Legal
Privacy Policy
How we collect, use and protect your information, in plain English.
Last updated: 14 November 2026
The short version
- We only collect what you send us (like your name, email and project details) plus basic technical data needed to run the site safely.
- We use it to reply to you, prepare a proposal and deliver any project you start with us.
- We never sell your data, and we never use it to train AI models.
- The site sets no advertising or tracking cookies.
- You can ask us to see, correct or delete your data at any time: hello@upaaylabs.com.
1. Who we are
Upaay Labs ("Upaay Labs", "we", "us") builds software, websites and AI agents for businesses. We are based in Gurugram, Haryana, India.
For personal data collected through upaaylabs.com, we are the data fiduciary under India's Digital Personal Data Protection Act, 2023 (the "DPDP Act"). That means we decide why and how that data is used, and we are responsible for protecting it.
Contact: hello@upaaylabs.com · +91 75658 73395
2. What this policy covers
This policy covers personal data we collect when you:
- visit upaaylabs.com or read our free guides;
- send us a message through the contact form, or request an AI audit;
- book a call with us;
- subscribe to new guides;
- talk to us by email, phone or WhatsApp; or
- work with us as a client.
It does not cover personal data inside the systems we build or run for clients (for example, the customers who chat with a client's WhatsApp agent). For that data, our client is the data fiduciary and we act on their instructions. See section 12.
3. Information we collect
3.1 Information you give us
- Contact and audit forms: your full name, work email, company name (optional), the service you are interested in, and the project details you write.
- Newsletter: your email address and a record that you agreed to receive new guides.
- Booking a call: your name, email, the time you choose and any answers you give in the booking form. This is collected by our booking provider, Calendly, on our behalf.
- Email, phone and WhatsApp: whatever you choose to share in those conversations.
- Clients: business contact details, billing and GST details, and the information you share with us during a project.
Please don't send us sensitive personal data (such as health, financial account or government ID details) through the contact form. If a project needs such data, we will agree a secure way to handle it first.
3.2 Information collected automatically
- Context of your enquiry: the page you sent the form from, any campaign tags in the link you followed (for example
utm_source=instagram), and the website that referred you (the domain only). - A one-way, salted hash of your IP address, stored with your enquiry so we can limit spam and abuse. We cannot turn the hash back into your IP address.
- How long the form was open before you sent it, used only to filter out automated spam.
- Technical data that our hosting provider, Cloudflare, processes to deliver the site securely, such as your IP address, browser type and the pages requested.
- Visit statistics: if we turn on Cloudflare Web Analytics, it records aggregated, cookie-free visit counts. It does not build a profile of you or follow you across other websites.
We do not collect payment card details through this website.
4. How we use it, and why
Under the DPDP Act, we use personal data either with your consent or for a legitimate use the law allows, such as when you voluntarily give us your details for a specific purpose, or when the law requires us to keep records.
| What we do | Data used | Why we're allowed to |
|---|---|---|
| Reply to your enquiry, discuss your project and send a proposal | Form details, emails, WhatsApp messages | You gave them to us for this purpose |
| Run a call you booked | Booking details | Your consent when you book |
| Deliver a project, invoice you and keep business records | Client and billing details | Our agreement with you, and tax and accounting laws |
| Send you new free guides | Email address | Your consent (withdraw any time) |
| Keep the site secure and stop spam | Hashed IP, form timing, technical data | Needed to provide the service safely |
| Understand which pages and campaigns bring enquiries | Campaign tags, referring site, aggregated visit counts | Sent along with your enquiry; visit counts are not personal |
We do not:
- sell, rent or trade your personal data;
- use your enquiry, project or personal data to train AI models;
- send you marketing you didn't ask for; or
- make automated decisions about you that have legal or similarly significant effects.
6. Where your data is stored
Our service providers run global infrastructure, so your data may be stored or processed outside India (for example in the United States or Europe). The DPDP Act allows this, except to countries the Government of India specifically restricts. We will follow any such restriction.
7. How long we keep it
- Enquiries that don't become a project: up to 12 months after our last conversation, then deleted.
- Client information: for the length of the project and afterwards for as long as Indian tax and accounting laws require us to keep records.
- Newsletter: until you unsubscribe.
- Spam-prevention data (the hashed IP and form timing): kept with the enquiry and deleted with it.
- Technical logs at Cloudflare: for Cloudflare's standard short retention period.
When we no longer need data, we delete it or make it anonymous.
9. How we protect it
- The whole site runs over encrypted HTTPS.
- Access to enquiries and project data is limited to the people who need it, using accounts protected with strong passwords and two-step verification where available.
- IP addresses are stored only as salted, one-way hashes.
- Forms are protected against spam and abuse with rate limits.
- We work with established providers that maintain strong security practices.
No system is perfectly secure. If a personal data breach happens, we will inform you and the Data Protection Board of India as the DPDP Act requires, and take steps to limit the harm.
10. Your rights
Under the DPDP Act you have the right to:
- Access: get a summary of the personal data we hold about you, what we do with it, and who we have shared it with.
- Correction and erasure: ask us to correct, complete, update or delete your data. We will delete it unless the law requires us to keep it.
- Withdraw consent at any time, as easily as you gave it. This does not affect anything we did before you withdrew it.
- Nominate someone to use these rights for you if you die or become unable to act.
- Grievance redressal: complain to us first. If you are not satisfied with our response, you can complain to the Data Protection Board of India.
How to use your rights: email hello@upaaylabs.com with the subject "Privacy request". We may ask you to confirm your identity first. We aim to respond within 30 days.
To stop receiving new guides, reply to any guide email or write to us, and we will remove you.
11. Children
Our website and services are for businesses and adults. They are not intended for anyone under 18, and we do not knowingly collect children's personal data. If you believe a child has sent us personal data, contact us and we will delete it.
12. Data we handle for clients
When we build or run a system for a client, such as a WhatsApp AI agent, a CRM or a patient portal, that system may handle personal data of the client's own customers, patients or staff. For that data:
- the client is the data fiduciary, and we act as their data processor;
- we process it only to deliver the agreed service and on the client's documented instructions;
- we keep it confidential and secure, and help the client respond to people who use their rights;
- we do not use it for our own purposes or to train AI models; and
- at the end of the engagement we return or delete it, as the client chooses.
The details are set out in our agreement with each client. If your data is in a system we run for one of our clients, please contact that business first.
13. Other websites
Our site links to other services, such as our guides on GitHub Pages, Instagram, WhatsApp, LinkedIn and Calendly. Their own privacy policies apply when you use them.
14. Changes to this policy
We will update this page when our practices change and change the "Last updated" date at the top. If a change significantly affects how we use data you have already given us, we will tell you directly where we can.
15. Contact and grievances
For any question, request or complaint about privacy:
- Email: hello@upaaylabs.com
- Phone / WhatsApp: +91 75658 73395
- Upaay Labs, Gurugram, Haryana, India