Privacy Policy

1. Who operates this website

This website is owned and operated by Sreenath R, an individual, based in Bangalore, Karnataka, India. All references to "we", "us", "our", "I" or "me" mean the operator of this website. Where this website is collectively referred to as the "Service", it includes the portfolio pages, the interactive tools, and the blog published at sreenath.tech.

You can reach me for privacy-related matters at support@sreenath.tech, or at the postal address: Bangalore, Karnataka, India. See the Legal & Regulatory Disclosures page for full operator, grievance and regulatory details.

2. Scope of this policy

This policy covers the personal data (as defined in the DPDP Act, 2023) that is processed digitally through this website, whether it is collected directly by me or received, stored or transmitted through the infrastructure providers described in section 8.

Separate applications. The financial application FinWise AI is a separate product operated by the same individual. It has its own Privacy Policy and Terms available within the application, and it is not governed by this page. Companion GitHub repositories linked from the Projects section are neither owned nor operated by me and have their own policies.

3. Legal framework

This policy is drafted to be consistent with the principal Indian laws and subordinate legislation that apply to a personal website operator:

Instrument	Relevance
Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023, as amended by the Digital Personal Data Protection (Amendment) Act, 2025)	Primary privacy statute. It regulates processing of digital personal data in India, gives data principals rights of access, correction, erasure, grievance redressal and nomination, and requires data fiduciaries to provide a notice, obtain consent and adopt reasonable security safeguards.
Digital Personal Data Protection Rules, 2025 (notified by the Government of India on 13 November 2025)	Operationalises the Act through a phased implementation: Data Protection Board from 2025, the Consent Manager framework from 13 November 2026, and full substantive fiduciary obligations from 13 May 2027. I am adopting the substantive standards early rather than waiting for the final phase.
Information Technology Act, 2000 (as amended), including sections 43A and 72A (and sections 66C/66D penal provisions)	Background framework for compensation for failure to protect data, punishment for disclosure of personal information, and computer-related offences.
IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules")	Imposes consent, purpose-limitation, notice, security-practice and disclosure safeguards for "sensitive personal data or information", which includes passwords, financial information such as bank account or card details, and any detail related to such information.
IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021	Imposes due-diligence and grievance-redressal duties on intermediaries and online services, including acknowledgement of complaints within 24 hours and disposal within 15 days.
Constitution of India, Article 21 (right to privacy, per Justice K.S. Puttaswamy (Retd.) v. Union of India, 2017)	Constitutional grounding for the privacy commitments in this policy.

Nothing in this policy is a warranty of legal compliance or legal advice. If you have a compliance question about your own organisation, please consult an Indian lawyer.

4. Personal data we collect, and why

What I collect depends on how you use the site. The table below sets out each scenario honestly — including what I do not collect.

Scenario	Data processed	Why	Stored where
Contact form (Home → Contact)	Name, email address, subject, message text, timestamp. Your message may contain additional personal data you choose to include.	To receive your message, reply to you, and keep a professional correspondence record. An acknowledgement copy is emailed to you.	Delivered by email to support@sreenath.tech via Zoho Mail (India region) or the configured provider; held in my mail account. Not stored in the website database.
Tool usage analytics (aggregate counters on the Tools page)	Tool identifier, action type (view / use / calculate / export, etc.), approximate timestamp, and a short-lived IP-derived rate-limiting key.	To show honest aggregate popularity statistics ("used N times"), improve tools, and prevent abuse / spam automation. Rate-limit keys are stored in Cloudflare KV with a 30-minute expiry and are never published.	Cloudflare D1 database (aggregate event rows) and Cloudflare KV (ephemeral rate-limit keys). No name, email or browser fingerprint is attached to these events.
AI tax / CTC coaching (CTC Decoder and Tax Regime Optimizer "explain" feature)	Only aggregate, de-identified numerical inputs (salary figures, deduction totals, tax outcomes). Per the publicly-visible source code, no name, employer, email or other PII is ever sent to the AI.	To generate an educational explanation of the calculator output. Responses may be cached by a hash of the numbers for up to one hour.	Processed by Cloudflare Workers AI; numeric payload may briefly touch Cloudflare's edge network. Not stored beyond the short cache.
Client-side financial tools (Tax Regime Optimizer, LTCG Harvester, Freelancer Tax, Rent vs Buy, FIRE planner, EMI & Loan, Accounts Workbench, JD Analyzer, CSV Profiler, and similar)	None. Inputs such as income, PAN-adjacent data, bank account numbers used for invoice templates, or uploaded CSV/JD documents are processed entirely in your browser.	These tools are deliberately "100% client-side privacy" — computations never leave your device, and nothing is uploaded, stored or logged server-side.	Nowhere on my servers. Data stays in your browser/session unless you choose to export it.
Blog / project pages (content you read)	IP address and standard server/edge logs (used by Cloudflare for delivery, security and rate limiting).	To serve the pages, mitigate DDoS/abuse, and diagnose faults. Logs are not used for profiling.	Cloudflare edge/network logs; access is restricted and retained only as long as operationally needed.
Direct email to me	Whatever you choose to send (e.g., for work, projects or feedback).	To respond to your enquiry and, if relevant, proceed with a project engagement.	My mail account (Zoho, India region).

