Code 'n' Kraft ("we", "us", "our") is a web design, development and search-visibility studio — covering SEO, GEO (Generative Engine Optimization) and AEO (Answer Engine Optimization) — operating in India.

• Website: codenkraft.com
• Instagram: @codenkraft
• Email: [email protected]

For the purposes of the Digital Personal Data Protection Act, 2023 ("DPDP Act"), we act as the Data Fiduciary for personal data collected through our website and communication channels — meaning we decide the purpose and means of processing your data.

a) Information you share with us. When you contact us — through our website enquiry form, by email, through Instagram direct messages (including our free visibility-audit intake), or any other channel — you may share your name, email address, phone number, business name, website URL, and details about your business or project. We collect only what you choose to share.

b) Information collected automatically. Like most websites, our hosting infrastructure may log technical information such as your IP address, browser type, device information, and pages visited, purely for security, diagnostics and operational purposes.

c) What we do not collect. Our website has no sign-ups, checkouts or payment flows, so we do not collect account credentials or payment information through this site.

We process your personal data only for the following purposes:

• To respond to your enquiries and communicate with you;
• To prepare and deliver free visibility audits you request;
• To prepare quotations and deliver our services (web design, development, SEO, GEO, AEO, rebrand, UI/UX);
• To improve our website and services; and
• To comply with our legal obligations.

We do not use your data for any purpose incompatible with the above, and we process it only after giving you clear notice and obtaining your consent where the DPDP Act requires it.

Where we rely on your consent under Section 6 of the DPDP Act, it is free, specific, informed, unconditional and unambiguous — given through a clear affirmative action, such as sending us an email, messaging us on Instagram, or submitting your details for an audit.

You may withdraw your consent at any time by writing to [email protected]. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal. If you share another person's details with us, please make sure you have their permission to do so.

We do not sell your personal data. We share it only in these limited situations:

• Service providers who help us operate — for example, Formspree (which processes our website enquiry-form submissions), Instagram/Meta (for direct messages) and our email hosting provider. They process data only on our instructions and are expected to protect it.
• Legal requirements — if we are required to disclose data by law or in response to a lawful request from a government authority.

We keep your personal data only for as long as reasonably needed for the purposes described above, or as required by applicable law. When data is no longer needed, we delete it or anonymise it so it can no longer identify you. You may also ask us to delete your data sooner (see "Your rights" below).

Under the DPDP Act, 2023, you — as a Data Principal — have the following rights, and we are committed to honouring them:

• Right to access information (Section 11) — to obtain a summary of the personal data we hold about you and how it is being processed;
• Right to correction, completion, updating and erasure (Section 12) — to have inaccurate or incomplete data corrected and to request deletion;
• Right of grievance redressal (Section 13) — to have your complaints about our data practices addressed (see below); and
• Right to nominate (Section 14) — to nominate another person to exercise your rights in the event of your death or incapacity.

To exercise any of these rights, email us at [email protected] with the subject line "Data Request". We will verify your identity before acting, to protect your data from unauthorised access.

If you have any complaint about how we handle your personal data, write to us at [email protected] with the subject line "Privacy Grievance". We aim to acknowledge your complaint promptly and resolve it within 30 days.

If you remain unsatisfied, you may escalate the matter to the Data Protection Board of India under the DPDP Act, 2023.

Our services are business services and are not directed at children. Under the DPDP Act, a "child" is an individual below 18 years of age, and processing a child's data requires verifiable parental or guardian consent. We do not knowingly collect personal data of children. If you believe a child has shared personal data with us, please contact us and we will delete it promptly.

We implement reasonable security safeguards to protect your personal data against loss, misuse, unauthorised access or disclosure, as required of a Data Fiduciary under Section 8 of the DPDP Act. No method of transmission or storage is completely secure, so we cannot guarantee absolute security — but we take the protection of your data seriously, and we will notify you and the Data Protection Board of India in the event of a personal data breach, as the law requires.

Some of our service providers (for example, Meta for Instagram messages, and email hosting providers) may process or store data on servers located outside India. Any such transfer is made only in accordance with the DPDP Act, 2023.

Our website uses only strictly necessary cookies required for security and basic functionality. We do not use analytics, advertising or cross-site tracking cookies. Read our Cookie Policy for details.

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The updated version will be posted on this page with a revised "Last updated" date. We encourage you to review it periodically.

For any questions about this Privacy Policy or our data practices, reach us at:

• Email: [email protected]
• Instagram: @codenkraft