Privacy Policy
Last Updated: October 15, 2026 · Effective Date: October 15, 2026
1. Introduction & Data Fiduciary Identity
This Privacy Policy describes how SANKH LABS PRIVATE LIMITED (“Sankh Labs”, “we”, “us”, or “our”), acting as a Data Fiduciary, processes digital personal data collected through our website (https://www.sankhlabs.com), customer inquiries, business engagements, and proprietary software platforms including SankhCard.
Our data processing practices adhere to the provisions of India's Digital Personal Data Protection (DPDP) Act, 2023 and associated digital data regulations.
2. Personal Data We Collect
We limit the collection of digital personal data to what is strictly necessary for legitimate business communication, software engineering delivery, and platform operations:
- Inquiry & Consultation Information: Full name, business email address, phone or WhatsApp number, company name, project requirements, and budget preferences submitted voluntarily via our contact forms.
- Client Account & Platform Data (SankhCard): User credentials (email address, securely hashed password), professional profile information (designation, company, social and contact links) that cardholders deliberately choose to share.
- Career & Employment Data: Résumés, portfolio links, employment history, and contact details submitted by applicants for open positions.
- Technical & Telemetry Data: IP addresses, browser types, device identifiers, and anonymous performance metrics gathered through essential cookies to ensure site stability and security.
3. Lawful Grounds & Specific Purposes of Processing
Under Sections 4, 5, and 7 of the DPDP Act, 2023, personal data is processed solely for specific, lawful purposes:
- To evaluate project scopes, respond to consultations, and prepare engineering proposals.
- To deliver contracted custom software, SaaS products, website development, and automation services.
- To provide user authentication, account management, and customer support on platforms like SankhCard.
- To prevent cybersecurity incidents, mitigate unauthorized access, and protect system integrity.
- To comply with statutory legal, taxation, and regulatory mandates in India.
4. Notice and Consent Mechanism
When you submit personal details through our forms or portals, you receive clear notice of the purpose of data collection. Consent is freely given, informed, specific, and unambiguous.
You possess the statutory right to withdraw your consent at any time by contacting our Grievance Officer. Withdrawal of consent does not affect the legality of data processed prior to the withdrawal.
5. Your Rights as a Data Principal
As a Data Principal residing in India or utilizing our services under the DPDP Act, 2023, you have the following rights:
Right to Access Summary
Request a brief summary of personal data held by us and the processing activities undertaken.
Right to Correction & Erasure
Request correction of inaccurate or misleading data, updating of incomplete records, or erasure of unnecessary data.
Right of Grievance Redressal
Access our designated internal grievance mechanism to resolve complaints before escalating to regulatory boards.
Right to Nominate
Nominate any other individual to exercise your rights under the Act in the event of death or incapacity.
6. Data Retention and Erasure Schedule
Under Section 8(7) of the DPDP Act, personal data is retained only for as long as necessary to satisfy the purpose for which it was processed or to satisfy statutory accounting and tax obligations.
Prospective inquiry records that do not transition into active client contracts are routinely purged or anonymized within 180 days. Registered users of platforms like SankhCard may delete their accounts at any time via the self-service Account Deletion Portal.
7. Reasonable Security Safeguards
In compliance with Section 8(5) of the DPDP Act, Sankh Labs implements reasonable administrative, technical, and physical safeguards against data loss, unauthorized access, and cyber incidents:
- Mandatory TLS 1.3 / HTTPS encryption across all web endpoints and API transmissions.
- Cryptographic hashing of user credentials using salted algorithms (bcrypt/Argon2).
- Role-based access controls (RBAC) ensuring only authorized technical staff have access to production databases.
- Regular vulnerability scanning, automated cloud backups, and DDoS mitigation.
8. Third-Party Service Providers & Data Processors
We engage trusted third-party technology providers for cloud infrastructure, content delivery, database hosting, and business email (such as Vercel, cloud server providers, and official partner services like Razorpay and Shopify). All third-party processors operate under strict data protection and confidentiality agreements. We do not sell or rent personal information to data brokers or advertisers.
9. Cookies & Tracking Technologies
Our website uses lightweight, essential cookies necessary for authentication, security, and theme preferences. Where analytical measurement is enabled, it is aggregated to understand website traffic patterns.
You can manage your cookie preferences through the on-site consent banner or via your browser settings at any time.
10. Grievance Redressal Officer (Section 8(9))
In accordance with the DPDP Act, 2023, any concerns, questions, or requests to exercise your statutory rights as a Data Principal may be submitted to our designated Grievance Officer:
Designation: Data Grievance Redressal Officer
Entity: SANKH LABS PRIVATE LIMITED
Registered Address: Vijay Nagar, Jabalpur, Madhya Pradesh - 482002, India
Email: contact@sankhlabs.com (Subject: “DPDP Data Privacy Request”)
Response Timeline: Acknowledgments provided within 48 business hours; formal resolution provided within 30 days.
11. Updates to This Policy
We may periodically update this Privacy Policy to reflect technical enhancements or regulatory rule notifications issued under the DPDP Act. The “Last Updated” date at the top of this page will reflect the date of the most recent revision.