Privacy Policy

This policy explains what personal data Shivansh Chawla, a sole proprietor established in India, trading as Endorphyn^™ Web by Endorphyn ("we", "us", "our"), collects through this website and in the course of providing services, why we collect it, how long we keep it, and what you can require us to do with it.

It is written to meet India's Digital Personal Data Protection Act 2023 (DPDP Act), the EU General Data Protection Regulation (2016/679), the UK GDPR and Data Protection Act 2018, and the California Consumer Privacy Act as amended by the CPRA. We serve clients in India, the United States, the United Kingdom, Australia and Canada.

For DPDP Act purposes we are the Data Fiduciary. For GDPR purposes we are the Controller. For CCPA purposes we are the Business.

1. Data you give us directly

Through the enquiry flow on the home page, the contact page, the consultation form, the audit form, and the smaller budget request form, you may give us:

• Your name
• Your email address
• Your phone or WhatsApp number, including the country dialling code, and your preferred time to be called
• Your preferred contact channel (email, WhatsApp, or phone)
• Your business name and current website address
• The country you are in, and your state, province, county, city or region, as you select and type them
• The type of project you want and the budget range you select
• Whatever you write in a message, brief, or description of your situation
• Any file, copy, image, logo, or credential you send us during a project
• Whether you ticked the optional box asking for occasional marketing email

Only the fields marked required are required. The budget range is a broad band you pick from a list, not a figure we ask you to disclose.

2. Data collected automatically

This site is served from Cloudflare's edge network. Handling a request necessarily involves the following:

• Your IP address, processed by Cloudflare to route and serve the request and to defend the site. We use it in two further ways: it is sent to Cloudflare as part of verifying a Turnstile anti-spam token, and it is used to count form submissions for rate limiting.
• A short-lived rate-limit counter keyed to your IP address, held in Cloudflare's cache and automatically discarded after 10 minutes. It records a count and a timestamp, nothing else.
• Your country code, derived by Cloudflare from your connection and returned to your browser by our /api/geo endpoint. It is used once, to decide whether prices default to USD, GBP, or INR. We do not store it on our side.
• Your approximate location, when you submit a form. At the moment you send us an enquiry, Cloudflare works out a rough location from your IP address at its edge network, and we add four things to the enquiry email: country, region or state, city, and timezone. It is city-level at best, it is often wrong on a VPN or a mobile network, and it is a guess, not a fact. We use it for three things: to know which market and timezone an enquiry has come from before we reply, to quote in the right currency, and to sanity-check obvious spam. We do not receive, store, or email the IP address itself, and we do not use this to identify you or to build a profile. Where a field cannot be worked out, the email says "Unknown". Because it sits inside the enquiry email, it is kept for as long as that email is, which is set out in section 7. This is separate from the country and region you type into the form yourself: the two can legitimately differ, and neither one overwrites the other.
• Standard request metadata (browser user agent, requested URL, timestamp) processed by Cloudflare as part of serving and securing the site.

We do not build a profile from any of this, and we do not track you across other websites.

3. Browser storage

We set no cookies of our own. We store two values in your browser's localStorage: ew_currency (the currency you picked) and ew_country_auto (the country code from the step above, cached so we do not ask again). Both stay on your device, are never transmitted to us, and are cleared when you clear your browser storage. Our Cookie Policy covers this in full, including the cookies Cloudflare sets to keep the site secure.

4. Who we share data with

We do not sell your personal data and we do not share it for cross-context behavioural advertising. These are the only third parties involved:

These are all the recipients. Nothing on this list is a website tracker: none of them is loaded to observe your browsing. We may also disclose data where a law that applies to us requires it, or to establish or defend a legal claim.

No analytics or advertising tool is in use on this website: no Google Analytics, no Google Tag Manager, no Meta Pixel, no Microsoft Clarity, and no equivalent. Note that Google Analytics, Meta Pixel, and Microsoft Clarity appear in our Growth and Premium package descriptions because we can set them up on your website as part of a build. That is a service we perform for you on your own property, under your own accounts; it is unrelated to what runs here. If we ever add such a tool to this site, this policy and the Cookie Policy will be updated before it goes live, and visitors in the EU, the UK, and the EEA will be asked for consent first.

5. Why we process your data, and on what legal basis

Where we rely on legitimate interests, we have considered your rights and interests and concluded that the processing is limited to what is necessary. Where we rely on consent, you may withdraw it at any time without affecting processing carried out before you withdrew.

6. The free quote call from our smaller budget page

Our smaller budget page offers a free call with a quote, and promises no follow-up calls. That promise is a limit on how we process your data, and we state it here so the two documents say the same thing.

