Privacy Policy

1. Data Controller Identity

The data controller responsible for personal and commercial information collected through this website and initial discovery engagements is:

2. Categories of Information We Collect

We collect only the minimum information necessary to evaluate project feasibility, prepare architectural estimates, and deliver contracted engineering services:

• Direct Communications & Scoping Forms: Full name, corporate email address, telephone/WhatsApp number, company name, project brief, feature specifications, and target timelines submitted via our discovery forms or booking tools.
• Scheduling Data: Meeting availability, selected time slots, and meeting notes submitted when scheduling a scoping call.
• Technical & Telemetry Data: IP address, browser type, operating system, referring URLs, and page navigation metrics collected via standard web server logs to monitor site availability and defend against DDoS attacks.

3. Purpose and Legal Basis for Processing

We process data under lawful bases recognized across India, the UK (GDPR), the EU, and the United States:

• Pre-contractual Steps & Scoping: Processing your contact information and requirements to deliver an Architecture & Sprint Plan or scoping estimate.
• Contractual Performance: Fulfilling contracted sprint obligations under an agreed Statement of Work.
• Legitimate Business Interests: Maintaining platform security, monitoring error rates, and preventing fraudulent requests.
• Zero Commercial Sale of Data: We never sell, rent, monetize, or disclose your corporate or personal information to third-party advertisers or data brokers under any circumstances.

4. Data Retention & Storage Locations

Contact form inquiries that do not proceed to an active engagement are purged automatically after 12 months. Client project data, communications, and contractual records are retained for the duration of the engagement plus statutory commercial and tax limitation periods (typically 5 to 7 years).

Data is stored in enterprise cloud facilities featuring hardware encryption at rest (AES-256) and mandatory TLS 1.3 encryption in transit.

5. Authorized Sub-Processors & Infrastructure

We use trusted third-party service providers who maintain strict confidentiality and data protection standards:

6. Your Data Rights

Regardless of your geographical location, we respect your fundamental data rights:

• Right to Access: You may request a copy of all personal data held concerning you.
• Right to Rectification: You may request corrections to inaccurate or outdated contact information.
• Right to Erasure ("Right to be Forgotten"): You may request complete deletion of your personal data from our contact databases, subject only to ongoing statutory compliance obligations.
• Right to Object: You may opt out of receiving follow-up project scoping correspondence at any time.

To exercise any of these rights, email your request to privacy@sprintstack.digital. We respond to all verified inquiries within 3 business days.

7. Cookies & Tracking Technologies

SprintStack.digital utilizes strictly necessary technical cookies to maintain site performance, theme preferences (light/dark mode), and CSRF security tokens. We do not deploy third-party advertising cookies, cross-site retargeting pixels (such as Meta Pixel), or invasive user profiling trackers.