Privacy Policy
What personal data we collect, which services process it, and the choices and rights you have.
1. Who we are and what this policy covers
Zenvorix Studios (“Zenvorix”, “we”, “us”) provides digital services from India and operates zenvorix.in. For the personal data described below, we decide the purposes and means of processing; in the language of the Digital Personal Data Protection Act, 2023 (“DPDP Act”) we act as the Data Fiduciary. This policy covers the website, enquiries, the optional Google sign-in, and our communications and billing with clients and prospective clients. If we process data on behalf of a client inside a project (for example, a client’s customer list), the client decides the purposes and we process it only on its instructions.
Contact for privacy matters: support@zenvorix.in (subject “Privacy Request”).
2. Laws we refer to, and what is in force
We want to be accurate about the legal position rather than claim more than is true:
- Information Technology Act, 2000 and the reasonable-security rules under it (including Section 43A and the 2011 SPDI Rules) currently apply, together with the CERT-In incident-reporting directions where applicable to us.
- DPDP Act, 2023 and the DPDP Rules, 2025. The Rules were notified in November 2025 and commence in phases: provisions on the Data Protection Board from notification; provisions on Consent Managers from about November 2026; and the main duties of data fiduciaries (notice, consent, security safeguards, breach intimation, retention and erasure, children’s data, and the rights of Data Principals) from about May 2027. Consent Manager provisions are not relevant to us today because we do not use a Consent Manager.
- Consumer Protection Act, 2019 and, where applicable, the Consumer Protection (E-Commerce) Rules, 2020 govern consumer-facing aspects such as grievance handling.
We have written this policy to follow the DPDP standards voluntarily before they become mandatory. This is a statement of our practice and intent. It is not a certification or claim that every DPDP obligation already applies or has been fully met. Dates of commencement should be checked against the official notifications.
3. Personal data we collect and why
| Source | Data | Why we use it |
|---|---|---|
| Enquiry form (contact page) | Name, email address, WhatsApp/phone number, service, package, budget range and the project details you type, plus a technical source label (“zenvorix.in”) and a timestamp. | To respond to your enquiry, prepare a quotation and discuss your project. |
| Google sign-in (Account page, optional) | From your Google account: display name, email address, profile photo link and a Firebase user ID. We do not receive your Google password. | To show you as signed in and identify your session. |
| Email, WhatsApp, phone | Whatever you send us: contact details, messages, files and project material. | To communicate, deliver services and give support. |
| Project and billing records | Business and billing details, invoice data, payment amount, date and transaction reference (such as UTR). Payments are made outside this website (see the Payment Policy). | To confirm payments, issue invoices, handle refunds and meet accounting and tax obligations. |
| Technical data | IP address, browser and device details, requested pages and timestamps, as received by our hosting provider and by providers whose resources load on our pages. | To deliver and secure the website and fix problems. |
We do not ask for, and you should not send, card numbers, card security codes, banking passwords, OTPs or sensitive personal data through the form, email or WhatsApp. Please give us only what is needed for your request. Providing your details is voluntary, but we cannot reply to an enquiry without a contact detail.
4. Services and integrations: status
We checked the website’s own code to prepare this table. A provider listed as active means the website code actually loads or calls it. We cannot see settings inside provider dashboards from the code, so we say clearly where something could not be verified.
Active (found in the website code)
| Service | What it does here | Data involved |
|---|---|---|
| Google Cloud Firestore (Firebase project) | Stores each enquiry you submit on the contact page. | The enquiry fields listed in section 3. |
| Firebase Authentication (Google sign-in) | Signs you in on the Account page. A small script on every page checks if you are signed in so it can show your photo or initials on the account button. | Google name, email, photo link, user ID; sign-in session data in your browser. |
| Firebase JavaScript libraries from gstatic.com (Google) | Delivered from Google’s servers to run the two items above. | Your IP address and browser details reach Google when the files load. |
| Google Fonts | Loads the Inter typeface on every page. | IP address and browser details reach Google. |
| Font Awesome icons via cdnjs.cloudflare.com (Cloudflare) | Loads icons on every page. | IP address and browser details reach the CDN. |
| Unsplash images (images.unsplash.com) | Sample photographs shown on the home, about, services and portfolio pages. | IP address and browser details reach the image host when those pages load. |
| WhatsApp / Meta (click-to-chat links) | Links and a floating button open WhatsApp when you click. Nothing from WhatsApp is embedded or loaded until you click. | What you send in WhatsApp, which is then also subject to WhatsApp’s own terms and privacy policy. |
| Netlify (website hosting) | The site’s configuration and deployment notes are in Netlify’s format, so we treat Netlify as the host. Please see the note on verification below. | Standard request data such as IP address and browser details. |
Configured in the code, but delivery or settings could not be verified
| Service | What the code does | What we could not verify |
|---|---|---|
| EmailJS | When you submit the form, after saving it, the page asks EmailJS to send a notification email to support@zenvorix.in containing your enquiry details and its reference number. Account identifiers are set in the code. | Whether the EmailJS account, template and connected email service are currently active and working, which mailbox provider receives the email, and any provider-side limits or domain restrictions. If the email step fails, the enquiry is still saved and the form tells you. |
| Email provider for support@zenvorix.in | Receives enquiries and your emails. | The provider is not identified in the website code. |
| Firestore location, backups and abuse protection | The database is used as described above. | The data region, backup settings and whether Firebase App Check is enabled are dashboard settings and are not visible from the code. |
Not in use (not found in the website code)
Google Analytics / GA4, Google Tag Manager, Firebase Analytics, Meta Pixel or Conversions API, Google Ads or remarketing tags, other advertising or tracking pixels, any online payment gateway, embedded chat widgets or the WhatsApp Business API, file-upload features, and embedded third-party forms. If we start using any of them, we will update this policy and, where consent is needed, ask for it before it loads.
