Your Privacy, Our Commitment.

Introduction

ProjectCode is an AI-powered platform owned and operated by Lenditt Innovations & Technologies Pvt Ltd (“Company,” “we,” “us,” or “our”), a company duly incorporated and validly existing in India under the provisions of the Companies Act, 2013. The platform is designed to support and empower developers as well as non-technical users including entrepreneurs, collaborators, and visitors to create, share, and deploy web applications using natural-language inputs (“User,” “you,” or “your”). Our core mission is to streamline and modernize the software development lifecycle through advanced tools, seamless integrations, and shared workspaces, enabling you to build, distribute, and deploy applications (including backend, frontend, and database-management components) using intuitive solutions, integration features, and artificial-intelligence (AI) assisted development technologies, while maintaining a strong commitment to the security and confidentiality of your information. We seek to cultivate an active and collaborative developer ecosystem and ensure that our operations align with applicable data-protection and privacy regulations in India.

This Privacy Policy (Policy), accessible online at https://projectcode.dev/privacy-policy, sets out in detail how we collect, use, store, disclose, process, and safeguard your Personal Information when you access or use our website, platform, and related offerings. This Policy has been prepared in accordance with the provisions of the Information Technology Act, 2000, the Digital Personal Data Protection Act, 2023 as amended from time to time, together with rules, notifications, and directions issued thereunder (“DPDP Act”) as well as other relevant laws in India and intends to comply with the same. In the event of any inconsistency between this Policy and the DPDP Act or any rules, notifications, or directions issued thereunder, the provisions of the DPDP Act shall prevail to the extent of such inconsistency.

By accessing or using our website https://projectcode.dev/ proprietary software systems, products, or by engaging with us for any service engagement including application or website development through AI-based development for backend, frontend, database management (collectively, “Services”), you acknowledge and agree to be bound by this Policy and consent to our treatment of your personal data as described herein. If you do not agree with this Policy, you are advised to discontinue use of, or refrain from accessing, our Services.

Scope And Purpose

For the purposes of this Policy, the term “Personal Data” (also referred to interchangeably as “Personal Information”) refers to any data relating to an identifiable individual that is capable of identifying such person either directly or indirectly. This includes any information defined and protected under the DPDP Act, together with any applicable rules, notifications, guidelines, or frameworks issued under relevant Indian data-protection laws. Personal Data may relate to a specific natural person or be capable of identifying an individual when combined with other information available to the Company.

Personal Data may include, by way of illustration and without limitation, your full name, postal or residential address, email address, telephone number, gender, username or login credentials, authentication information, government-issued identifiers (solely where permitted or required by applicable law), unique device or browser identifiers, Internet Protocol (IP) address, geolocation data, system usage logs, online behaviour data, as well as any other information that can reasonably be associated with, linked to, or used to identify you.

In addition to Personal Data, we may process certain operational, diagnostic, analytical, statistical, or telemetry-based information generated automatically when you interact with or use the Services (“Functional Data”). Such Functional Data is processed for maintaining platform functionality, ensuring security, optimizing performance, supporting billing operations, improving the user experience, and enabling technical troubleshooting. Unless such Functional Data is directly associated with or reasonably capable of identifying a specific natural person under applicable law, it shall not be treated as Customer Personal Data.

We collect, use, store, disclose, and share Personal Data in connection with the access, use, and performance of our platform, products, tools, and Services. This Policy specifies the scope, manner, and purpose of the processing of your Personal Data while interacting with the Services, whether directly through the platform or indirectly through integrations, APIs, development engagements, or other operational processes.

This Policy governs our processing activities within the territory of India and applies to all Personal Data collected from or relating to Users in connection with the Services. It also reflects our compliance-oriented approach under applicable Indian laws, including the DPDP Act. The expressions “personal data,” “data fiduciary,” “data principal,” “processing,” and other similar terms shall be interpreted in accordance with their meanings under the DPDP Act and relevant legal provisions.

Definitions

Few definitions are provided below, however few definitions are included in the entire document as and when the word appears.

Legal Basis for Processing

We collect, handle, store, use, disclose, and otherwise process Personal Data pursuant to one or more of the lawful grounds recognized under applicable Indian data-protection laws, including the DPDP Act, industry standards, and related rules, notifications, and guidance. Depending on the context of your interaction with our Services, such processing may be justified on the following legal bases:

Processing of Personal Data

Your use of the Services constitutes acknowledgment that processing of Personal Data will be subject to this Policy and applicable Indian law.

What Information We Collect?

