Privacy policy.

01 Who we are

This website, mobilebytesensei.com, is operated by Mobilebytesensei Private Limited ("Mobile Byte Sensei", "we", "us"), a company incorporated in India. For the personal data described in this policy we are the Data Fiduciary under the Digital Personal Data Protection Act 2023, and the controller for the purposes of the GDPR and UK GDPR.

When we build or operate software for a client, the client normally decides why and how personal data in that product is processed, and we act as its Data Processor under a written agreement. That processing is governed by the agreement, not by this policy.

02 Scope

This policy covers personal data collected through this website and through enquiries sent to us from it or to the email addresses published on it.

It does not cover our mobile, web or desktop products. Each of those has its own privacy policy, linked from its store listing or website, which applies when you use that product.

03 Personal data we collect and why

We collect only the data listed below, for the stated purpose. We do not collect sensitive personal data or information (such as financial, health, biometric or password data) through this website, and we ask you not to include it in an enquiry.

04 Legal basis for processing

We do not use your data for marketing unless you have asked to receive it, and we do not sell personal data or share it with third parties for their own marketing.

• Enquiries and correspondence: you provide this data voluntarily for a specified purpose and have not indicated that you object to its use for that purpose, which is a legitimate use under section 7(a) of the DPDP Act. Where the GDPR applies, the basis is steps taken at your request before entering into a contract, and our legitimate interest in responding to business enquiries.
• Technical logs: processing necessary to keep the website secure and available. Where the GDPR applies, the basis is our legitimate interest in the security of our systems.
• Website analytics, session recordings and heatmaps: your consent, given through the choice shown on your first visit (section 6 of the DPDP Act and, where the GDPR applies, Article 6(1)(a)). One choice covers Google Analytics, PostHog and Microsoft Clarity, each named in it. Nothing is collected and no analytics cookie is set until you allow it. You can withdraw consent at any time from Cookie settings at the foot of every page, as easily as you gave it, and all three stop at once.
• Where we rely on consent for any other purpose, we will ask for it clearly and separately, and you may withdraw it at any time by writing to us. Withdrawal does not affect processing carried out before it.

05 Cookies

This website sets no advertising cookies and shows no advertising. It uses the cookies below only for analytics, session recordings and heatmaps, and only after you choose "Allow analytics". If you choose "Decline", or make no choice, none of them is set and no request is made to Google, PostHog or Microsoft.

Your choice itself is remembered in your browser's local storage (not a cookie) so we do not ask again on every page. Clearing your browser data resets it.

To change your choice, use Cookie settings at the foot of any page. If you withdraw consent, all three tools stop immediately and the cookies set on this site below are deleted from your browser. Cookies Microsoft sets on its own domains (CLID, MUID) cannot be deleted by this site; they are no longer refreshed by it, and you can remove them in your browser settings.

Google signals and advertising personalisation are switched off, so analytics data is not combined with your Google account or used for advertising. PostHog creates no personal profile of anonymous visitors, and its own session recording is switched off. Microsoft Clarity is told that advertising storage is denied.

06 Service providers

We share personal data only with service providers who process it on our behalf, under written contracts that require them to use it solely to provide their service to us and to protect it with reasonable security safeguards. The categories are:

• Website hosting and infrastructure: Cloudflare, Inc., which serves the site and holds technical logs
• Database: Supabase, Inc., which stores the project briefs submitted through the contact form
• Transactional email: Resend, Inc. (Plus Five Five, Inc.), which delivers the acknowledgement of your brief and our internal notification of it
• Email and communication services, which deliver and store correspondence
• Website analytics: Google Analytics 4, provided by Google LLC (and Google Ireland Limited for visitors in the EEA and UK), acting as our processor under the Google Ads Data Processing Terms, and only where you have allowed analytics
• Product analytics: PostHog, provided by PostHog, Inc., acting as our processor under its data processing agreement, and only where you have allowed analytics
• Session recordings and heatmaps: Microsoft Clarity, provided by Microsoft Corporation under the Microsoft Clarity terms, and only where you have allowed analytics
• Accounting and invoicing software, which holds billing details of clients

07 Transfers outside India

Some service providers store or process data outside India. We transfer personal data outside India only as permitted under section 16 of the DPDP Act, and not to any country or territory to which the Central Government has restricted transfers.

