Privacy policy

Who is responsible

DOiNhub is the trade name of Pavan Gupta, a proprietary concern registered with the Ministry of Micro, Small and Medium Enterprises, Government of India, as a Micro enterprise: Udyam Registration No. UDYAM-UP-75-0108585, major activity Services, in business since 1 April 2023.

Registered office: SA 7/48 DD, Bela Road, Benipur, Sarnath, Varanasi, Uttar Pradesh 221007, India. Email hello@doinhub.com. Phone +91 84236 61117.

For the purposes of the Digital Personal Data Protection Act, 2023 and, where it applies to you, the EU and UK GDPR, the data fiduciary and controller is Pavan Gupta, trading as DOiNhub.

What this policy covers

It covers this website, our correspondence with you, and the personal data we handle while delivering client projects. Where we build or operate a system that processes your customers' data, we act on your written instructions as a processor for that data, and the contract and NDA for that project govern the details.

What we collect

What you choose to send us: your name, email address, phone number if you share it, the content of your messages, and the materials, credentials and data access a project requires. The enquiry form on this site collects exactly three things, your name, your email address and what you are trying to build. It emails them to us and stores them in our own database on our own server, together with how you reached the site, so we can tell which of our own links and campaigns actually reach people. That record is never sold, never shared with an advertising network, and never used to build a profile of you.

What arrives with a payment: the payer name, amount, currency and payment status that our payment processor passes back to us. Card, UPI and banking credentials go to the processor directly and we never receive or store them.

What the server records: standard access logs with IP addresses, timestamps and browser types, kept for security monitoring and rotated automatically. When the enquiry form is used, the sending address is held in memory for one hour purely to limit automated abuse, and is never written to disk or attached to your message.

What a campaign link records: some of our links carry a short name so we can count how many people a particular post, partner or advertisement actually sent us. Following one records the name on the link, the country your network reports, the site you came from, and the time. Your IP address is not stored. It is converted into a one-way fingerprint using a secret that changes every day, which lets us count one person once within a day and becomes permanently unreadable the moment the day turns over.

What this site does in your browser

This site sets no cookies at all, and carries no advertising tracker, no social media pixel and no third-party marketing script. Nothing here follows you to any other website.

It stores two things on your device. Your light-or-dark theme choice, which stays on your device and is sent nowhere. And, if you arrived through one of our campaign links or from another website, a note of where you came from, so that if you then write to us we can tell which link brought you. That note is kept in what browsers call session storage: it belongs to that one browser tab and it is erased the moment you close it.

We measure how the site is used with analytics software that we run ourselves on our own server. It sets no cookies, does not fingerprint your device, and cannot follow you across other sites. The measurements it produces stay on our server and are never sent to any analytics company, because there is no analytics company involved.

If we ever add an advertising pixel, this section changes and a consent request appears before anything is loaded. We will not do it quietly.

Why we process it

To reply to you and negotiate a proposal, to deliver and invoice the project you engaged us for, to collect payment and keep the accounts the law requires, to secure our systems, to understand which of our own links and pages actually bring people here, and to establish or defend legal claims if it ever comes to that.

Under the DPDP Act we rely on your consent and on legitimate uses connected to a purpose you approached us for; under the GDPR, on performance of a contract, legitimate interests and legal obligation. We do not use your data for advertising, profiling or automated decisions about you, and we never sell it.

Who it is shared with

Only the providers that make the work possible, each limited to its role: Razorpay for payment processing, our email provider for the mailbox, our hosting providers for this site and project infrastructure, and GitHub where a project's repository lives. Beyond that, only professional advisers under confidentiality, and authorities where the law requires disclosure.

Where it is processed

We work from India with clients worldwide, so data may be processed outside your country, including on the infrastructure named above and on systems you direct us to use. Wherever it moves, it stays under this policy, the project's contract and NDA, and the safeguards the applicable law requires.

How long we keep it

Correspondence and proposals: for the relationship and up to three years after it ends, in case work resumes. Invoices and payment records: for the periods Indian tax and accounting law require, currently up to eight years. Project materials and credentials: per the project's contract, and deleted or returned on request at handover. Server logs: rotated on a short automatic cycle.

How it is protected

Reasonable security practices under the Information Technology Act, 2000 and the DPDP Act: client work in private repositories with least-access permissions, credentials in a manager rather than in files, sensitive material exchanged under NDA, servers hardened and reachable only over encrypted connections, and this site served over HTTPS.

If a personal data breach ever affects you, we will notify you and the authorities the law names, without undue delay and with what we know and are doing about it.

Your rights

Under the DPDP Act: access to a summary of your personal data and how it has been used, correction and completion, erasure where the law allows, grievance redressal, and the right to nominate a person to exercise these rights for you. Under the GDPR you additionally hold rights to restriction, portability and objection.

Exercise any of them by writing to hello@doinhub.com. Identity is verified before data is released, the request is answered within thirty days, and there is no charge.

Grievance officer

Grievance Officer: Pavan Gupta, DOiNhub, SA 7/48 DD, Bela Road, Benipur, Sarnath, Varanasi, Uttar Pradesh 221007, India. Email hello@doinhub.com, phone +91 84236 61117.

Grievances are acknowledged within forty-eight hours and resolved within thirty days. If you remain unsatisfied under the DPDP Act, you may escalate to the Data Protection Board of India.

Children, and changes

This site and our services are for businesses and are not directed at children; we do not knowingly collect children's data, and we delete it if we learn we hold any.

When this policy changes, the new version is published here with a new effective date, and material changes are flagged to active clients directly.