5. How we share personal data
We do not sell personal data. We share it only as needed with the providers in section 4, with advisers (for example accountants or lawyers) bound by confidentiality, with banks or payment providers to process payments and refunds, and with authorities when the law requires or to protect rights and security. If the business is reorganised or transferred, data may pass to the successor on terms consistent with this policy. These providers process data under their own terms and privacy policies.
6. Processing outside India
Google (Firebase, Fonts), Cloudflare, EmailJS, Netlify and Meta operate global infrastructure, so your data may be processed on servers outside India. We have not set or verified a specific data location for the Firestore database. The DPDP Act allows transfers outside India except to countries the Government restricts by notification. If a restriction applies to a provider we use, we will take appropriate action.
7. How long we keep data
We have not set up automatic deletion or fixed retention periods for enquiries in the website database. Enquiries stay in the database until we delete them. We keep enquiry and project information for as long as needed to answer you, prepare a quotation, deliver and support a project, and handle disputes or refunds. Invoices, payment and accounting records are kept for the periods required by tax and accounting laws. When data is no longer needed and no law requires us to keep it, we delete it or remove identifying details. You can ask for earlier deletion at any time (section 9). Providers may keep logs or copies under their own practices.
8. Security
The website is served over HTTPS. Firestore security rules allow visitors only to create a valid enquiry; they cannot read, change or delete stored enquiries. Reading and deleting enquiries is limited to an authorised administrator’s Google account, checked on the server by the database rules. We do not store passwords because Google handles sign-in. No system is completely secure, so please use safe channels and never share OTPs or passwords with us.
9. Your rights and how to use them
You can ask us to: (a) tell you what personal data of yours we hold and how it is used; (b) correct or complete it; (c) erase it; (d) withdraw consent; (e) address a grievance; and (f) nominate another person to exercise your rights if you die or become unable to do so. Email support@zenvorix.in with the subject “Privacy Request” from the address you used with us. We may ask for information to confirm it is you. We will acknowledge within 2 business days and aim to respond within 30 days, and in any case within the time law requires. Some data we must keep by law (for example invoices); we will tell you if we cannot erase something and why. The statutory right to these remedies under the DPDP Act applies once the relevant provisions commence; we are honouring requests now.
10. Withdrawing consent
Where we rely on your consent (for example to send updates), you can withdraw it by emailing us or using any unsubscribe option. Withdrawal does not affect lawful processing done before it. If you withdraw consent needed to deliver a service you requested, we may not be able to continue that service. You can change your cookie choice with “Cookie settings” in the footer.
11. Children
Our services are for businesses and adults. Under the DPDP Act a child is anyone under 18, and verifiable parental consent will be needed for processing a child’s data once the relevant provisions commence. We do not knowingly collect children’s data. If you believe a child has sent us data, contact us and we will delete it.
12. Data breaches
If we become aware of a personal data breach, we will investigate and contain it, assess the risk, and, where the law requires, notify the Data Protection Board of India, CERT-In and affected people within the prescribed time. We will tell you what happened, the likely effect and what you can do. Breach intimation duties under the DPDP Rules apply from the commencement date noted in section 2; we will follow the CERT-In directions that already apply to us.
13. Links to other sites
Our website links to services such as WhatsApp and Google. Their privacy practices are their own. Please read their policies before you share data with them.
14. Cookies and browser storage
See our Cookie Policy for what is stored in your browser, and how to change your choice.
15. Changes to this policy
We will post updates here with a new effective date and, if the change is material, a notice on the website. Previous versions are available on request.
16. Grievance and contact
For privacy requests or complaints, contact the Grievance Officer of Zenvorix Studios at support@zenvorix.in or WhatsApp +91 82660 33988. See Grievance Redressal for the process, timelines and further options. Please do not put passwords or OTPs in your message.
This page explains our practices and your rights in plain language. It is not legal advice.