Privacy Policy

1. Who is responsible for your data

Adeshpreet Singh, independent full-stack developer is the data controller (GDPR) and Data Fiduciary (DPDP Act 2023) for personal data collected through this site and through the client CRM.

Contact: hello@adeshpreet.com

These terms are governed by the laws of India. Disputes are first addressed by good-faith negotiation for 30 days, then by the courts with jurisdiction over Punjab, India.

2. What is collected, and why

• Enquiries. Name, email, optional phone, project type, budget range, timeline, your description of the problem, and any URL you submit. Used to answer you and prepare an estimate. This is transactional: it is not marketing consent.
• Booking. If you book a call, Cal.com collects the details you enter on its form.
• Server logs. IP address and request metadata, retained by the host for security and abuse prevention.

Two things this site does not do: it does not use advertising cookies, ad pixels, or third-party cross-site trackers, and it does not sell data.

3. The CRM database, and public lead listings

Enquiries are stored in a private CRM. Alongside them, that database contains a collection of publicly posted project briefs gathered from freelance marketplaces and job boards: the kind of listing a business owner posts when looking for a contractor. Those rows hold a username, a public post URL, and the text of the post.

These are public business listings, not private individuals, and they are used only to assess whether a project is in scope. They are never added to any mailing list: the ingestion route for them is technically incapable of recording marketing consent, which is why it exists separately from the enquiry route. No message is sent to them automatically. If you published a listing and want it removed, email the address above and it will be deleted.

4. Who else receives your data

Each processor below handles data under its own policy and is bound by contract to use it only for the stated purpose.

5. International transfers

Every processor above is outside the UK and EEA. Data is therefore transferred to the United States and, where the law requires a safeguard, it is covered by the EU–US Data Privacy Framework where a processor participates, or by the European Commission's Standard Contractual Clauses where it does not. For a sole trader operating under India's DPDP Act 2023, cross-border transfer to the named processors is permitted; no further localisation is imposed.

Honest caveat: the certification status of each named sub-processor is asserted by that processor and is not independently verified here. If you need contractual assurances for a procurement process, ask and you will get the specific processor named rather than a general statement.

6. How long data is kept

• Enquiries. Kept while the enquiry is live or the engagement is active. After that: 24 months, then deleted.
• Client records. Retained for the duration of the engagement plus 7 years, because tax and business records have a statutory retention requirement.
• Lead listings. Rolled off as they go cold; 12 months maximum.
• Server logs. 30 days.

7. Your rights

Under the GDPR and India's DPDP Act 2023 you may:

• Access: ask what data is held about you and get a copy.
• Correct: have inaccurate data fixed.
• Delete: have your data erased, subject to the 7-year records retention above.
• Withdraw consent : where processing rests on consent, withdraw it at any time, with no effect on processing already done.
• Object or complain : object to processing based on legitimate interest, or complain to your supervisory authority. In India that is the Data Protection Board; in the EU/UK it is your local supervisory authority.
• Nomination (DPDP only): ask for a nominated person to exercise these rights on your behalf if you are incapacitated.

Email hello@adeshpreet.com with the subject line Privacy request. A response is sent within 30 days, usually sooner. Identity may need verifying before data is released.

8. If something goes wrong

A confirmed personal-data breach is notified to affected users and to the relevant supervisory authority within 72 hours of becoming aware of it, where the risk to individuals is high. Lower-risk breaches are recorded and reviewed rather than published.

9. Cookies and local storage

No advertising cookies and no cross-site tracking, so there is no consent banner to click. What is stored on your own device:

• localStorage: your theme preference.
• localStorage: the URL you typed into the site grader, kept so a reload does not lose it.

The site grader fetches your URL

When you run the site grader, the URL you submit is fetched once from this site’s server so its HTML can be read for the checks above. That means this site’s IP address can appear in your own server logs, and I see that a request was made. The response is analysed in memory and discarded: the page content is not stored, no result is retained after the response is sent, and nothing is written to a database. Requests are rate-limited, restricted to ports 80 and 443, and blocked from reaching private network addresses.

If you would rather not have your server see that request, you can run the same checks yourself against a local copy of the page.

A first-party counter records which pages get used, but it is stored server-side in aggregate. Nothing about you is written to a third party.

10. Changes to this policy

If this policy changes materially: a new processor, a new purpose, a longer retention period: the "Last updated" date above changes and the new version is live on this page. There is no separate changelog because there has not yet been a material change.