Privacy Policy

CodeCurious Technologies Pvt. Ltd. ("CodeCurious", "we", "us", or "our") collects information necessary to deliver bespoke engineering services, cloud platform development, mobile applications, and technical consulting.

• Direct Consultation Data: Your name, work email address, phone/WhatsApp number, company name, and project scope details provided via contact forms or Calendly integrations.
• Technical Telemetry: Anonymized browser metadata, IP address, device viewport, and navigation logs used strictly to diagnose site performance and prevent DDoS attacks.
• Project Artifacts: Architectural specifications, wireframes, repository access credentials, and API tokens provided under mutual Non-Disclosure Agreements (NDAs).

We use collected information solely for genuine commercial and engineering purposes:

• To formulate engineering estimates, sprint roadmaps, and technical architecture proposals.
• To execute custom software development, DevOps CI/CD pipelines, and cloud deployments on your designated infrastructure.
• To transmit critical system alerts, project deliverables, and monthly engineering dispatches (which you may opt out of at any time).

We operate under a strict 100% Client IP Ownership Model. All source code, schema designs, database scripts, deployment configurations, and trade secrets authored for your project belong exclusively to you upon payment of agreed invoices.

Our engineers work within ephemeral, containerized development sandboxes with strict RBAC access controls, ensuring client codebase isolation and zero cross-tenant contamination.

When building autonomous AI systems, LangGraph agent workflows, or RAG platforms for our clients:

• We mandate enterprise zero-data-retention (ZDR) APIs (e.g. OpenAI Enterprise, Anthropic Bedrock, AWS Private LLMs).
• Your proprietary data, prompts, embeddings, and database contents are never used to train public AI foundation models.
• Private vector databases (pgvector, Qdrant, Pinecone) are deployed inside your dedicated VPCs with end-to-end encryption.

We implement comprehensive defense-in-depth measures:

• In Transit: TLS 1.3 with Perfect Forward Secrecy across all web endpoints and API gateways.
• At Rest: AES-256 GCM encryption on all storage volumes, databases, and backup snapshots.
• Access Control: Mandatory Hardware 2FA / WebAuthn for all engineering workstations, SSO authentication, and least-privilege IAM policies.

Our website uses strictly minimal, privacy-friendly storage keys:

• cc_theme: Saves your preferred UI color mode (Sapphire Dark or Light).
• cc_session_token: Authenticates secure project estimator and contact sessions.

We do not utilize invasive cross-site tracking pixels, third-party canvas fingerprinting, or commercial spyware.

Regardless of your geographic location, you retain full sovereignty over your personal data:

• Right to Access & Portability: Request an export of all personal data held in our systems.
• Right to Rectification: Update or correct any inaccurate personal details.
• Right to Erasure ("Right to Be Forgotten"): Request immediate permanent purging of your records from our active databases.
• Right to Restrict Processing: Limit how your information is utilized during active commercial disputes.

We retain contact intake records for a maximum of 24 months following the conclusion of commercial discussions, unless statutory tax or legal regulations require extended preservation. Inactive staging repositories and ephemeral test environments are cryptographically destroyed 30 days after project handoff.

For privacy inquiries, GDPR subject access requests, or NDA execution requests, contact our legal counsel directly: