Last updated: 23 September 2026
Privacy Policy
The full text of this Privacy Policy prevails over this summary.
- We are Untitled Build Private Limited, an Indian software studio. This policy covers our website, our client services, and our products.
- We collect what you give us directly (contact form, job applications), a small amount automatically (analytics, log data), and nothing from data brokers.
- We use Google Analytics, Google Tag Manager, Usercentrics (our cookie consent tool), Brevo (live chat), and Supabase (our database). We do not sell your personal data.
- When we build software for a client, we usually process data on that client’s instructions, not our own. That relationship is governed by a separate Data Processing Agreement, not this policy.
- We do not use your personal data to train AI models without your explicit written consent, and we do not make decisions about you using automated processing alone.
- If you are in India, the EEA/UK, or the US, you have rights over your data, including access, correction, and deletion. Contact details and how to exercise them are below.
Table of contents
- Introduction and scope
- Who we are and how to contact us
- Personal data we collect
- Purposes and lawful bases
- Cookies and tracking technologies
- AI and automated processing
- Sharing and disclosure
- International data transfers
- Data retention
- Security measures
- Your rights
- Children’s data
- Data breach notification
- Client project data
- Changes to this policy
- Contact and grievance redressal
1. Introduction and scope
This Privacy Policy explains how Untitled Build Private Limited, operating as untitled build (“we”, “us”, “our”), collects, uses, discloses, and protects personal data when you:
- visit or use our website at untitledbuild.com (the “Site”);
- apply for a role with us through our careers page;
- engage us as a client for design, engineering, AI, cloud, or security services (our “Services”); or
- use any current or future software product we build and operate (our “Products”) — to be updated as products launch.
This policy does not govern personal data that we process on a client’s behalf, as their processor, inside a client engagement. See Section 14.
By using the Site, applying for a role, or using a Product, you acknowledge this policy. Where consent is the legal basis for processing (for example, non-essential cookies or AI training), we will ask for it separately and you may withdraw it at any time.
2. Who we are and how to contact us
| Legal entity | Untitled Build Private Limited |
| Corporate Identification Number (CIN) | U62011AS2026PTC030913 |
| Registered / principal business address | India, Asia |
| Website | https://untitledbuild.com |
| General contact | hello@untitledbuild.com |
| Privacy contact | hello@untitledbuild.com |
We are the Data Fiduciary (under India’s Digital Personal Data Protection Act, 2023) and the data controller (under GDPR/UK GDPR) for the personal data described in this policy, except where Section 14 applies.
Grievance Officer
Under the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023, grievances relating to this policy may be directed to our Grievance Officer at hello@untitledbuild.com.
3. Personal data we collect
We collect the following categories, grouped by source.
3.1 Data you give us directly
| Where | Data collected |
|---|---|
| ”Collaborate” contact form | Name (optional), email address (required), project type (required, selected from a list), and any message you write. A hidden honeypot field is used to detect automated bot submissions and is not intended to collect data from you. |
| Careers “Apply” form | Name, email address, the position you are applying for, and your résumé/CV file (PDF or DOCX, up to 10 MB). |
| Client engagements | Business contact details, and any personal data you or your organisation provide in the course of a Service, as agreed in the applicable Statement of Work. |
| Correspondence | Anything you send us by email, chat, or otherwise, including via our live chat widget (Brevo Conversations). |
3.2 Data we collect automatically
| Data | Source |
|---|---|
| Usage data (pages viewed, referrer, approximate location, device and browser type, time on page) | Google Analytics 4 (via Google Tag Manager) |
| Cookie and consent preferences | Usercentrics (our consent management platform) |
| Server/hosting logs (IP address, request timestamps, user agent) | GitHub Pages, our static hosting provider |
| Technical metadata attached to form submissions (user agent) | Captured automatically by our database (Supabase) when you submit the contact or careers form |
3.3 Data from third parties
| Source | What we may receive |
|---|---|
| Referrals | If someone refers you to us for a role or a project, we may receive your name and contact details from them. |
| Public professional profiles | If you apply for a role, we may look at publicly available professional information you have shared (for example, on LinkedIn), where relevant to assessing your application. |
4. Purposes and lawful bases
| Purpose | Data used | Lawful basis (GDPR/UK GDPR) | Basis under DPDP Act, 2023 |
|---|---|---|---|
| Responding to enquiries submitted via the contact form | Name, email, project type, message | Consent / legitimate interest in responding to enquiries | Consent |
| Evaluating job applications | Name, email, position, résumé | Consent / steps prior to entering a contract | Consent |
| Delivering and administering our Services | Client and engagement data | Performance of a contract | Consent / performance of a contract |
| Operating and improving the Site (analytics) | Usage data via GA4 | Consent (cookie-based) | Consent |
| Providing live chat support | Chat messages, contact details you share in chat | Consent / legitimate interest | Consent |
| Security, fraud, and abuse prevention (e.g. the honeypot field) | Form metadata, server logs | Legitimate interest | Legitimate use permitted under the Act for security purposes |
| Complying with legal obligations (tax, employment law, regulatory requests) | Relevant records | Legal obligation | Compliance with law |
Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal. See Section 11 for how.