Purpose of Collection and Use

We collect and process Personal Data only for lawful and limited purposes connected with the provision of our products and Services. The purposes for which Personal Data may be used include, without limitation:

• Provision, Operation & Enhancement of Services: To provide, administer, manage, operate, configure, customize, support, maintain, and improve the Services (including backend, frontend, database-management, integrations, and deployment environments).
• Application & Platform Development: For the design, architecture, development, testing, deployment, hosting, quality assurance, maintenance, optimisation, and debugging of applications, websites, and related services built or used through our platform.
• Database & Infrastructure Management: To enable database creation, configuration, hosting, storage, querying, performance tuning, back-up, data modelling, extraction, transformation, loading, data analytics, and related administrative or operational tasks.
• AI-Enabled Services & Platform Functions: For AI-based or automated functionality such as code generation, optimisation, documentation assistance, error detection, testing automation, performance benchmarking, analytics, predictive analysis, and other features designed to support platform or application development. Where AI processing involves Personal Data, it shall be performed only where permitted by applicable law or valid contract. Personal Data will not be used for model training unless anonymised or otherwise legally permitted.
• Customer Relationship Management (CRM): To communicate, respond to support requests, resolve disputes, provide product updates and notifications, billing and invoicing, and maintain account and service records.
• Internal Administrative Purposes: For internal documentation, audits, backup and recovery functions, data governance, research, business analytics, forecasting, quality monitoring, and service-usage analysis.
• Regulatory, Legal & Compliance Purposes: To comply with applicable laws, regulatory requirements, law-enforcement requests, court orders, taxation and accounting obligations, and to establish, exercise, or defend legal claims.
• Security, Risk Prevention & Fraud Detection: To detect, prevent, and investigate fraud, cyber incidents, abuse, unauthorised access, violations of our terms, and other harmful or illegal activities; and to secure networks, systems, data, and user accounts.
• Use Limitation & Consent: We shall not process Personal Data for purposes unrelated to our business functions without obtaining consent, except where otherwise permitted under applicable law (e.g., compliance, legal claims, security incidents, fraud prevention).

We may use Personal Data for internal research, statistical analysis, service enhancement, and technology development and demonstration. Such use shall be in compliance with applicable laws and, where feasible, employ de-identification or anonymisation. These activities are not considered “selling” or “sharing” Personal Data. We do not sell or share Personal Data to third parties for monetary consideration or commercial benefit.

Use of Information

We use the Personal Data and other information we collect solely for lawful and limited purposes directly related to the provision and improvement of our Services. Subject to applicable law, we may use such information for the following purposes:

• Provision, Operation, and Enhancement of Services: To provide, operate, administer, maintain, manage, troubleshoot, and enhance our Services, including backend services, frontend interfaces, application deployments, hosting environments, integrations, and database-management workflows.
• Personalisation and Feature Enablement: To personalise and optimise the user experience, including recommending features, configurations, integrations, templates, and workflows; enabling user interface customisation; and tailoring platform behaviour based on usage preferences and operational contexts.
• Analytics, Platform Monitoring, and Performance Management: To analyse usage patterns; monitor platform performance and resource consumption; debug, diagnose, and resolve errors; detect anomalies; prevent and remediate outages; and ensure stability, reliability, and operational effectiveness of the Services.
• Security, Fraud-Prevention, and Abuse Monitoring: To detect, prevent, investigate, and mitigate fraud, unauthorised access, abuse of Services, security incidents, cyber-threats, policy violations, and other harmful or illegal activity; and to maintain the confidentiality, integrity, and availability of systems and data.
• Communications and Customer Support: To communicate with you regarding your account or use of the Services, including transactional notices, account-related alerts, billing notifications, password-reset messages, system or policy updates, and service-impacting communications; and to respond to support tickets, inquiries, requests, feedback, or disputes. Such communications may be conducted through available communication channels, including email or community platforms such as Discord, depending on the mode of interaction chosen by you.
  Marketing or promotional messages will be sent only where consent has been obtained, and you may opt out at any time.
• Legal, Regulatory, and Compliance Purposes: To comply with applicable legal, regulatory, and contractual obligations, including tax and accounting requirements, audits, law-enforcement requests, dispute resolution, record-keeping, and compliance with export-control, sanctions, and other statutory obligations.
• Aggregated / Anonymised Insights, Research, and Product Development: To generate statistical or aggregated insights, conduct analytics and research, model usage trends, plan capacity, evaluate platform performance, and improve or develop new features, products, and technologies.
• Personal Data will not be used for model training unless anonymised or otherwise permissible under applicable law and/or pursuant to valid contractual permission.
• Billing and Account Management: To manage billing, metering, credit balances, points, and invoicing; calculate consumption of Services; conduct usage audits; detect irregular activity; and perform other financial or account-administrative functions.

Role of the Company under the DPDP Act

• In relation to Personal Data collected directly from Users for account creation, access management, billing, communications, security, and platform operations or any other similar services, the Company acts as a Data Fiduciary under the DPDP Act.
• In relation to Personal Data contained in Customer Data uploaded, stored, or processed by Users through the Services, the Company acts as a Data Processor and processes such data solely on documented instructions of the relevant User, except where processing is required by applicable law.

Retention of Your Information

We retain personal data only for as long as necessary to fulfil the purposes outlined in this Privacy Policy, including but not limited to: service delivery, account administration, billing, analytics, security, fraud prevention, and legal or regulatory compliance. Once the applicable purpose has been fulfilled, we will either securely delete or anonymise the data, unless a longer retention period is required or permitted under applicable law.

