Privacy policy

1. Information you share with us

If you submit an audit request, we receive the name, email address, website address and any other details you enter in the form. If you email us, we receive your email address, the contents of your message, any attachments, and other information you choose to provide. This may include your business name, service areas, business locations, project requirements and the software your business uses.

If you request a website review, we may also review publicly available content on the website you identify.

Please do not send passwords, payment-card details, sensitive personal information or your customers’ personal information in an initial enquiry. If a project requires access to your systems, we will agree on an appropriate way to arrange it.

2. Current status of our enquiry forms

The audit request form is available only when our email delivery service and anti-abuse rate limiting are configured. When available, it sends a plain-text copy of your audit request through Resend to the email address you enter. The email’s Reply-To address is sahil@ductfolio.com, so your replies reach Sahil’s Gmail inbox. We do not automatically email a separate copy of the form submission to that inbox. A successful submission means Resend has accepted the email for sending, not that it has reached your inbox.

The website application does not save audit requests in a database, keep a durable backup of submissions, or write personal information to application logs. To limit abuse, Cloudflare temporarily processes IP-based rate-limit information. This is separate from the enquiry email and is not used to track visitors.

The project enquiry form remains disabled and does not submit your information. You can contact us by email instead, including when the audit form is unavailable.

3. Hosting and website analytics

Our website runs on Cloudflare Workers. Cloudflare processes network and request information to deliver, secure and maintain the website. This can include IP addresses, requested URLs, browser and device information, timestamps, and diagnostic or security information.

The live website also uses Cloudflare Web Analytics, including a performance beacon supplied by Cloudflare. It reports page visits and technical performance information, such as page-load timings and browser information, to help us understand website use and reliability. Cloudflare states that this service does not track individual visitors across its customers’ websites.

Learn more in Cloudflare’s Privacy Policy and its Web Analytics documentation.

4. Cookies and browser storage

The website application does not set cookies or use local storage to save enquiry details or track visitors. We do not use advertising pixels or behavioural advertising on this website. Fonts and website images are served from our own site rather than third-party font or image services.

Cloudflare’s hosting and security services may use essential browser technologies when needed to protect the website. These are separate from advertising. You can control cookies and scripts through your browser settings; blocking some technologies may affect website functionality. Browser privacy tools may also block the Cloudflare analytics beacon.

5. Why we use information

We use information to respond to enquiries, deliver requested website reviews, understand project requirements, prepare proposals, communicate about agreed services, maintain website performance and security, and meet applicable legal obligations.

Where a legal basis is required, we rely on steps you request before a contract, performance of an agreement, our legitimate interests in running and protecting the business where permitted, legal obligations, or consent where required. You can withdraw consent for processing that relies on it by emailing us. Withdrawal does not affect processing already lawfully carried out.

Contacting us does not automatically subscribe you to a marketing mailing list.

6. Who receives information

We do not sell or rent your personal information. We share information only where needed to operate our services, fulfil your requests, or meet legal requirements.

Recipients include Cloudflare for hosting, security, anti-abuse rate limiting and analytics; Resend for sending audit request emails; and Google’s Gmail for receiving and storing our email correspondence. Authorised project collaborators or professional advisers may also receive information where necessary. We may disclose information when required by law or to establish, exercise or defend legal claims.

We limit information shared to what is relevant to the purpose. We do not have a payment-processing integration on this website.

7. How long we keep information

We keep routine enquiry correspondence and associated personal information for 30 days after our last substantive communication about the enquiry, then delete it from our active records.

If an enquiry becomes an active project, we retain information needed to deliver that project for the duration of the engagement and ordinarily delete it within 30 days after completion. We may retain specific records longer where required by law, such as invoices, or where necessary to resolve a dispute or establish, exercise or defend legal claims.

The 30-day period applies to enquiry and project information under our control, including audit request emails in our active records. Cloudflare’s infrastructure logs and analytics, Resend’s email-processing records, and Google’s service records and backup copies follow the retention arrangements applicable to those services; we do not represent that every provider-held copy is deleted within 30 days.

8. International processing and security

Ductfolio operates from India. Cloudflare and other service providers may process information in other countries. Where applicable law requires safeguards for international transfers, those requirements apply to our use of these services.

We take reasonable steps to protect information against unauthorised access, loss, misuse or disclosure. No internet transmission or storage system can be guaranteed completely secure.

9. Your choices, rights and complaints

You can contact us to ask what personal information we hold about you, correct it, request its deletion, or raise a concern about its use. Depending on applicable law, you may also have rights to access a copy, restrict or object to processing, receive eligible information in a portable format, or withdraw consent.

Send requests or privacy grievances to Sahil Suman at sahil@ductfolio.com. We may ask for information reasonably needed to verify your identity. We will respond within the period required by applicable law and explain any lawful reason that prevents us from fulfilling a request.

You may also complain to a competent data protection authority where that right is available under applicable law.

10. Other websites and client data

This policy covers Ductfolio’s website and its own business communications. Third-party websites and websites we build for clients have their own privacy practices. If we handle personal information on a client’s behalf, the applicable service agreement and data-processing terms govern that work. Requests concerning a client’s customer records should normally be directed to that client.

11. Children’s privacy

Our services are intended for business users, not children under 18. We do not knowingly collect personal information from children. If you believe a child has provided information to us, contact us so we can investigate and arrange appropriate deletion.

12. Changes and contact

We may update this policy when our services, practices or legal requirements change. The current version and its update date will appear on this page. We will provide additional notice or obtain consent where required by law.