Who we are
Postcode Studio ("we", "us") runs this website and decides how the personal data collected through it is used. Under the Digital Personal Data Protection Act, 2023 (the DPDP Act), that makes us the data fiduciary.
You can reach us about anything in this policy at hello@postcode.studio, or by post at Postcode Studio, Your street address, City, PIN.
What we collect
We collect as little as we can.
- When you write to us. The contact form asks for your name, email address, organisation (optional), a topic and your message. We use these only to read and reply to you.
- When you browse. Like most websites, our server records technical details of each request: your IP address, the page you asked for, the time, and your browser's description of itself. We use these to keep the site running and secure.
- To stop spam. We note the IP address each contact message comes from, so we can limit how many messages one address sends. We delete these notes after about an hour.
- If you have an account. Members who write for our blog sign in with a username and password. We keep the password only in a scrambled (hashed) form we can't read back. We also briefly record failed sign-in attempts, with their IP address, to block password guessing.
We don't run analytics or advertising trackers, and we don't sell or rent personal data.
Cookies
We use one cookie, and only because the site needs it. It protects the contact form from forged submissions and keeps members signed in. It doesn't track you across other websites. Signed-in members are signed out automatically after 24 hours.
Who else handles your data
- Hosting and email providers. Our servers, and the email service that tells us about new messages, process data on our behalf so the site can work.
- Google Fonts. Our pages load typefaces from Google, so your browser sends your IP address to Google when it fetches them. See Google's privacy policy.
We share personal data with anyone else only when the law requires it.
How long we keep it
- Messages. We keep messages for as long as we need them to reply and follow up. We delete a message sooner if you ask.
- Server logs. Kept for a short period, then deleted.
- Spam and sign-in protection. These records are removed after an hour or less.
Your rights
Under the DPDP Act you can:
- ask what personal data we hold about you and how we use it;
- ask us to correct, complete, update or erase it;
- withdraw consent you've given, as easily as you gave it;
- nominate someone to exercise these rights for you if you die or can't act yourself;
- raise a grievance with us.
To use any of these rights, email hello@postcode.studio. We may need to confirm who you are first. If you aren't satisfied with our answer, you can complain to the Data Protection Board of India.
Children
This website isn't aimed at children. If you're under 18, please ask a parent or guardian to contact us for you.
Security
The whole site is served over an encrypted connection, and we limit who can see stored data. No system is perfectly secure, so if we ever have a breach that affects you, we'll tell you and the Data Protection Board as the law requires.
Changes to this policy
If we change this policy, we'll update it here and change the date at the top.