I do not operate advertising networks, third-party ad-servers, customer-lifestyle profiling, or cross-site behavioural tracking. I do not sell, rent or share personal data for any commercial purpose.

5. Sensitive personal data

Under the SPDI Rules, "sensitive personal data or information" includes passwords, financial information such as bank account or credit/debit card details, biometric and health data. The DPDP Act, 2023 does not create a separate "sensitive" category but applies heightened care to children's data under section 9.

• On this website, I do not collect sensitive personal data. The financial tools that let you enter PAN-adjacent inputs, bank details for invoice templates, or salary data do so purely in your browser (see section 4) so that no sensitive financial information is transmitted to or stored by my servers.
• If you send sensitive data inside a contact-form message (you should avoid this), it will sit in my mail account like any correspondence and will only be used to respond to you.

6. Lawful basis for processing

Consistent with the DPDP Act, 2023, personal data is processed on the following grounds:

• Consent — when you submit the contact form or otherwise affirmatively provide personal data, you consent to its use for the purpose described in section 4.
• Performance of a service or lawful purpose — providing the website, tools and replies you request (Section 6 of the DPDP Act).
• Legitimate interests — operating and securing the site, preventing abuse (e.g., rate limiting), and analytics in aggregate, which do not override your fundamental rights.
• Legal obligations — when Indian law, an order of a court or a lawful authority (e.g., under section 69 of the IT Act) requires disclosure or retention.

You may withdraw consent at any time by contacting me (section 15) or ceasing to use the relevant feature, without affecting the lawfulness of processing before withdrawal.

7. Cookies & similar technologies

This site uses a minimal set of cookies and browser mechanisms. There is no advertising or cross-site tracking cookie.

Mechanism	Purpose	Type / duration
Cloudflare (CDN, security)	Load-balanced delivery, security and bot mitigation;	Compliance / security cookies as set by Cloudflare; essential
Google reCAPTCHA (contact form)	Human verification. May set cookies and collect device signals while evaluating whether the submission is a bot. This is a third-party service governed by Google's privacy policy.	Third-party cookies; see Google's Privacy Policy
Google Fonts & CDN resources	Delivering fonts and libraries (Boxicons, jsDelivr, Alpine.js). May log requests in the provider's network.	Resource requests; no persistent first-party advertising cookies set by me
Local preferences	Some tools store your last-used settings (e.g., chosen tax regime) in your browser's local storage so you don't re-enter them.	Local storage on your device; never transmitted to my servers

Because the cookies in use are essential or benign and my site does no ad-tracking, I do not show a consent banner for advertising cookies. You can block or delete cookies in your browser at any time; the site will continue to work, though reCAPTCHA may ask you to re-verify.

8. Third-party services & processors

I use the following providers to run the site. Each acts as a data processor on my instructions, or as an independent controller for its own services, and each is contractually obligated or legally required to protect the data:

Provider	Service	What it may see
Cloudflare, Inc.	CDN, edge compute, D1 database, Workers KV, Pages hosting, bot mitigation	IP addresses, request metadata, aggregate tool-use events, occasional numeric AI payloads (see section 4)
Zoho Corporation Pvt. Ltd. (India region)	Email delivery for the contact form	Your name, email and message content, transmitted to deliver correspondence
Resend (fallback)	Alternative email delivery provider	Same contact-form content when used as fallback
Google LLC	reCAPTCHA and font delivery	Device signals and IP for bot checks; font request metadata
GitHub, Inc.	Source hosting for the open-source tools	Data you deliberately share on public repositories (outside my control)

Where a provider is an independent controller (e.g., Google, GitHub), its own privacy policy applies to that portion of the processing.