Operational / Service Data, such as logs and telemetry, may be retained for up to 90 for security, diagnostic, and billing purposes, after which it will be securely deleted or anonymised unless retention is legally mandated. Data stored in encrypted backups or archives will be isolated from active processing and deleted in accordance with our backup retention schedule.

Unless otherwise required by law, we do not retain your Personal Data for longer than the duration of your active account with us or the duration necessary to fulfill the purpose for which it was collected. Once there is no ongoing lawful purpose or business need to retain your Personal Data, we will:

• Delete or irreversibly anonymise such Personal Data; or
• Where deletion or anonymisation is not technically feasible (e.g., stored in backup archives), we will securely store and isolate such Personal Data from further processing until deletion is feasible.

If you request deletion of your Personal Data, we will take reasonable steps to delete or anonymise it within a reasonable time period, unless retention is required to comply with applicable law or protect our legal interests.

If you request deletion of any information relating to your use of the Services, we will take reasonable steps to delete such information promptly, unless retention is required to comply with applicable law, enforce our agreements, or protect our legal rights and interests.

Nothing in this Policy restricts the Company’s right to collect, use, retain, analyse, aggregate, derive insights from, or otherwise process non-personal data, anonymised data, aggregated data, metadata, telemetry, usage statistics, performance metrics, or derivative data generated in the course of providing the Services, including for analytics, research, product improvement, security, and AI-enabled functionalities, provided that such data does not identify any Data Principal.

We periodically review our data-retention practices to ensure continued compliance with applicable laws, including the DPDP Act.

How Do We Keep Your Information Safe?

We implement appropriate, reasonable, and industry-standard technical, administrative, and organisational safeguards to protect the Personal Data we process against unauthorised access, disclosure, alteration, misuse, loss, or destruction. These safeguards include, where applicable, access-control measures, encryption in transit and at rest, secure development practices, periodic security assessments, logging and monitoring, vulnerability scanning, and employee confidentiality obligations.

We maintain internal policies, technical controls, and procedural frameworks that are reasonably designed to ensure the confidentiality, integrity, and availability of data processed through our platform. We also review and update our security measures periodically in light of evolving industry practices, regulatory guidance, and emerging threats. Where third-party service providers are engaged, we require them to follow industry standard security and restrict their access to Personal Data solely to the extent necessary for performing contracted functions.

However, no method of electronic transmission, data storage, or security system is completely infallible. While we take reasonable steps to secure the Personal Data entrusted to us, we cannot guarantee that cyber-attackers, unauthorised third parties, or other malicious actors will never circumvent our security measures or misuse your information. Therefore, any transmission of Personal Data to or from the Services is undertaken at your own risk.

We encourage you to take proactive measures to protect your Personal Data, including using strong passwords, enabling MFA/2FA where applicable, restricting access to your devices and accounts, and accessing our Services only through secure networks or environments. If you believe the security of your Personal Data has been compromised, please notify us immediately using the contact details provided in this Policy.

In the event of a personal data breach involving Personal Data governed by the DPDP Act, the Company shall notify the Data Protection Board of India and affected Data Principals, where such notification is required under applicable law, in the manner and within the timelines prescribed by law.

Sharing, Disclosure, and Transfers

We do not sell or rent Personal Data. However, we may share or disclose Personal Data under the circumstances described below, strictly in accordance with applicable Indian law, including the DPDP Act and related rules and guidance. We may share or disclose your Personal Information only in accordance with applicable law and for legitimate business purposes connected to the delivery and operation of our Services. Such disclosure is carried out under strict confidentiality, data-protection, and security obligations.

We may share Personal Information with the following categories of recipients:

• Employees, Subcontractors, and Affiliates: With authorised personnel, employees, subsidiaries, or group entities who require access on a strict need-to-know basis to assist in providing, managing, supporting, improving, or securing our Services.
• Third-Party Service Providers / Sub-Processors: We may engage third-party service providers, contractors, vendors, and sub-processors to support the operation, delivery, maintenance, and improvement of our Services. These third parties may provide services such as cloud hosting, storage infrastructure, database management, content delivery networks (CDNs), CI/CD tooling, application monitoring, analytics, billing and payments processing, customer support, and system-security services. With trusted third-party partners such as cloud-hosting providers, data-storage and database service providers, analytics tools, network service providers, deployment/integration platforms, payment processors, and other infrastructure partners that assist with operations, maintenance, delivery, and enhancement of the Services. These parties are contractually bound to maintain confidentiality and process data only under our instructions.
• We ensure that such third-party service providers and sub-processors (a) are appointed under enforceable contracts; (b) are bound by confidentiality obligations; (c) implement statutory and industry-standard technical and organisational safeguards; and (d) process Personal Data solely in accordance with our instructions and for no other purpose.
• We maintain oversight of such sub-processors and may update our vendor list from time to time as necessary to support the Services.
• AI-Based Tools / Data-Processing Systems: With authorised AI-based software tools, models, or development utilities strictly for purposes of code generation, debugging, performance optimisation, analytics, and service improvement. Wherever reasonably feasible, such data will be anonymised, pseudonymised, or aggregated so that it cannot uniquely identify you or your end-users. Personal Information will not be used to train AI models unless permitted by applicable law or contract.
• Legal/ Government / Regulatory Authorities/ Protective Disclosures: With government agencies, law-enforcement bodies, courts, regulatory entities, or other competent authorities when disclosure is required to comply with applicable laws, respond to lawful requests, enforce our rights, or protect the rights, property, or safety of the Company, our users, or the public. We may disclose Personal Data where required or permitted under applicable law, including:

• Compliance with lawful requests by government authorities, courts, regulatory bodies, enforcement agencies, or tax authorities;
• Responding to legal process, litigation, subpoenas, or arbitration requests;
• Protecting our rights, intellectual property, safety, and interests, or those of our users, employees, affiliates, or the public;
• Detecting, preventing, investigating, or responding to fraud, unauthorised access, security incidents, threats, or misuse of the Services; or
• Enforcing our contracts, terms of service, and policies.
• Where legally permissible and practicable, we will notify you of such disclosures.

Cross-Border Transfers: As part of delivering global backend, frontend, hosting, and database-management functionality, Personal Data may be stored, processed, or transferred to servers or service providers located outside India. Where such cross-border transfers occur, we ensure compliance with applicable Indian law, including the DPDP Act and relevant government notifications on international data transfer. We implement appropriate transfer safeguards, which may include:

• Contractual assurances ensuring a reasonable level of protection;
• Standard contractual clauses, data-protection terms, or equivalent mechanisms;
• Government-approved transfer frameworks; or
• Other lawful bases recognised under Indian law.

We will not transfer Personal Data outside India in jurisdictions that are expressly restricted by the Government of India and will ensure that transferred data continues to receive protection that is comparable to the safeguards afforded under this Policy and applicable law. Transfers of Personal Data outside India shall be carried out strictly in accordance with the DPDP Act and any restrictions, conditions, or notifications issued by the Government of India. Consent of the Data Principal shall not override any statutory prohibition or restriction on cross-border transfer imposed under applicable law.

Business Transfers (Mergers, Acquisitions & Reorganisation): We may share or transfer Personal Data in connection with, or during negotiations of, any merger, acquisition, financing, reorganisation, restructuring, bankruptcy, sale of assets, or similar corporate transaction. In such circumstances, we will ensure that the recipient entity assumes the obligations of this Privacy Policy or provides comparable levels of protection for the Personal Data. Where required by applicable law, we will notify you before such transfer takes effect.

Security and Storage

We implement reasonable and appropriate technical and organisational measures to protect your Personal Data from unauthorised access, loss, misuse, disclosure, alteration, or destruction. These measures include, where applicable:

• Encryption of data in transit using TLS protocols and encryption of data at rest
• Role-based access control mechanisms to restrict system access
• Multi-factor authentication (MFA), including OTP-based verification
• Secure backend, frontend, and database architecture with industry-standard security practices
• Audit logging and access monitoring to track system activities
• Regular security awareness training for employees and periodic internal security audits
• Vulnerability assessments, security testing, and defined incident-response procedures
• AI-Related security safeguards, including encryption and hashing of tokens, credentials, and passwords prior to storage in databases

Where Personal Data is processed using AI-based tools, models, or development workflows, we implement additional safeguards to mitigate privacy and security risks, including:

• Implementation of safeguards to prevent manipulation of AI systems or Large Language Models (LLMs) for unauthorised data access
• Use of anonymised or pseudonymised data wherever feasible
• Strict access controls, monitoring, and logging for AI-related data processing activities
• Model output review and validation mechanisms to prevent unintended disclosure of sensitive information
• Implementation of reasonable safeguards to prevent unauthorised third-party extraction, inference, or reconstruction of input data from AI model outputs
• Where third-party AI service providers are engaged, they are required to comply with their applicable data protection and privacy policies and contractual security obligation.

Despite these safeguards, no method of electronic transmission, storage, or AI-based processing is completely secure, and we cannot guarantee absolute security or uninterrupted availability. You remain responsible for safeguarding your credentials, granting appropriate access permissions, and ensuring secure practices within applications you build or deploy using our Services.

Data Retention

We retain Personal Data only for as long as necessary to fulfil the purposes stated in this Policy or to comply with applicable legal obligations. Retention schedules are periodically reviewed. Customer Data is processed in accordance with your instructions. Upon termination of your account, we will delete or anonymise such data in line with our data-deletion processes, subject to backup and archival policies.

Account Information

You may review, update, or delete certain information associated with your account at any time by logging into your account settings. Upon request to terminate your account, we will deactivate or delete your account and remove associated information from active databases. Some data may be retained to prevent fraud, assist with investigations, troubleshoot issues, enforce legal terms, maintain required business records, comply with applicable law.

We disclaim liability for security incidents that occur due to circumstances beyond our reasonable control.

