What we collect, and why.
Last updated 27 August 2026 · Written for India's Digital Personal Data Protection Act, 2023
This page is deliberately short and in plain English. If anything here is unclear, ask us and we will explain it — that is easier than reading a lawyer's version.
The short version. We collect what you choose to send through a form, plus limited technical data needed for security and traffic counting. We do not sell personal data or run advertising trackers. Raw IP addresses are not persisted in the KK Cyber lead or analytics stores; a one-way pseudonymous identifier is used for abuse controls. Ask us to delete your data and we will handle the request promptly.
Who we are
KK Cyber, 121, Tanda Hoshiarpur Rd, Kandhala Jattan, Hoshiarpur, Punjab 146116, India. MSME registered. We are the data fiduciary for everything described here. Reach us at ceo@kkcyber.com or on WhatsApp at +91 84273 03490.
What we collect
| What | When | Why |
|---|---|---|
| Name, phone, email | Only when you fill in a form | To answer your enquiry |
| Service, budget, your message | Only when you fill in a form | To quote accurately |
| Page viewed, referrer, device type, screen size, language | Every visit | To know which pages are useful |
| Pseudonymous request identifier derived from IP | When the site API is used | Rate limiting, abuse prevention and aggregate traffic counting |
| Country code supplied by the hosting edge | When an enquiry is submitted, if available | Operational context for the enquiry |
Raw IP addresses are not persisted in our application records. For rate limiting, the server derives a pseudonymous HMAC identifier using a server-side secret. This reduces exposure if application data is leaked, but we still treat the resulting identifier as security-sensitive operational data rather than claiming it is perfectly anonymous.
Worth knowing: a browser never gives a website your email address. No script can collect it, on this site or any other. We know who you are only when you choose to tell us through a form.
What we do not do
- We do not sell, rent or trade your details to anyone.
- We run no advertising pixels, no Facebook tracker, no Google Analytics.
- We set no marketing cookies. The site can keep local UI preferences, an offline contact-form draft, and a short-lived queue of submissions that could not be sent because the network was unavailable. Those offline records stay on your device until they are synchronized or expire.
- We do not send marketing email you did not ask for.
Offline storage and retry
The progressive web app caches only public static assets for reliability. API and admin responses are not cached. If you start an enquiry while offline, the service worker can store the draft and queued submission in your browser's IndexedDB and retry it when connectivity returns. Queued items expire automatically after a short period, and a successful submission clears the related contact draft.
Who else sees it
Only the services that are needed to deliver the site, and only the minimum each one needs:
- Netlify hosts the site and stores enquiries. Standard server logs sit with them.
- Resend delivers configured enquiry emails to KK Cyber and acknowledgement copies to the supplied email address. These can include the submitted project or course brief as a PDF.
- Meta WhatsApp relays configured owner notifications and project/course PDF briefs. These include submitted contact details, requirements and the planning estimate. The PDF is uploaded privately for message delivery; it is not published as a public website link. Legacy CallMeBot, when selected, relays text notifications instead.
We hand data to police or a court only when the law compels us, and we will tell you if we are permitted to.
How long we keep it
- Enquiries — three years, then deleted. Long enough for a returning client, short enough not to hoard.
- Traffic records — twelve months.
- Project files for paying clients — as long as the contract says, and afterwards on your instruction.
Your rights under the DPDP Act
You can ask us to show you everything we hold about you, correct anything wrong, delete all of it, or tell you who we shared it with. Email ceo@kkcyber.com with the phone number you used and we will act within seven working days. There is no charge, and you never need a reason.
If we handle a request badly you may complain to the Data Protection Board of India.
Children
Our services are for adults and for businesses. If you are under eighteen, please have a parent or guardian make the enquiry. We do not knowingly keep a child's data, and we delete it if we learn we have it.
Keeping it safe
The site runs over HTTPS only. Enquiries are stored on servers we control through Netlify, IP addresses are hashed rather than stored, the dashboard is password-protected, and its password lives in an encrypted environment variable rather than in a file. No system is perfect — if we ever suffer a breach that puts you at risk, we will tell you and the Data Protection Board promptly.
Changes
If this notice changes materially we will update the date above and, for anything significant, say so on the home page.
Back to the siteHow the new enquiry and AI features handle data
The project form collects the name, business contact details, selected service, budget, timeline, meeting preference and message voluntarily provided by a visitor. On a properly configured Netlify deployment, these entries are processed by Netlify Forms so KK Cyber can reply. If separately configured, the server-side WhatsApp Business API sends a summary to KK Cyber's designated owner number. Provider acceptance is not proof of phone delivery.
The optional KK AI chat sends the text you enter, with recent conversation context, to Google's Gemini API using a server-side secret—not browser JavaScript. If this API is missing or unavailable, the widget explicitly falls back to a local guided FAQ. Do not provide passwords, API keys, payment details, government IDs or confidential project data in public forms or chat.
Enquiries and chat interactions may be processed by hosting, messaging and AI providers according to their terms and site configuration. Access should be restricted to authorized personnel. Contact ceo@kkcyber.com to request access, correction or deletion where applicable. Before production use, confirm the providers' data handling and applicable notices/consent requirements.
Minimal website engagement measurement
We may count anonymous daily totals for service-link clicks, demo visits, enquiry starts and WhatsApp handoff clicks. Form contents, names, phone numbers and email addresses are not sent as analytics events. A WhatsApp handoff click is not proof that a message was sent. Browser Do Not Track is respected by the page’s optional click measurement.