9. Cross-border transfers

The DPDP Act, 2023 adopts a "blacklist" approach to cross-border flows: personal data may be transferred to any jurisdiction unless the Central Government has notified a restriction on that jurisdiction (section 16). No restriction has been notified that affects this website.

In practice, the providers above operate global networks (Cloudflare), and email providers used here are based in India or the United States. Where data moves across borders, it does so for the purposes described in section 4, under contractual protections and industry-standard safeguards, and never for the purposes of monetising it.

10. Data retention

• Contact form / email: correspondence is retained for as long as reasonably needed to respond and, where relevant, to evidence a professional relationship; you may ask me to delete it.
• Tool usage analytics: aggregate event counts are retained in D1; raw rate-limit keys expire automatically within 30 minutes. I may prune old aggregate rows periodically.
• AI advice cache: hashed, de-identified numeric payload cache expires automatically within one hour.
• Server/edge logs: retained only as long as operationally necessary for security and troubleshooting.

Retention is always guided by the DPDP principle that personal data must not be retained beyond the purpose it was collected for (section 5 of the DPDP Act).

11. How we protect your data

I apply reasonable security practices and procedures of the kind contemplated by section 8(5) of the DPDP Act and the SPDI Rules, including:

• Encryption in transit — every page and API is served over HTTPS (TLS).
• Minimisation & client-side design — the financial tools are architected so sensitive inputs never leave your browser, which materially reduces what a server compromise could expose.
• Access control & least privilege — database and secret access is limited to the operator; secrets (SMTP/API keys) live in Cloudflare environment variables, not in the repository.
• Abuse controls — rate limiting and reCAPTCHA reduce spam, scraping and denial-of-service.
• Dependency hygiene — static-generation and edge-function dependencies are versioned and kept current.
• Incident management — see section 14 on breach handling.

No system is perfectly secure. You play a part too: use a unique password on any service you connect, avoid sending sensitive documents (PAN, bank statements, etc.) through the contact form, and treat any downloaded outputs (such as generated invoices) as containing confidential data.

12. Your rights as a data principal

As a data principal under the DPDP Act, 2023 (sections 11–15), you have the right to:

1. Access — obtain a summary of the personal data I hold about you and the third parties with whom it has been shared.
2. Correction & erasure — correct inaccurate or incomplete data and request erasure where the purpose of collection is no longer served.
3. Grievance redressal — file a complaint about my processing, which I will acknowledge and address on the timelines in section 15.
4. Nominate — nominate another individual to exercise these rights in the event of death or incapacity.
5. Withdraw consent — withdraw any consent given, subject to legitimate legal grounds to continue processing.

To exercise these rights, email support@sreenath.tech with "Data principal request" in the subject line. I will verify your identity reasonably before acting, and will respond within the statutory timelines (generally within 30 days). If you are dissatisfied, you may escalate to the Data Protection Board of India as it becomes operational, or to the appropriate court.

Please note that, because the site is not an account-based service, my records about you are typically limited to correspondence and aggregate analytics — so an access request will usually yield exactly that.

13. Children's data

This website and its tools are intended for adults (18 and above). The DPDP Act and its Rules require verifiable parental consent to process the data of children (individuals below 18) and prohibit tracking, behaviourally profiling or running targeted advertising directed at children (section 9 of the DPDP Act and Rule 13 of the DPDP Rules, 2025). I do none of those things.

If you believe I have inadvertently received personal data relating to a child, please contact me and I will delete it expeditiously.

14. Data breach handling

In the event of a personal data breach, I will, consistent with the DPDP Rules, 2025: (a) promptly inform the Data Protection Board of India and any affected data principals where the breach is likely to result in a risk to their rights; (b) provide details of the breach and mitigation measures; and (c) take all reasonable steps to contain and remediate the breach. I maintain a contact path (email) on which affected users can reach me quickly.

15. Grievance redressal & contact

If you raise a privacy complaint, provide enough detail for me to verify and act. Trivial, frivolous or abusive complaints may be declined (note that the DPDP Act permits a penalty of up to ₹10,000 against a data principal who registers false or frivolous complaints). If I cannot resolve the matter to your satisfaction, you may approach the Data Protection Board of India or the courts of appropriate jurisdiction in India.

16. Changes to this policy

I will review this policy at least annually and whenever the legal landscape changes (for example, when the remaining phases of the DPDP Rules, 2025 become effective — Consent Managers from 13 November 2026 and full fiduciary obligations from 13 May 2027). Material changes will be announced on this page with an updated effective date. Your continued use of the site after a change constitutes acceptance of the updated policy.