5. Cookies and tracking technologies
We use the following categories of cookies and similar technologies on the Site. You can manage your preferences at any time through the Usercentrics consent banner that appears when you first visit the Site, or by clearing your browser’s cookies.
The Analytics category (Google Analytics 4 and Google Tag Manager) is not loaded at all until you grant consent through that banner - not merely hidden or paused, but not requested from Google’s servers in the first place.
| Category | Purpose | Tools |
|---|---|---|
| Strictly necessary | Remembering your cookie consent choices | Usercentrics |
| Analytics | Understanding how visitors use the Site, in aggregate | Google Analytics 4, Google Tag Manager |
| Functional | Powering the live chat widget | Brevo Conversations |
Google Analytics 4 typically sets cookies such as _ga and _ga_<container-ID>, generally retained for up to 13-24 months, to distinguish visitors. Because Usercentrics can add or reconfigure cookies over time, the current, definitive list is always available inside the consent banner itself (open it and select “Details” / “Show purposes”) rather than reproduced here, where it would go stale.
How to opt out:
- Adjust your preferences at any time via the Usercentrics banner (available on every page of the Site).
- Use Google’s Analytics opt-out browser add-on to opt out of Google Analytics specifically.
- Configure your browser to block or delete cookies; note that some Site functionality (like the contact form’s spam protection) may not work correctly if you do.
6. AI and automated processing
We do not use personal data submitted through this Site, or personal data belonging to our Product users, to train or fine-tune AI/ML models, unless we have your explicit, informed, written consent to do so.
Where our Services or Products use AI systems (for example, models provided by third-party AI vendors), we or our client may use such systems to process data as part of delivering a feature or engagement, subject to the applicable client agreement. As of this policy’s drafting, no third-party AI vendor processes personal data collected through this Site in its own right. Where a specific engagement or Product does route personal data through an AI vendor, that vendor will be named in the applicable SOW or in product-specific terms.
No solely automated decisions with legal or similarly significant effects. We do not use your personal data to make decisions about you (such as hiring decisions) based solely on automated processing, without meaningful human involvement. A human reviews every job application and every contact form enquiry we act on.
7. Sharing and disclosure
We do not sell your personal data. We share personal data only with:
| Category | Examples | Why |
|---|---|---|
| Infrastructure and hosting sub-processors | Supabase (database and file storage), GitHub Pages (static hosting) | To run the Site and store form submissions |
| Analytics and consent sub-processors | Google (Analytics, Tag Manager), Usercentrics | To understand Site usage and manage cookie consent |
| Communications sub-processors | Brevo (live chat widget only) | To provide live chat support |
| Professional advisors | Lawyers, accountants, auditors | As needed for legitimate business purposes, under confidentiality obligations |
| Legal and regulatory authorities | Courts, regulators, law enforcement | Where required by applicable law, or to protect our rights |
| Business transferees | A successor entity in a merger, acquisition, or asset sale | Personal data may be transferred as part of that transaction, subject to this policy or a materially similar one |
Every sub-processor listed above is contractually or operationally restricted to using personal data only for the purpose we’ve engaged them for.
8. International data transfers
We are based in India. Some of our sub-processors (for example, Google and Usercentrics) may process data outside India, including in the European Economic Area, the United Kingdom, or the United States.
- From the EEA/UK: where we or our sub-processors transfer personal data outside the EEA/UK, we rely on appropriate safeguards, such as the European Commission’s Standard Contractual Clauses (SCCs) or the UK’s International Data Transfer Addendum, as implemented by the relevant sub-processor.
- To/from India: the DPDP Act, 2023 permits transfer of personal data outside India except to countries restricted by the Central Government. We will comply with any such restrictions as they are notified.
- Our infrastructure providers, including our database and file-storage provider (Supabase), may process and store data outside India. Where they do, we require safeguards consistent with the DPDP Act, 2023 and, where applicable, the GDPR/UK GDPR’s international-transfer requirements.
9. Data retention
We keep personal data only as long as needed for the purpose it was collected, or as required by law.
| Category | Retention period |
|---|---|
| Contact form enquiries | 36 months from your last contact with us, or until you ask us to delete it sooner |
| Job applications (including résumés) | 24 months from the date of application, so we can consider you for future roles without asking you to re-apply |
| Client engagement records | For the term of the engagement, and thereafter as required by the Companies Act, 2013 (generally 8 years for financial records) and applicable Indian tax law |
| Product account data | For the life of your account, plus 30 days after closure |
| Server and access logs | 90 days |
| Cookie/consent records (Usercentrics) | Typically 12 months, per Usercentrics’ default configuration |
Where we can, we will anonymise or securely delete personal data once it is no longer needed rather than retain it indefinitely.
