Website preview
The current static preview is designed not to collect visitor submissions, run analytics or set tracking cookies. The pilot request control remains disabled until the production intake route is configured. This statement must be rechecked after deployment and before enabling any form, analytics or external service.
Portfolio and website evidence
The internal controlled pilot observes publicly accessible website pages and maintains source URLs, extracted snippets, page types, content hashes and review metadata. Its registry is not published by this static site. Before operating a customer-facing service, the operator must define and disclose the applicable controller/processor roles, purpose, lawful basis where required, recipients, international transfers, retention periods, rights handling and security contact.
Proposed account activity and export audit logs (not active in this preview)
The intended paid service may record limited server-side events such as subscription start or plan change, a portfolio view, export requested/completed/failed, cancellation requested/scheduled, subscription end and refund request/review. For an export, the service may record the pseudonymous account reference, event time, plan, record count and identifiers included, export identifier, a checksum of the exact file generated, and the versions of the applicable notice and terms. These records are intended to evidence what our service generated or made available, investigate billing/support disputes, prevent misuse and protect service security. An export log does not prove that a user later opened, retained, copied, screenshotted or redistributed a file.
The proposed design does not capture screenshots of members’ devices, keystrokes, session-replay videos, device fingerprints or full IP addresses by default. We will disclose account activity logging before account creation or export, restrict staff access, protect audit integrity and use logs only for stated purposes. The current static preview does not activate this planned logging. Before launch, the operator must select and test a durable log store, approve the lawful basis where required, complete any necessary legitimate-interest assessment or other assessment, and publish an accurate retention schedule. The current proposal is a 180-day routine retention window for commercial audit events, subject to jurisdiction-specific review and documented legal holds; it is not yet an approved promise. Security/access logs used for protective safeguards are a separate category: the planned India design is to support at least one year of retention for those logs where the DPDP Rules require it, from the relevant commencement date. The applicable retention schedule will be confirmed with counsel and implemented before production processing begins.
Exports, downloaded copies and sharing
Where the paid service permits export, the export may contain an account/export reference, export time and permitted-use notice as a practical watermark. A separate server-side manifest may record the exported record identifiers and a cryptographic checksum of the generated file. These controls deter and help investigate misuse but cannot reliably prevent screenshots or recall a copy already downloaded. Personal data, if any, must be assessed and minimised before it is included in the service or exports.
India launch considerations (draft; not yet approved)
Before the service accepts accounts or payments in India, the operator will confirm which provisions of the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 apply on the launch date, including the phased commencement timeline. The operator will publish its verified legal identity and privacy contact, explain the specific purposes and categories of personal data processed, describe applicable rights and grievance routes, and implement the required processes before collection begins.
Business websites can contain personal data where information identifies an individual, including an individual's name, direct email or telephone number. Public availability alone is not treated as blanket permission for every use. Before launch, the operator must document source/data categories, processing basis, minimisation, retention, use in reports/exports, recipient access and any applicable outreach limitations. The service has not yet approved its India data map, lawful-processing basis, vendor/transfer review or rights-request process. These are launch blockers, not completed compliance claims.
The Consumer Protection (E-Commerce) framework and amendments that the Government has announced for 1 January 2027 will be assessed against the service's actual operating model and definitions. The required support/grievance contact and any other disclosures will be inserted only after details are verified. The current preview does not accept sign-ups or payments.
Contact and rights requests
A production privacy contact has not yet been configured. Do not submit personal information through this preview. Before launch, identify the legal entity responsible for the service, publish its contact route, and establish a working process to handle access, correction, deletion, objection and other applicable requests.
Security and retention
Internal credentials must remain in server-side GitHub Actions secrets and must never be embedded in the static website. Production retention, backups, deletion from active records and backups, incident response and access control require a documented and tested operating policy.
Effective date and legal review
To be completed after the operating legal entity, service scope, hosting providers and data flows are confirmed. This draft is not legal advice and must be reviewed for the jurisdiction and actual processing arrangements before publication.