Privacy Policy

acharyya.dev is run by Suman Acharyya, an independent software developer (sole proprietor) based in Barasat, Kolkata, West Bengal, India. For personal data collected here, I am the data fiduciary (under India's DPDP Act) and the data controller (under the GDPR).

Privacy contact and grievance officer: Suman Acharyya, hello@acharyya.dev.

Please don't send sensitive personal data — such as health, financial account or government ID details — unless a project truly needs it and we have agreed how it will be handled.

• To reply and consult — answering enquiries and running free consultations. Basis: your consent, and steps taken at your request before a contract.

• To deliver projects — scoping, building, testing, deploying and supporting your software. Basis: our contract.

• To invoice and keep records — billing, tax and accounting. Basis: legal obligation.

• To keep the site secure — preventing abuse and fixing errors. Basis: legitimate interests.

I don't use your data for automated decisions about you, and I don't send marketing emails unless you ask to receive them.

I never sell or rent personal data. I share it only with service providers that help me run this site and my business, each handling it under their own privacy terms:

• Vercel — website hosting.

• Cloudflare — domain, DNS, security and email routing.

• Google — email inbox (Gmail).

• Payment platforms — such as your bank, a payment processor or a marketplace like Fiverr, when you pay an invoice.

I may also disclose data where Indian law or a valid legal request requires it.

When you give me access to your code, systems or users' data, I act on your instructions and use it only to deliver the agreed work.

• Access is kept to the minimum needed, and credentials are stored in a password manager, never in plain text or chat.

• Where possible I work with test or anonymised data rather than real user data.

• I don't paste your confidential code or data into third-party AI tools without your permission.

• At the end of a project I return or delete your material and credentials, and ask you to revoke my access.

• If your users' personal data is involved, we can sign a data processing agreement on request.

• Enquiries that don't become projects: up to [12] months, then deleted.

• Project material and credentials: returned or deleted when the project ends, unless you ask me to keep it for ongoing support.

• Invoices and contracts: for as long as Indian tax and accounting law requires.

• Hosting and security logs: as set by the hosting provider, usually a short period.

I protect data with encrypted connections (HTTPS), two-factor authentication on my accounts, a password manager for credentials, and encrypted devices. No system is perfectly secure; if a breach ever affects your personal data, I will tell you and the relevant authority as the law requires.

Everyone can ask me to access, correct, update or delete their personal data, or withdraw consent they have given. Withdrawing consent doesn't affect anything already done.

Under India's DPDP Act, you can also have a grievance addressed, and nominate someone to act for you in case of death or incapacity. If you're not satisfied with my response, you can complain to the Data Protection Board of India.

In the EU and UK, you can also restrict or object to processing, ask for a portable copy of your data, and complain to your local data protection authority.

Email hello@acharyya.dev to use any of these rights. I will reply within 30 days and may ask you to confirm your identity first.

I am based in India, and the service providers above may store data in other countries, including the United States. When data moves across borders, I rely on these providers' standard safeguards, such as contractual protections, to keep it protected.

This site does not use advertising or tracking cookies. It stores two small things in your browser: your light or dark theme, so the site remembers it on your next visit, and — for the current tab only — whether the intro animation has already played. Neither leaves your device, and you can clear them in your browser settings.

Fonts are served from this site itself, so loading a page doesn't send your IP address to a font provider. If I add analytics in future, I will update this policy first.

This site and my services are meant for businesses and adults. I don't knowingly collect personal data from anyone under 18. If you think a child has sent me their data, email me and I will delete it.

I may update this policy as my services or the law change. The date at the top shows the latest version, and I'll highlight important changes on the site.

Questions or requests: hello@acharyya.dev · Suman Acharyya, Barasat, Kolkata, West Bengal, India. See also the Terms of Service.