10. Security measures
We take reasonable, industry-appropriate technical and organisational measures to protect personal data, including:
- encryption of data in transit (HTTPS/TLS across the Site and our hosting);
- access controls restricting who inside our team can access personal data, including Row-Level Security policies on our database that limit what our public website can do to insert-only, so form submissions cannot be read back through the Site itself;
- storing uploaded résumés in a private file storage bucket that is not publicly accessible;
- confidentiality obligations on everyone with access to personal data as part of their role.
No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. We will notify affected individuals and, where legally required, regulators, in the event of a data breach likely to result in harm, as described in Section 13.
11. Your rights
Your rights depend on where you are located.
If you are in India (DPDP Act, 2023)
As a Data Principal, you have the right to:
- obtain a summary of the personal data we hold about you and the processing activities;
- request correction, completion, or updating of your personal data;
- request erasure of your personal data, once it is no longer needed for the purpose it was collected;
- nominate another individual to exercise these rights on your behalf in the event of your death or incapacity;
- withdraw consent at any time, as easily as you gave it;
- file a complaint with us in the first instance, and escalate to the Data Protection Board of India if unsatisfied with our response.
If you are in the EEA or UK (GDPR/UK GDPR)
You have the right to access, rectify, erase, restrict, or object to processing of your personal data, the right to data portability, and the right to withdraw consent. You also have the right to lodge a complaint with your local supervisory authority.
If you are in California or another US state (CCPA/CPRA and similar state laws)
You have the right to know what personal data we collect, the right to request deletion, the right to correct inaccurate personal data, and the right to opt out of the “sale” or “sharing” of personal data. We do not sell personal data, and we do not knowingly “share” it for cross-context behavioural advertising as defined under the CPRA. If this changes, we will add a “Do Not Sell or Share My Personal Information” mechanism to this Site before doing so.
How to exercise these rights
Contact us at hello@untitledbuild.com or write to our Grievance Officer (Section 2). We aim to respond within 30 days. We may need to verify your identity before acting on a request, and, where permitted by applicable law, may charge a reasonable fee for, or decline, requests that are manifestly unfounded, excessive, or repetitive.
12. Children’s data
Our Site, Services, and Products are not directed at children. The minimum age to use our Products is 18. Where the DPDP Act, 2023 requires verifiable parental or guardian consent for processing a child’s personal data, we will obtain it before processing. If we learn we have collected personal data from a child without appropriate consent (including under the US Children’s Online Privacy Protection Act, COPPA, for US users), we will delete it.
13. Data breach notification
If we become aware of a personal data breach that is likely to cause harm to affected individuals, we will:
- take immediate steps to contain and assess the breach;
- notify the Data Protection Board of India and affected Data Principals as required under the DPDP Act, 2023;
- notify the relevant EU/UK supervisory authority within 72 hours of becoming aware, where the GDPR/UK GDPR applies and the breach is likely to result in a risk to individuals’ rights and freedoms, and notify affected individuals where the risk is high;
- notify affected US residents as required by applicable state breach notification laws.
14. Client project data
When we deliver Services to a client, we frequently process personal data (for example, the client’s own customer or employee data) strictly on that client’s documented instructions, for the purpose of building, testing, or operating the software we’ve been engaged to build.
In that relationship:
- the client is the data controller / Data Fiduciary, and we act as their data processor / Significant Data Fiduciary’s processor, as applicable;
- this Privacy Policy does not govern that processing;
- the terms of that processing (including sub-processors we may use, security commitments, and data deletion on termination) are set out in a separate Data Processing Agreement (DPA), incorporated into the applicable MSA/SOW with that client.
If you believe your personal data has been processed by us on behalf of one of our clients and you wish to exercise a data-subject right, please contact that client directly, or contact us and we will direct your request appropriately.
15. Changes to this policy
We may update this Privacy Policy from time to time, for example to reflect a new tool we start using, a new Product, or a change in law. We will update the “Last updated” date at the top of this page when we do. Where a change is material, we will provide additional notice (for example, a banner on the Site, or an email to affected individuals), where required by law.
16. Contact and grievance redressal
If you have a question, concern, or complaint about how we handle personal data:
- Contact us first, at
hello@untitledbuild.comor through our Grievance Officer. We aim to acknowledge grievances within a reasonable period and resolve them within the timeline prescribed under applicable law. - If you’re in India and unsatisfied with our response, you may escalate your complaint to the Data Protection Board of India, established under the Digital Personal Data Protection Act, 2023.
- If you’re in the EEA/UK, you may lodge a complaint with your local data protection supervisory authority.
- If you’re in the US, you may contact your state Attorney General’s office regarding rights under applicable state privacy law.