Special Considerations for Backend / Frontend / Database Services

Nature of Information Received Through Database Management

In the course of your use of our database-management, hosting, and application-development Services (“ DB Services”), you may upload, transmit, store, or otherwise make available information that you control. Such information may include structured or unstructured datasets, database tables, schemas, logs, files, metadata, configuration details, analytics outputs, or other content relating to your customers, employees, end-users, suppliers, or any other individuals whose information you lawfully hold.

This information may be (i) stored on our thirdparty hosting infrastructure when you provision database instances or deploy applications, or (ii) shared with us as part of technical support, troubleshooting, migration, onboarding, or related service engagements.

Where you determine the purpose and means of processing such information, you act as the Data Fiduciary, and we process such information as your Data Processor. Where you handle such information on behalf of a third party, you acknowledge that such information has been lawfully collected and made available to us for purposes associated with your use of the Services.

For purposes of this Policy, “Operational Data” means any information, including Personal Data, that you or your organization submit to, store on, or process through our database-management systems, hosting infrastructure, APIs, development environments, or related Services. Operational Data also includes information voluntarily shared during technical-support requests, such as diagnostic files, database exports, log captures, sample datasets, or similar material provided to facilitate issue resolution.

Operational Data excludes telemetry, diagnostic, machine-generated metadata, usage analytics, performance metrics, or similar information used to maintain, secure, enhance, or develop the Services.

You retain ownership and control of Operational Data at all times.

How We Use Operational Data

We process Operational Data solely in accordance with your instructions, lawful purposes permitted under applicable Indian law, including the DPDP Act, and the contractual terms governing our Services. We may process Operational Data for the following purposes:

• provisioning, operating, and maintaining database and application-hosting functionality;
• performing actions you initiate through the Services, including executing queries, storing, retrieving, or modifying database content;
• providing troubleshooting and diagnostic support;
• enabling configuration assistance, import/export support, and migrations;
• securing the infrastructure and preventing fraud or misuse; and
• ensuring compliance with legal or regulatory obligations.

For example, when you import Operational Data into your managed database instance, we store and process that data to support your operations; if you contact us for technical assistance relating to data-integrity or query-execution issues, we may use relevant portions of Operational Data to identify and resolve the issue. We do not use Operational Data for advertising, profiling unrelated to the provision of Services, or other independent commercial purposes.

Push Notifications

If you enable notifications within our desktop, we may deliver such notifications through third-party service providers. Notifications may be managed through your device or application settings at any time.

Who We Share Operational Data With

• Affiliates and Sub-Processors: To provide database-management, hosting, and support services, we may engage group entities and authorised third-party sub-processors. Such entities may access Operational Data strictly for the purposes described in this Policy and are bound by confidentiality and data-protection obligations consistent with Indian law.
• Personnel and Authorised Contractors: We may provide limited access to Operational Data to trained personnel and authorised contractors solely to perform tasks such as diagnosing technical issues, carrying out maintenance, or fulfilling your instructions. Access is controlled, logged, restricted to specific individuals, and governed by confidentiality obligations.
• Collaborators and Other Users: Where you set permissions enabling shared database environments, collaboration, or workspace-level access, Operational Data may be accessible to authorised collaborators based on the rights and roles you configure. You are responsible for assigning and managing such access permissions.
• Third-Party Integrations Selected by You: If you enable integrations with third-party products or services, you may authorise such third parties to access Operational Data or Service Data or related Personal Data. Their processing will be governed by their respective privacy practices, and we encourage you to review such policies before enabling integrations.

We may otherwise share Operational Data only in accordance with applicable law or as described in this Policy.

Retention of Operational Data

We retain Operational Data for as long as you maintain an active account or as necessary to provide the Services, unless a longer retention period is required to comply with applicable Indian law. Upon account closure or deletion request, Operational Data will be removed from active systems in accordance with our scheduled deletion processes. Backup copies may persist for a limited time in accordance with our backup-retention schedule and will then be securely deleted.

Data Principal Requests

Where we process Operational Data on your behalf, we act as a Data Processor and are not authorised to fulfil Data Principal rights requests (such as access, correction, erasure, or grievance). Such requests must be made directly to you, as the Data Fiduciary.

Upon receiving a lawful request from you for support in fulfilling a Data Principal request, we will provide reasonable assistance in accordance with our contractual commitments and technical feasibility.

Public Applications and Replication

Where you choose to make an application, template, workflow, or similar asset created using the Services publicly available on the platform, other users may be permitted to clone or replicate such application. In such cases, only the structural or functional components of the application (such as configurations, workflows, or schemas) may be replicated as a template or replica. No Personal Data, account information, credentials, or private data associated with the original creator will be shared or made accessible to other users through such cloning or replication. Ownership of any such replica shall vest with the user who creates the clone, while you shall continue to retain ownership of your original application.