Where you request that call, we use the contact details you provide only to arrange the call, hold it, and send you the written quote that follows. Specifically:

• We do not make follow-up sales calls. After the quote is sent, we do not call you again unless you contact us first or expressly ask us to.
• We do not add you to a marketing list on the basis of this request. Marketing email requires a separate, express opt-in.
• We do not pass your details to anyone beyond the recipients in section 4, all of which are needed to deliver the form and the quote.
• You can ask us to delete the enquiry at any time and we will do so, subject only to any tax record we are legally required to keep.

7. How long we keep it

At the end of a retention period, data is deleted or irreversibly anonymised.

8. International transfers

We operate from India, and the recipients in section 4 include organisations in the United States. Your data may therefore be transferred outside your own country.

For transfers from the EEA and the UK, we rely on the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, as incorporated into the terms of the providers listed in section 4, together with the additional technical measures those providers apply. You may request a summary of the safeguards in place at the address in section 16.

9. Your rights

9.1 If the EU or UK GDPR applies to you

You have the right to: be informed; access your data; have inaccurate data corrected; have data erased; restrict processing; data portability; object to processing based on legitimate interests; and withdraw consent at any time. You are not subject to any automated decision-making or profiling by us, because we do none.

We respond within one month. Where a request is complex we may extend by two further months and will tell you why inside the first month. You may complain to your supervisory authority: in the UK, the Information Commissioner's Office; in the EU, the authority in the member state where you live or work.

9.2 If the DPDP Act applies to you (India)

As a Data Principal you have the right to: access a summary of your personal data and the processing we carry out; correction, completion, updating, and erasure; grievance redressal through the officer named in section 11; and to nominate another person to exercise your rights in the event of your death or incapacity. You may withdraw consent at any time, as easily as it was given.

You also have a duty under the Act not to make a false or frivolous grievance and not to impersonate another person when giving data. We respond to DPDP requests within 30 days.

9.3 If the CCPA applies to you (California)

You have the right to: know what personal information we collect, use, and disclose; access it in a portable form; correct inaccurate information; delete it; and opt out of sale or sharing. We do not sell personal information and we do not share it for cross-context behavioural advertising, so there is nothing to opt out of, and we do not process sensitive personal information for inferring characteristics. You will not be discriminated against for exercising any of these rights.

We collect the categories "identifiers" and "commercial information" as those terms are used in the CCPA, for the business purposes in section 5. We respond within 45 days, extendable once by a further 45 days with notice. An authorised agent may act for you on proof of authorisation.

9.4 Making a request

Email shivansh@endorphynweb.com with the subject line "Privacy request". Tell us which right you are exercising and enough detail for us to find your data. We may ask you to confirm your identity, and we will only ask for what is necessary to do so. There is no charge unless a request is manifestly unfounded or excessive.

10. Security

Every page is served over HTTPS with HSTS. The site sets a Content Security Policy and related security headers. All forms are protected by Cloudflare Turnstile, server-side verification, rate limiting, a honeypot field, and length limits on every field. Secrets are held as environment variables on the server side and never appear in code delivered to your browser. Access to our inbox and invoicing accounts is restricted to the operator.

No method of transmission or storage is completely secure. If a breach occurs that is likely to affect your rights, we will notify you and the relevant authority within the timeframes the applicable law sets, including the Indian Computer Emergency Response Team and the Data Protection Board where the DPDP Act requires it.

11. Grievance Officer

Under the DPDP Act and the Information Technology Rules, the Grievance Officer for Endorphyn^™ Web is:

Shivansh Chawla, Grievance Officer · shivansh@endorphynweb.com · India

Grievances are acknowledged within 3 business days and resolved within 30 days. If you are not satisfied with the outcome, you may escalate to the Data Protection Board of India, or to the supervisory authority for your jurisdiction.

12. Children

This site is directed at businesses and is not intended for anyone under 18. We do not knowingly collect data from a child. The DPDP Act requires verifiable parental consent before processing a child's data, and we do not process children's data at all. If you believe a child has given us data, contact us and we will delete it promptly.

13. Marketing email

We send marketing email only where you expressly opted in. Every such email carries an unsubscribe link, and you can email shivansh@endorphynweb.com to be removed at any time. Requesting a quote, booking a call, or submitting an enquiry does not opt you in. We never sell or rent your email address.

14. Payment and bank detail safety

We never ask for payment using bank details published on a public web page. Payment instructions are sent privately by email or through Zoho Invoice. If you receive a payment request claiming to be from us that you did not initiate, do not pay it, and contact us at shivansh@endorphynweb.com.

15. Changes to this policy

Material changes are flagged by the updated date at the top of this page, and active clients are notified by email. Any addition of an analytics or advertising tool will be reflected here and in the Cookie Policy before that tool is deployed.

16. Contact

Privacy and grievances: shivansh@endorphynweb.com · General enquiries: get@endorphynweb.com · Shivansh Chawla, trading as Endorphyn^™ Web by Endorphyn, India.