| Analytics | Aggregate, privacy-focused statistics on pages viewed and visit flow. No advertising and no cross-site tracking | You can block it in your browser or with a content blocker |

We do not use advertising or retargeting cookies.

## Service providers

We use a small number of providers to run this website and our business. Each handles personal information only on our instructions and under terms that limit its use.

| Provider | What for | Information involved |
| --- | --- | --- |
| Vercel | Hosting and delivering the website | Technical data, server logs |
| Amazon Web Services (Amazon SES) | Sending contact-form messages to our inbox | Contact form content |
| Cloudflare (Turnstile) | Blocking spam and bots on the contact form | Technical and browser signals |
| Analytics provider | Aggregate usage statistics | Usage and technical data |
| Email and calendar tools | Corresponding with you and booking calls | Contact details, messages |

Contact-form messages are validated on our server and delivered to us by email. We do not keep a separate database of form submissions.

## Sharing and disclosure

Beyond the providers above, we share personal information only:

- When the law requires it, or to respond to a valid legal request. Where we can, we will tell you first.
- To protect our rights, our systems or other people from fraud, abuse or harm.
- In a merger, acquisition or sale of assets, where the information would pass to the new owner under the same commitments as this policy.
- With your agreement, for example when you ask us to introduce you to someone.

We do not sell or rent personal information.

## International transfers

CodeScapes operates from India, and our providers run infrastructure in several countries. Your information may therefore be processed outside the country where you live, including outside India and the European Economic Area.

Where required, we rely on appropriate safeguards such as the European Commission’s standard contractual clauses or the UK addendum, and we choose providers that commit to protecting personal information to a comparable standard. Transfers of personal data outside India are made in line with the DPDP Act and any restrictions notified under it.

## How long we keep it

| Information | Kept for |
| --- | --- |
| Enquiries that do not lead to a client engagement | Up to 24 months after the last contact |
| Client contact details and correspondence | For the engagement, then for the period in the contract or the law requires |
| Careers introductions | Up to 12 months, then deleted unless you ask us to keep it |
| Server logs | A short rolling period set by our hosting provider, then deleted |
| Analytics | Aggregated and anonymised; no individual-level retention |

We delete or anonymise information when its purpose has been met, unless the law requires us to keep it longer.

## Security

We protect personal information with encryption in transit, access limited to the people who need it, and least-privilege practices, and we choose providers that do the same. We describe our approach in more detail on our Data security page.

No system is perfectly secure, and email in particular is not encrypted end to end. If a breach affects your personal information, we will tell you and the relevant authority as the law requires.

## Your rights

Depending on where you live, you may have the right to:

- Know what personal information we hold about you and get a copy of it.
- Have inaccurate information corrected or incomplete information completed.
- Have your information erased when it is no longer needed or you withdraw consent.
- Object to, or ask us to restrict, certain processing.
- Receive your information in a portable format.
- Withdraw consent at any time.
- Nominate another person to exercise your rights if you cannot, as the DPDP Act allows.
- Not be discriminated against for exercising these rights. We do not sell or share personal information for cross-context advertising.

## How to use your rights

Email hello@codescapes.io with what you would like us to do. We may ask you to confirm your identity first. We respond within 30 days, and sooner where the law requires.

If you are not satisfied with our answer, you can complain to us first, and then to your data protection authority — in the EU or UK, your local supervisory authority; in India, the Data Protection Board of India once its complaint process is available.

## Children

Our services are for businesses and are not directed at children. We do not knowingly collect personal information from anyone under 18. If you believe a child has sent us information, write to us and we will delete it.

## Third-party links

This site may link to other websites, including our open-source projects and social profiles. We do not control them and are not responsible for their privacy practices. Please read their policies.

## Changes to this policy

We may update this policy as our practices or the law change. The date above shows the latest revision. For material changes, we will say so prominently on this page before they take effect.

## Contact

CodeScapes · hello@codescapes.io. For privacy requests and complaints, put “Privacy” in the subject line so it reaches the right person.