Children’s Data

Our Services are not intended for use by individuals under eighteen (18) years of age. We do not knowingly collect, process, or store personal data belonging to minors. If you are a parent or legal guardian and believe that your child has provided Personal Data to us without your consent, please contact us at support@projectcode.dev. Upon becoming aware that we have inadvertently collected Personal Data belonging to a minor without verifiable parental consent, we will take appropriate steps to delete or anonymise such data in a timely manner.

Where processing of a minor’s Personal Data is legally permitted (e.g., via appropriate parental/guardian consent), we will handle such data strictly in compliance with applicable Indian law, including the DPDP Act.

Your Rights, Controls and Choices

You have certain rights over your Personal Data under the DPDP Act and other applicable Indian laws. These rights are designed to give you greater transparency and control over how your data is collected and processed by us. Subject to applicable law, you have the following rights in relation to your Personal Data:

• Right to Access and Information: You have the right to obtain a summary of your Personal Data being processed by us, the categories of such data, and the purposes for which it is being used.
• Right to Correction and Erasure: You have the right to request correction, completion, updating, or deletion of your Personal Data where it is inaccurate, incomplete, outdated, or no longer necessary for the purposes for which it was processed.
• Right to Nominate: You may nominate another individual who can exercise your data rights in the event of your death or incapacity, in accordance with Section 14 of the DPDP Act.
• Right to Withdraw Consent: You have the right to withdraw your consent to the processing of your Personal Data at any time. Upon such withdrawal, we will cease processing such data unless required by law or for compliance, fraud prevention, or legal claims.
• Right to Grievance Redressal: You have the right to register a grievance regarding our data-handling practices or actions related to your Personal Data. We will acknowledge and respond to your grievance within the timeframes prescribed by Indian law.
• Right to Be Informed: You are entitled to be informed of the purposes for which your Personal Data is processed, the categories of data collected, the rights available to you, and how you may exercise those rights.
• How to Exercise Your Rights: You may exercise these rights by contacting our Grievance Officer or using the contact details provided below:
• We may request proof of identity to verify your request. Once verified, we will act on your request within the period required by law, unless an extension is justified under lawful grounds.

Please note that these rights are subject to statutory exceptions and limitations under applicable Indian laws, including for purposes such as compliance with legal obligations, law enforcement, prevention of fraud, or the protection of national security and public interest.

The exercise of these rights does not affect our right to retain certain data where retention is necessary for compliance, dispute resolution, or other legitimate purposes permitted under law.

How to Exercise Your Rights

You may submit a request by contacting us at: support@projectcode.dev. Please provide sufficient information to verify your identity. We will acknowledge and respond to your request within a reasonable timeframe and in accordance with applicable Indian law. We may ask for additional information to verify your identity before fulfilling certain requests. Certain requests may be denied where permitted under law (e.g., ongoing legal claims, investigation, compliance requirements, security incidents, pending contractual obligations). If you disagree with our handling of your Personal Data, you may approach the competent Indian authority under the DPDP Act or other applicable jurisdictional authority.

Cookies and Tracking Technologies

We and our third-party partners use cookies, pixels, software development kits (SDKs), artificial-intelligence-assisted analytics tools, and similar tracking technologies (“Cookies”) to operate, secure, personalise, and analyse our Services. These technologies help us understand usage patterns, improve functionality, and provide a seamless user experience across global regions.

Types of Cookies and Similar Technologies We Use

• Strictly Necessary Cookies: Essential for core platform operations, including authentication, routing, security (e.g., fraud prevention, bot-mitigation), and consent management. These cannot be turned off via user controls.
• Analytics and Performance Cookies / AI-Assisted Analytics: Used to measure usage, diagnose performance issues, and improve features. We may also use AI-based analytics tools to detect anomalies or performance degradation; assess feature usage trends; improve user workflows and onboarding; generate aggregated insights. Such tools generally process aggregated or pseudonymised data, and we do not use identifiable personal data for AI model training unless permitted by applicable law and/or explicit user consent.
• Functional Cookies: Enable user preferences such as UI layout, region, and language. Disabling them may limit customisation.
• Marketing & Advertising Cookies: Used to measure campaign performance, improve ad relevance, support cross-site remarketing/retargeting (where applicable). These may be provided by third parties such as Google, Meta, and others. You may opt-out of non-essential marketing Cookies.

Depending on your jurisdiction or legal basis requirements, we may request consent before enabling such Cookies.

Managing Cookies & Consent

You may manage or withdraw Cookie preferences via our Cookie Settings panel (where available), browser controls, supported automated privacy signals (e.g., GPC), disabling non-essential Cookies may affect feature performance or personalization but will not restrict core platform functionality.

Use of Third-Party Tracking Technologies

We may allow approved third-party service providers to use Cookies and related technologies to perform analytics, AI inference, or deliver insights, provide ads or sponsored content (if enabled), measure cross-site behaviour, support customer service or diagnostics.

These providers may process data independently for their own purposes in accordance with their privacy policies. You are encouraged to review those policies directly.

