1. Who we are and what this policy covers
Ctoryteller is an independent software studio based in Mumbai, India. We build our own products and help businesses work through the problems behind them.
This Privacy Policy explains how we handle personal information when you:
- visit our website at ctoryteller.com;
- write to us by email or WhatsApp — for example about our products, a partnership, support, or a consultation;
- otherwise deal with Ctoryteller as a company.
Our apps have their own policies. If you use one of our products, its own privacy policy describes the data that product collects and takes precedence for that product:
2. The short version
- Our website is a set of static pages. It has no accounts, no sign-up, no forms, no cookies, no analytics, and no advertising or tracking scripts.
- We only learn something about you if you choose to contact us — and then we use it to reply to you.
- We do not sell your personal data, and we do not use it for advertising or profiling.
3. Information we collect
3.1 When you visit the website
We do not ask for, or deliberately collect, any personal information when you browse ctoryteller.com. Two kinds of technical data are nonetheless processed as a necessary part of delivering a web page:
- Server logs. Like any website, our hosting provider receives standard request data when your browser loads a page — your IP address, browser and device type (user agent), the page requested, the referring page, and the date and time. This is used to deliver the site, keep it secure, and diagnose faults.
- Web fonts. Our pages load fonts from Google Fonts. To deliver them, your browser connects to Google's servers, which receive your IP address and user agent. Google's handling of that data is governed by Google's own privacy policy.
3.2 When you contact us
If you email us, message us on WhatsApp, or call us, we receive whatever you choose to send, typically:
- your name, email address or phone number;
- your organisation and role, if you mention them;
- the content of your message and any attachments, and our correspondence with you afterwards.
Please do not send us sensitive personal data (such as financial account details, health information, or government identifiers) unless we specifically ask for it and it is necessary for what you have asked us to do.
3.3 When you work with us
If you become a customer, partner or consulting client, we will also hold the information needed to carry out that relationship — contact details, the details of what we have agreed, invoices and payment records. Payments for our products are processed by Razorpay; we do not see or store your card or bank details.
4. How we use your information
We use personal information only to:
- Respond to you — answer your enquiry, provide support, or discuss a consultation or partnership you have asked about.
- Carry out an engagement — deliver work we have agreed with you, and invoice for it.
- Run and protect the website — deliver pages, keep the site secure, and investigate faults or misuse.
- Meet legal obligations — keep the records the law requires us to keep, such as tax and accounting records.
We will not add you to a mailing list or send you marketing because you contacted us. If we ever want to, we will ask first, and you can withdraw that consent at any time.
5. Legal basis
We process personal information under India's Digital Personal Data Protection Act, 2023 on the basis of:
- your consent, given when you choose to contact us and share information with us; and
- legitimate uses permitted by the Act, including where you have voluntarily provided information for a specified purpose, and where processing is needed to comply with law.
6. Who we share it with
We share personal information only with service providers who help us operate, and only as far as they need it:
- Our website hosting provider (Vercel) — serves the website and processes the server logs described in Section 3.1.
- Google — delivers the web fonts described in Section 3.1.
- Our email provider — stores the emails you send us and our replies.
- WhatsApp (Meta) — if you choose to contact us on WhatsApp, your messages are handled under WhatsApp's own terms and privacy policy.
- Razorpay — processes payments for our products.
We may also disclose information where the law requires it, or in response to a valid request from a court or government authority, or to protect our rights or the safety of others.
If Ctoryteller is involved in a merger, acquisition or sale of assets, personal information may transfer as part of that transaction; we will tell you before it becomes subject to a different privacy policy.
7. Where your data is processed
Ctoryteller is based in India. Some of the providers above operate infrastructure outside India, so your information may be processed in other countries. Where that happens, we rely on providers that maintain appropriate safeguards, and on transfers permitted under the DPDP Act.
8. How long we keep it
- Enquiries and correspondence are kept for as long as needed to deal with your message and any follow-up, and then deleted, unless they become part of an ongoing relationship with you.
- Customer and engagement records, including invoices, are kept for as long as the relationship continues and afterwards for as long as tax and accounting law requires.
- Server logs are kept by our hosting provider for a limited period under its standard log-retention settings.
9. How we protect it
The website is served only over encrypted HTTPS connections. We limit access to personal information to the people at Ctoryteller who need it, and we choose service providers who maintain recognised security standards. No method of transmission or storage is completely secure, but we take reasonable steps to protect what you share with us.
10. Your rights
Under the DPDP Act, you have the right to:
- Access — ask what personal information we hold about you and how we use it.
- Correction and completion — ask us to correct or update inaccurate information.
- Erasure — ask us to delete your information, unless we need to keep it to comply with law.
- Withdraw consent — at any time, for anything we process on the basis of consent. Withdrawing does not affect processing that already took place.
- Nominate — nominate another person to exercise these rights on your behalf in the event of your death or incapacity.
- Grievance redressal — raise a complaint with our Grievance Officer, and escalate to the Data Protection Board of India if it is not resolved.
To exercise any of these rights, email contact@ctoryteller.com or our Grievance Officer at grievance@ctoryteller.com. We may need to verify your identity before acting on a request.
11. Children
Our website and services are intended for businesses and adults. We do not knowingly collect personal information from anyone under 18. If you believe a child has sent us personal information, contact us and we will delete it.
12. Links to other websites
Our website links to other services, such as WhatsApp. We are not responsible for the privacy practices of those services; please read their own policies.
13. Changes to this policy
We may update this Privacy Policy from time to time. When we do, we will publish the new version on this page and change the "Last updated" date above. If a change is significant, we will make it prominent on the website.
14. Contact us and grievance redressal
If you have any question about this Privacy Policy or how we handle your information, or wish to raise a grievance, contact us:
- Email: contact@ctoryteller.com
- Grievance Officer: Faroze War, grievance@ctoryteller.com
- Phone / WhatsApp: +91-9970983661
- Registered address: Ctoryteller, 7th Floor, Skyline Icon, Andheri East, Mumbai 400059, India
- Business hours: Monday–Saturday, 10:00 AM – 6:00 PM IST
- Response time: Within 2 business days (general); 15 business days (formal grievances)