Privacy Policy

Last updated: 11 November 2026

This policy explains what personal data we collect, why, who we share it with, how long we keep it and the rights you have. We collect only what we need to answer you and to deliver your project.

1. Who we are

The website quadcraftstudio.com, the QUADCRAFTSTUDIO client portal and the email address business@quadcraftstudio.com are run by:

In this policy “we”, “us” and “QUADCRAFTSTUDIO” mean that business. Under India’s Digital Personal Data Protection Act, 2023 we are the “Data Fiduciary” for the data described here; under the EU and UK GDPR we are the “controller”.

2. What we collect and why

When you visit the website

The website has no forms, no sign-up, no analytics, no advertising and no tracking cookies. Everything on it, including its fonts and films, is served from our own site. One service still receives technical data so the site can work:

• Cloudflare (our website host) processes your IP address, browser type, the pages and files you request and the time of the request, to deliver the site and protect it from attacks.

When you email us

If you write to us, we receive your name, email address and anything you choose to include, such as your company, phone number, project details or files. We use this only to reply, to prepare a quote or proposal and, if you become a client, to run your project.

When you use the client portal (clients only)

The portal is only for clients we have agreed to work with. We create your account and use these details to run your project:

• Account: your name, username, email address, phone number, job role, an optional profile photo, your notification settings, and your password (stored only in scrambled, “hashed” form by our provider; we cannot read it).
• Company and billing: company name and address, billing contact, billing email and billing address.
• Project content: files, designs, feedback and comments you or we add, download requests and a log of project activity.
• Invoices and payments: invoice amounts and status, and the payment details you report — method (bank transfer or UPI), transaction reference, amount, a note and any payment proof you upload. We never collect or store card numbers or your banking passwords; payments are made through your own bank or UPI app.
• Sign-in: cookies that keep you signed in (see the Cookie Policy).

3. Our lawful grounds

• To answer you and run a project you asked for: under the DPDP Act, data you give us voluntarily for that purpose (a “legitimate use”); under the GDPR, steps before or to perform a contract.
• To meet legal duties, such as keeping invoices and accounts under Indian tax and company law.
• Your consent, where we ask for it. You can withdraw consent at any time by emailing us; this does not affect what we did before.

We do not sell personal data, use it for advertising, or make automated decisions about you.

4. Who we share it with

We share data only with service providers who process it for us under their terms, and only as needed:

We may also share data with our professional advisers (such as accountants and lawyers), and with courts, regulators or police when the law requires it.

5. Transfers outside India

Some of these providers store or process data outside India, including in the United States. Where the GDPR applies, we rely on the safeguards those providers offer, such as the European Commission’s Standard Contractual Clauses.

6. How long we keep it

• Emails and enquiries that do not lead to a project: until the conversation has ended and we no longer need them, then deleted.
• Portal accounts and project content: for the length of the project and afterwards while you may still need access to your files. You can ask us to close your account at any time.
• Invoices and payment records: for as long as Indian tax and company law requires (at present up to eight years).
• Technical data held by Cloudflare: for the short periods set by Cloudflare.

7. How we protect it

The website and portal are served only over encrypted connections (HTTPS). Portal data sits behind sign-in, and each client can see only their own company’s projects. Only the people at QUADCRAFTSTUDIO who need the data can access it. No system is perfectly secure; if a breach affects your data, we will tell you and the authorities as the law requires.

8. Your rights

You can ask us to:

• tell you what personal data we hold about you and how we use it, and who we have shared it with;
• correct, complete or update it;
• erase it, unless we must keep it by law (for example, invoices);
• stop using it where we rely on your consent;
• name someone to act for you if you die or cannot act yourself (DPDP Act).

If you are in the EU or UK you also have the rights to restrict or object to processing, to data portability, and to complain to your local data protection authority.

To use any of these rights, email business@quadcraftstudio.com. We may need to confirm who you are before acting.

9. Complaints and Grievance Officer

If you have a concern about how we handle your data, contact our Grievance Officer:

We will acknowledge your complaint and aim to resolve it within one month. If you are not satisfied with our answer, you may complain to the Data Protection Board of India once it is accepting complaints, or, in the EU or UK, to your data protection authority.

10. Children

Our services are for businesses. The website and portal are not meant for anyone under 18, and we do not knowingly collect their data.

11. Changes to this policy

If we change how we handle data, we will update this page and the date at the top. If a change affects clients significantly, we will tell them by email.