Use of AI-Enabled Tools

We may use AI-enabled systems (internal or third-party models) to detect automated abuse (e.g., bots, DDoS patterns); improve platform telemetry and reliability; analyse anonymised or aggregated usage data; enhance product performance or generate insights. Where AI systems are employed, we avoid using identifiable personal data for training without legal basis, apply data minimisation and anonymisation where technically feasible, implement contractual and security safeguards for AI vendors. You remain responsible for ensuring lawful processing of end-user data uploaded to your applications.

Disclaimer Regarding AI-Generated Code and Services

Our Services may include tools, code suggestions, automations, or other functionality powered by artificial intelligence (“AI Products”). These AI Products are designed to assist development and operational workflows (including code generation, drafting logic, and automation), but are not a substitute for professional software engineering, architectural review, or security assessment. You remain solely responsible for:

• Reviewing, testing, and validating any AI-generated code, configuration, logic, or deployment-related output;
• Ensuring such output does not introduce security vulnerabilities, legal non-compliance, or operational failures; and
• Maintaining all required administrative, technical, and organizational safeguards appropriate to your use case.

We make no representations or warranties (express or implied) regarding the correctness, completeness, security, suitability, or performance of any AI-generated output. AI-generated output may be inaccurate, incomplete, biased, or unsafe if used without review.

To the maximum extent permitted by law, we disclaim liability for any damages arising from or in connection with reliance on AI-generated output.

Third-Party AI Service Providers & Data Processing

We provide certain AI Products through third-party service providers (“AI Service Providers”), which may include OpenAI, Anthropic, Google Cloud AI, and others. As described in this Privacy Policy, your inputs, outputs, prompts, generated content, and personal information may be shared with and processed by these AI Service Providers to operate and improve the AI Products. These AI Service Providers may process data in multiple jurisdictions. Their processing is subject to their respective privacy notices, security controls, and terms.

You must not use the AI Products in any manner that:

• Violates this Policy or applicable law,
• Violates the terms or policies of any AI Service Provider,
• Attempts to re-identify individuals from anonymized data,
• Involves unlawful, harmful, or high-risk activities without appropriate human oversight, or
• Attempts to bypass safeguards, security controls, or usage-limits imposed on the AI Products.

Intended Purpose of AI Products: Our AI Products are designed for-

• AI-supported code suggestions and generation
• Developer workflow automation
• Pattern recognition and optimization
• Data-assisted configuration or integration recommendations
• Other reasonable use cases within application development, deployment, and operations

They are not intended for critical-infrastructure control systems, medical diagnosis, legal advice, financial advisory, or other regulated or high-risk decision-making without appropriate human expert validation.

Intellectual Property Ownership, AI-Generated Output

How Can You Review, Update, or Delete the Data We Collect from You?

Under applicable Indian law, including the DPDP Act, you may exercise certain rights regarding your personal data processed by us. These include the right to:

• Request access to personal information we hold about you and details of how we process it;
• Request correction of inaccurate or incomplete personal information;
• Request deletion of your personal information, subject to legal or contractual limitations;
• Withdraw consent where processing is based on your consent.

To submit a request to review, update, or delete your personal information, please contact us at:

Email: support@projectcode.dev

We may request additional information to verify your identity before processing your request. We aim to respond within applicable statutory timelines under Indian law. Certain data may be retained as permitted or required by law (e.g., accounting, fraud-prevention, regulatory compliance).

Deleting your information may affect your ability to access or use parts of the Services. If you are an end-user of a customer application built using our platform, we may direct your request to the relevant customer (data controller).

If you are unsatisfied with our response, you may escalate the matter to our designated Grievance Officer or the competent Data Protection Board of India.

Payment & Billing

We use third-party payment processors to process payment card details and transactions. We do not store full payment card details on our systems. Card processing is subject to the processor’s security and privacy policies (including PCI-DSS compliance, where applicable).

We may receive limited transaction information, such as payment confirmation, masked card details, reference identifiers, or billing metadata, for billing, reconciliation, fraud-prevention, and tax purposes.

We may also aggregate anonymised usage metrics (e.g., spend amounts, invoice status) from the payment processor for internal accounting and reporting.

Usage-Based Billing: You authorise us to collect usage metrics associated with your use of the Services including API calls, compute hours, storage, bandwidth, and log volumes. These metrics may be shared with payment processors and financial institutions for invoicing, revenue recognition, and compliance reporting.

Payment Data Collected: If you make a purchase, we may collect limited payment-related data, such as, payment instrument type (e.g., card, UPI, wallet), masked card number, expiry month/year, transaction amount, currency, date, status, billing name and address, GST or tax identification details. We do not store full card numbers or CVV/CVC. Full payment data is handled solely by the payment processor. GST and billing details may be used to generate tax-compliant invoices.

International Payments & Cross-Border Data Transfers: Where you make payments from outside India or where our payment processor operates globally, your payment information (including payment metadata, billing address, transaction identifiers, and currency details) may be transferred, processed, or stored outside India, including in jurisdictions that may have different data-protection laws.

