Privacy Policy.
Plain language, real accountability.

1. Who we are

OSHMAAL PRIVATE LIMITED is a digital product and engineering studio registered in India (CIN: U58200UP2024PTC195797, incorporated 16 January 2024). We design and build websites, web applications, e-commerce stores, mobile apps, AI systems, automations and custom software.

Registered office: House No. 2, Gali No. 1, Gautampuri, Near Devnagri, Ujhani, Budaun, Uttar Pradesh, India — 243639. Official email: shivangi@oshmaal.com. Phone: +91 9389017395.

For the purposes of the Digital Personal Data Protection Act, 2023 (“DPDP Act”), Oshmaal acts as the Data Fiduciary for personal data collected through this website and our sales / discovery process.

2. Scope

This policy applies to oshmaal.com, our contact and enquiry flows (forms, email, phone, video calls), and business communications related to our services. It does not apply to client systems we build or operate on a client’s behalf after handover — those are governed by the client’s own privacy terms and our work agreement with the client.

3. Data we collect

We collect only what we need to respond, scope work, and run a studio:

• Contact details you share: name, email address, phone number, company / organisation, business type, city.
• Project details you share: pages needed, goals, timelines, budgets, links, files, briefs, and call notes.
• Communications: emails, call recordings / notes (where you agree), proposals, invoices and support messages.
• Automatic / technical data: IP address, device and browser type, pages visited, time on page, referring URL, and approximate location — collected via privacy-respecting analytics and server logs.
• What we do not collect: we do not ask for passwords, OTPs, Aadhaar numbers, or full payment card details on this website. Payments, where applicable, are processed through named third-party providers.

4. Why we use it (purpose & lawful basis)

Under the DPDP Act we process personal data on the basis of your consent and for legitimate uses necessary to conduct business you have asked for:

• To respond to enquiries, schedule discovery calls, and prepare proposals and quotes.
• To deliver, maintain and support contracted work — including hosting setup, analytics setup, and handover documentation in accounts you control.
• To send project, billing and administrative communications (not marketing spam).
• To operate, secure and improve the website — including aggregated performance measurement.
• To comply with legal obligations (company, tax and accounting records) and to establish, exercise or defend legal claims.

Where consent is the basis, you may withdraw it at any time by emailing us — withdrawal does not affect processing already done, and we may still retain records the law requires us to keep.

5. Cookies & analytics

We use a small number of cookies and similar technologies:

• Strictly necessary: theme preference, mobile-menu state, and load / security functions. No consent banner is needed for these.
• Measurement: Google Analytics (ID: G-L11T8YR8WK) to understand aggregate visits and page performance. IP anonymisation is enabled where available, and data is viewed in aggregate.

You can block or delete cookies in your browser settings. Blocking measurement cookies will not break the site. We do not run cross-site advertising trackers on oshmaal.com.

6. Sharing & processors

We do not sell personal data. We share it only with:

• Service providers (processors) who help us operate — e.g. hosting / CDN (such as Vercel), analytics (Google), email, video-conferencing, and accounting tools — bound to use data only on our instructions.
• Professional advisers (chartered accountant, legal counsel) where needed for compliance.
• Authorities where required by law, court order, or to protect rights, safety and security.

Client deliverables are deployed into the client’s own domain, hosting and analytics accounts wherever possible, so ongoing visitor data of a delivered product sits with the client — not with us.

7. Retention

• Enquiry data: kept for up to 24 months from last contact so we can follow up and prevent duplicate scoping, then deleted or anonymised.
• Client / project records (contracts, invoices, handover docs): kept for at least 8 years as required under Indian company and tax law.
• Analytics / logs: aggregate reports are kept; raw logs are rotated and deleted on a rolling basis.

8. Security

We apply reasonable security practices — access control on a need-to-know basis, HTTPS everywhere, updated dependencies, and limited retention. No method is 100% secure; if we become aware of a personal data breach that affects you, we will inform you and the Data Protection Board of India as required by law.

9. Your rights

Under the DPDP Act you have the right to:

• Access a summary of personal data we hold about you and our processing activities;
• Request correction, completion or updating of inaccurate data;
• Request erasure where retention is no longer necessary or consent is withdrawn (subject to legal retention duties);
• Nominate another person to exercise your rights in case of death or incapacity;
• Seek grievance redressal with us first, and then with the Data Protection Board of India.

To exercise any right, email shivangi@oshmaal.com with the subject “Data Request”. We will verify your identity and respond without undue delay and within statutory timelines.

10. Children

Our services are business services and are not directed at children under 18. We do not knowingly collect children’s data. If you believe a child has shared data with us, contact us and we will delete it promptly.

11. Transfers

We are a remote-first studio operating in India and serving clients globally. Where a processor stores data outside India (for example, analytics or cloud infrastructure), we rely on contractual safeguards and process only what is necessary. The Government of India may restrict transfers to certain countries by notification — we will comply with any such restriction.

12. Third-party links

Our site links to client work, social profiles and tools. Their privacy practices are their own. Please review their notices before sharing data with them.

13. Changes to this policy

We may update this policy when our practices or the law changes. The “Last updated” date at the top will change, and material changes will be highlighted on this page. Continued use of the site after an update means you have read the revised policy.

14. Contact & grievance redressal

Related: Terms & Conditions · Contact us