Where personal data of individuals in the EEA or UK is transferred to a country without an adequacy decision, we rely on standard contractual clauses or another safeguard recognised under the GDPR. You may ask for details of the safeguard that applies by writing to privacy@mobilebytesensei.com.

Analytics data you allow is processed by Google in the United States and other countries where Google operates. Google LLC is certified under the EU-US Data Privacy Framework and its UK Extension, and Google's processing terms incorporate standard contractual clauses.

PostHog processes analytics data in the United States (PostHog Cloud US). PostHog's data processing agreement incorporates standard contractual clauses.

Microsoft Clarity processes recordings and heatmaps in the United States and other countries where Microsoft operates. Microsoft Corporation is certified under the EU-US Data Privacy Framework and its UK Extension.

08 Retention

These are maximum periods. Data is erased sooner when it is no longer needed for its purpose and no law requires us to keep it, or when you validly ask us to erase it.

09 How we protect personal data

We maintain reasonable security practices and procedures appropriate to the data we hold, as required by section 43A of the Information Technology Act 2000 and section 8(5) of the DPDP Act. These include encryption in transit, encryption at rest for stored data, access limited to people who need it, and multi-factor authentication on accounts with access to personal data.

Further detail is set out on our Security page.

10 Personal data breaches

If a personal data breach occurs, we will inform the Data Protection Board of India and each affected individual in the form and within the time required by the DPDP Act and the DPDP Rules, report cyber security incidents to CERT-In where the CERT-In Directions of 28 April 2022 require it, and notify the relevant supervisory authority and individuals where the GDPR requires it.

11 Your rights

Subject to the conditions and exceptions set out in applicable law, you have the right to:

• Obtain a summary of the personal data we hold about you, how it is processed, and the identities of those with whom it has been shared
• Have inaccurate or incomplete data corrected or completed, and have data updated
• Have your personal data erased where it is no longer necessary for its purpose, unless the law requires us to retain it
• Withdraw consent, where processing is based on consent
• Nominate another individual to exercise your rights in the event of your death or incapacity, under section 14 of the DPDP Act
• Where the GDPR applies, also to restrict or object to processing and to receive your data in a portable format
• Have a grievance addressed by us, and then complain to the Data Protection Board of India, or, where the GDPR applies, to your supervisory authority

12 Exercising your rights

Write to privacy@mobilebytesensei.com from the email address associated with your data, stating the right you wish to exercise. We may ask for information to confirm your identity where that is reasonably necessary, and will use it only for that purpose.

We will respond within thirty days of receiving your request. If a request is complex we may extend that period where the law allows, and will tell you why within the first thirty days. No fee is charged.

13 Grievance Officer

In accordance with the Information Technology Act 2000, the rules made under it, and section 13 of the DPDP Act, grievances about the processing of your personal data may be addressed to our Grievance Officer. We will acknowledge a grievance within forty-eight hours and resolve it within thirty days of receipt.

If you are not satisfied with our response, you may file a complaint with the Data Protection Board of India once you have exhausted this grievance process.

14 Children

This website is intended for businesses and adults. We do not knowingly collect personal data of anyone under the age of eighteen, and we do not track, behaviourally monitor or target advertising at children. If you believe a child has provided personal data to us, write to us and we will erase it.

15 Changes to this policy

We may update this policy to reflect changes in the law or in how we process personal data. The date at the top of this page shows when it was last updated. If a change is material, we will state that at the top of the page, and where the change requires your consent we will ask for it before applying it to data we already hold.

16 Governing law

This policy is governed by the laws of India. Subject to any non-waivable right you have to approach the Data Protection Board of India, a supervisory authority or a court in your place of residence, disputes relating to it are subject to the exclusive jurisdiction of the courts at Delhi, India.