Last updated: 27 September 2026
1. Who we are
Storm Code ("we", "us") is a software studio based in Bhagalpur, Bihar, India. For the personal data described here we are the Data Fiduciary under the DPDP Act. Contact us about anything in this policy at stormcode.in@gmail.com or +91 73773 34604.
2. What we collect and why
| Data | When | Purpose |
|---|---|---|
| Name, email, and optionally phone, company, service of interest, budget range and your message | You submit the contact form | To reply to your enquiry, understand your project and send a quote |
| Your consent record (date and time you agreed to this policy) | You submit the contact form | To show that we collected your data with consent, as the DPDP Act requires |
| Anything you send us by email, phone or WhatsApp | You contact us directly | To answer you and, if you become a client, to deliver the project |
| Pages visited, device and browser type, approximate location, analytics cookie IDs | Only if you click "Accept analytics" | To understand which pages are useful (Google Analytics). Never used for advertising |
| Billing name, address and GST details (clients only) | When we invoice you | To issue invoices and meet tax law |
We collect only what is needed for these purposes. We do not sell or rent personal data, we do not use it for advertising, and we do not send marketing messages unless you separately ask us to.
3. Legal basis
We process your data on the basis of the consent you give when you submit the contact form or accept analytics (Section 6 of the DPDP Act), and for legitimate uses allowed by Section 7, such as data you voluntarily provide for a specific purpose and data we must keep to comply with law.
4. Who processes data for us
We use a few trusted service providers (Data Processors) who handle data only on our instructions:
- Web3Forms delivers contact form submissions to our inbox.
- Google (Gmail and Google Workspace) hosts our email.
- Google Analytics measures site usage, only after you accept analytics.
- Cloudflare hosts and serves this website and protects it from attacks.
These providers may store data on servers outside India. Such transfers are permitted under Section 16 of the DPDP Act, and we do not transfer data to any country the Government of India has restricted.
5. Client project data
When we build software for a client, we may access personal data that belongs to the client's customers or staff. In that case the client is the Data Fiduciary and we act as their Data Processor: we use that data only to deliver the agreed work, keep it confidential, and return or delete it when the project ends.
6. How long we keep data
- Enquiries that do not become projects: deleted within 24 months of our last conversation.
- Client records and invoices: kept for 8 years, as Indian tax law requires.
- Analytics data: kept for up to 14 months, then deleted automatically by Google Analytics.
- Your consent record: kept as long as we hold the data it covers.
If you withdraw consent or ask us to erase your data, we delete it unless the law requires us to keep it.
7. Your rights
Under the DPDP Act you can:
- Get a summary of the personal data we hold about you and how we use it.
- Ask us to correct, complete or update it.
- Ask us to erase it.
- Withdraw consent at any time, as easily as you gave it: email us, or use Cookie settings in the footer for analytics. Withdrawal does not affect processing that happened before it.
- Nominate another person to exercise these rights if you die or become incapacitated.
- Raise a grievance with us and, if unresolved, complain to the Data Protection Board of India.
To use any of these rights, email stormcode.in@gmail.com. We may ask you to confirm your identity, and we reply within 30 days.
8. Grievance contact
Questions or complaints about your personal data: Grievance Contact, Storm Code, Bhagalpur, Bihar, India. Email stormcode.in@gmail.com, phone +91 73773 34604. If you are not satisfied with our response, you can approach the Data Protection Board of India.
9. Security
The site is served only over HTTPS, form submissions are encrypted in transit, and access to enquiries and client data is limited to the people working on your request. If a personal data breach occurs, we will inform affected people and the Data Protection Board of India as the DPDP Act and its Rules require.
10. Children
This site and our services are meant for businesses and adults. We do not knowingly collect personal data from anyone under 18. If you believe a child has sent us their data, email us and we will delete it.
11. Cookies
See the Cookie Policy for the exact list of cookies and browser storage the site uses.
12. Changes to this policy
If we change how we use personal data, we will update this page and the date above. For significant changes we will ask for fresh consent where the law requires it.