Privacy Policy

1. Information We Collect

We collect personal information necessary to deliver software development services, verify client accounts, communicate on project requirements, and process billing:

• Identity and Contact Data: Client username, normalized email address, and international mobile phone number in standard E.164 format.
• Profile Picture (Avatar / DP): Clients can upload a custom profile picture, sync their verified Google profile picture automatically, or use a generated initials avatar.
• Two-Factor Authentication Credentials: Cryptographic Time-Based One-Time Password (TOTP) keys compatible with Google Authenticator, Authy, and 1Password, plus single-use emergency backup recovery tokens.
• Order and Technical Specifications: Project briefs, architectural scopes, wireframes, and deployment credentials provided voluntarily for software delivery.
• Payment Logs: Transaction identifiers and payment status. We do not store raw debit or credit card numbers or banking PINs. All payments are processed through PCI-DSS compliant gateways.

2. Account Identification and Unified Logins

Clients may sign in using their verified email address, chosen client username, or verified mobile phone number with a 6-digit one-time password (OTP). When a client links both an email address and a mobile number to their profile, both identifiers resolve to the same user account. This prevents fragmented identity records and ensures unified access to project orders and deliverables.

3. Data Security and Cryptographic Protections

AnuragTecz enforces enterprise security practices to safeguard personal data and administrative infrastructure:

• Encrypted Transport: All data in transit is protected using modern TLS encryption with strict HTTP Strict Transport Security (HSTS) headers.
• Cryptographic 2FA Storage: TOTP secret keys are stored securely in our database. Emergency backup recovery tokens are single-use and permanently purged from the database once redeemed.
• Rate Limiting and Brute-Force Defense: Login attempts, OTP dispatches, contact forms, and security endpoints are shielded by automated sliding-window rate limiters.
• OTP Expiration: Mobile sign-in codes expire automatically within five minutes of issuance and are invalidated after five incorrect attempts.
• Content Security Policy: Stringent Content Security Policy (CSP) headers prevent cross-site scripting and unauthorized resource execution.

4. How Your Information is Used

Your data is strictly utilized for executing client software projects, generating invoices, sending milestone updates, and providing technical support. We never sell, rent, or trade your personal information to advertisers or marketing brokers.

5. Self-Service Account Deletion and Right to Erasure

Under Section 12 of the Digital Personal Data Protection (DPDP) Act 2023 and Article 17 of the GDPR, clients possess the fundamental right to data erasure.

You can delete your account at any time through our self-service deletion portal located at /accounts/delete/. To prevent accidental data loss, the system requires you to type your exact username and account password before processing. Upon confirmation, your account and all associated profile records, order histories, and authentication tokens are immediately and permanently erased from the live database.

6. Data Fiduciary and Statutory Contact