As on the date of this Policy, the Government of India has not notified any restricted countries or territories for the purposes of cross-border transfer of Personal Data, and India currently follows a negative list approach, under which transfers are permitted unless expressly prohibited by law.

In the event that the Government of India notifies any restricted jurisdictions or imposes additional conditions on cross-border transfers, the Company shall comply with such requirements and update this Policy accordingly. Data Principals shall be informed of material changes to cross-border transfer practices through updates to this Policy or such other lawful means as the Company may adopt. Consent of the Data Principal shall not override any statutory restriction or prohibition on cross-border transfer imposed under applicable Indian law.

We ensure that such transfers comply with applicable Indian laws, including the DPDP Act, which permits transfer of digital personal data outside India subject to government-notified restrictions. Where required, we implement appropriate contractual or organisational safeguards to ensure an industry standard level of protection for such data. Your payments may also be subject to:

• Cross-border financial regulatory requirements
• Fraud monitoring
• Sanctions, anti-money-laundering, and export-control checks

By initiating an international transaction, you acknowledge and consent to the cross-border processing of relevant payment-related data.

Chargebacks & Refunds: Any refunds, cancellations, chargebacks, or payment disputes relating to the Services shall be governed by the Company’s Refund Policy ↗.

Do-Not-Track (DNT) Signals

Some web browsers and mobile applications provide a “Do-Not-Track” (DNT) setting that allows users to indicate a preference not to have their online activities monitored across websites over time.

At this time, India does not have a legally recognized or standardized framework for responding to DNT signals. Consequently, our Services do not currently respond to DNT signals or similar browser-based preference mechanisms. If a legal, regulatory, or technical standard governing online tracking is adopted in India in the future and requires us to take action, we will comply with such requirements and update this Privacy Notice accordingly.

Entire Agreement

This Policy, together with our Terms of Service constitutes the entire and exclusive agreement between you and the Company regarding privacy, data-protection, and data-processing matters relating to the Services in India and, where applicable, in other jurisdictions.

In the event of any conflict or inconsistency between documents relating to privacy or data-processing obligations, the following order of precedence shall apply:

• This Privacy Policy
• Terms of Service

For avoidance of doubt, the DPA governs the processing of personal data where we act as a processor or sub-processor on your behalf. This Policy governs how we collect, use, disclose, secure, and retain personal data processed in connection with the Services.

AI-related processing (including use of third-party AI service providers) shall be interpreted in accordance with the DPA and this Policy.

Any additional or conflicting terms proposed by you, such as purchase orders, email terms, or other documents are rejected unless expressly agreed in writing and signed by an authorized representative of the Company. No oral statements or marketing materials shall modify any agreement relating to the privacy or processing of personal data.

Governing Law & Venue

This Policy shall be governed by and interpreted in accordance with the laws of India.

Any dispute arising out of or in connection with this Policy, including disputes relating to Personal Data processed through traditional or AI-enabled workflows, shall be subject to the exclusive jurisdiction of the courts of Ahmedabad, Gujarat, India.

Changes to This Policy

We may revise, update, or amend this Privacy Policy from time to time to reflect changes in our Services, the introduction of new features or technologies (including artificial intelligence-based functionality), internal governance adjustments, industry best practices, or changes to applicable laws and regulatory guidance in India or other relevant jurisdictions.

Whenever updates are made, we will post the revised Policy on our website and update the “Last Updated” date at the top of the document. Please review this Privacy Policy periodically to remain informed about how we collect, use, disclose, and protect your Personal Data.

Where a revision materially affects your rights, materially alters the manner in which we process your Personal Data, or significantly expands our data-processing activities, we will provide advance notice, where required under applicable law, by e-mail notifications, in-product banners or pop-ups, any other legally permissible method.

Contact Details & Grievance Officer

If you have questions or concerns about this Policy, including how we use AI technologies to process Personal Data, or if you wish to exercise any of your rights, you may contact us at:

Email: grievance@projectcode.dev

Address: 5th Floor, House 14, Times Corporate Park, Opp. Copper Stone Flats, Thaltej, Ahmedabad, Gujarat, India, 380059

We aim to respond to verified requests within a timeline as required under applicable laws.

If you believe that your data, whether processed through traditional or AI-enabled workflows has been improperly handled or requires correction/deletion, please reach out to us. We will investigate and take appropriate steps as required under applicable law.

Conclusion & Acceptance of Terms

We are committed to safeguarding your personal data and ensuring that it is processed responsibly, transparently, and in accordance with applicable laws in India and other relevant jurisdictions. As our Services may include global infrastructure, cross-border operations, and AI-enabled features, you acknowledge that your continued use of the Services constitutes acceptance of the practices described in this Privacy Policy.

If you do not agree with any provision of this Privacy Policy, you should discontinue use of the Services. We encourage you to review this Policy periodically to stay informed of updates, particularly relating to advancements in our AI-based capabilities, changes in regulatory requirements, and modifications to our data-handling practices.

If you have questions, require clarification, or wish to exercise your rights, please contact us using the information provided above. We remain committed to addressing your concerns and supporting your privacy needs.