Privacy policy.

Who we are

Sattyam Jain, an individual (India), operating as Provael - the controller for this website is the individual maintainer. A private limited company is being incorporated in Ahmedabad; from its incorporation (expected January 2027) paid contracts are with the company. Until then the counterparty is Sattyam Jain, an individual (India), operating as Provael. Contact: hello@provael.com.

What we collect

• Analytics. Two things, both cookieless, neither building a profile of you, so there is no consent banner. Cloudflare Web Analytics, when the operator enables it for this site, records page views and Core Web Vitals at the edge without cookies or cross-site identifiers.

  Separately, the site itself counts five events by name only - install command copied, a link into our GitHub followed, the request form sent, a checkout started, a call booked - as one integer per event per day in Cloudflare KV: no cookie, no identifier, no IP address, no page path, nothing that can be traced back to a visit. Browsers sending Do Not Track or Global Privacy Control are not counted at all. Nothing counted this way is published as a figure on any page.

• Repository lookup. When you hover over or focus the GitHub star control, the site reads the project’s star count from GitHub’s public API. That request sends your IP address and browser user-agent to GitHub; no cookie is set and we store nothing from it. It does not run on page load.

• The contact form. If you submit the form on /contact, the request form on the homepage or the readiness snapshot, we receive the fields you enter (name, work email, company, stack, milestone, what you want to prove, role and a message), the offer you chose (the form's intent), the form's own tag (source) and the path of the page it was on (page, read from the referrer, this site only), together with your country as derived by Cloudflare from your IP address and the time of submission (the browser user-agent was stored until 20 September 2026 and read by nothing; it is no longer kept).

  The submission is written to a Cloudflare KV store, forwarded to our lead backend on Amazon Web Services (a DynamoDB table in the us-east-1 region), and, when that path is configured and the submission came from a browser on this site, emailed to us through Resend (a submission whose request carries no evidence of the page is stored but not emailed, because automated submissions were filling that inbox). To limit abuse, a per-IP counter of submissions is kept in Cloudflare KV for two hours. If none of these capture paths succeeds, the page offers a pre-filled email instead and nothing is stored.

  One person - the maintainer - reads the submissions. The form is for compatibility information only: do not paste checkpoints, tokens, traces or proprietary prompts into it.

• A managed engagement. Nothing about your policy is collected through this website. In a Checkpoint Report or assessment the default is execution inside your environment or against an endpoint you host; any transfer of a checkpoint or traces is a written decision under the rules-of-engagement letter and the DPA, over a channel you approve, kept in the agreed environment the work order names, and deleted within 30 days of final delivery unless you instruct otherwise. The full data flow, per path, is on /trust.

• Newsletter. If you subscribe, your email address goes to Buttondown, which stores it and sends the newsletter. Every issue carries an unsubscribe link, and you can ask us to delete the address at any time.

• Email you send us. If you email us, we process the contact details and message you provide to respond.

• Booking. The booking buttons open Cal.com, which processes the name, email, time and any notes you enter to arrange the call.

We do not collect special-category data, and we do not sell personal data.

Legal basis (GDPR)

• Legitimate interest for aggregate, cookieless analytics that cannot identify you, and for the five first-party event counters, which identify nobody.
• Steps prior to entering into a contract, at your request, for the form on this site and for scoping calls; performance of the contract for an engagement.
• Legitimate interest in answering you and keeping a record of what was asked and promised, for the retention period below.

Subprocessors

This is the same list published in the diligence packet at /trust; the two pages render one source.

• Cloudflare (Global edge; form data lands in the stores below) - Hosts and serves this website; runs the server-side functions behind the contact form and the five first-party event counters (one integer per event name per day in KV); Web Analytics at the edge when enabled, cookieless. Touches: Website traffic metadata, the fields you type into a contact form in transit, and event names with no identifier attached.
• Amazon Web Services (US (us-east-1)) - Durable store for contact-form submissions (the operated lead backend). Touches: Name, email, organisation and the message you submit. No assessment data, ever.
• Resend (US) - Email delivery for contact-form notifications, used as a fallback capture path. Touches: The same contact-form fields, in an email.
• GitHub (US) - Source hosting, CI, issue tracking and release publishing. Touches: Public source and public issues. Nothing customer-confidential is placed here.
• PyPI (US) - Distributes the open-source package. Touches: Nothing of yours. Your installs are visible to PyPI as anonymous download counts.
• Cal.com (EU/US) - Scheduling for a scoping call: the booking buttons open a Cal.com page. Touches: The name, email, time and any notes you enter to book a call.
• Buttondown (US) - Sends the email newsletter you can subscribe to on this website. Touches: The email address you subscribe with. Every issue carries an unsubscribe link.
• Plausible / PostHog (EU (Plausible) / US (PostHog)) - Cookieless website analytics, environment-gated and off unless configured. Touches: Aggregate page-view data. No cookies, no cross-site identifiers.

• GitHub (Microsoft, United States) also receives the star lookup described above.
• Analytics (Plausible / PostHog) - not enabled on this deployment. If either is switched on, it is listed here with the endpoint it sends to.
• Cal.com - assessment-call scheduling (loaded only when you choose to book).

Retention

Analytics are aggregate and not tied to you; the event counters hold a number per day and nothing else, for 400 days.

Contact-form submissions expire automatically 730 days after they are received, in both the Cloudflare KV store and the AWS lead backend. Why two years and not one: a request about a robot policy typically arrives a year or more before the deployment or audit gate it concerns, and when the conversation resumes the record of what was asked and what was promised has to still exist; a shorter period would delete the context of a live enquiry.

The per-IP rate-limit counter expires after two hours. Emails you send us are kept only as long as needed to respond and to meet legal obligations, then deleted.

You can ask for earlier deletion at any time (see your rights below), and a request we know has ended is deleted on request without argument.

Your rights

Under the GDPR and the DPDP Act you may request access, correction, erasure, restriction, portability, or object to processing, and you may withdraw consent. Email hello@provael.com and we will respond within the statutory timeframe. EU/EEA users may also complain to their supervisory authority.

International transfers

We are based in India, which is not the subject of an EU adequacy decision. Data you type into this site’s forms goes directly from you to us, a controller outside the EU.

Under the EDPB’s Guidelines 05/2021 on the interplay of Article 3 and Chapter V, a disclosure made directly by the data subject to a non-EU controller is not a “transfer” in the Chapter V sense, so no Standard Contractual Clauses apply to it — this page used to say they did, and that was wrong. What protects it instead is the GDPR itself where it reaches us under Article 3(2), the lawful bases above, this notice, and the rights below.

Standard Contractual Clauses (Module 2, controller to processor) with the UK International Data Transfer Addendum are what we sign when an engagement puts your data in our hands as a processor; they are part of the DPA template.

Our onward transfers to processors are transfers, and are covered. Contact-form submissions are stored on Amazon Web Services in the United States (us-east-1) and, when that path is configured, emailed through Resend (United States); GitHub (Microsoft) is United States based, so the repository lookup described above involves a transfer to the US. Each is made under the transfer mechanism that processor publishes for EU/UK data (Standard Contractual Clauses), supported by a transfer-impact assessment.

Moving the lead store out of us-east-1 is an open item on the backend, noted here rather than promised with a date. Analytics endpoints are set per deployment, so the processing region is whichever host the subprocessor list names - not guaranteed to be the EEA.

India: the DPDP Act

The Digital Personal Data Protection Act, 2023 applies to us as a data fiduciary. Its substantive provisions — sections 3 to 17 (notice, consent, the obligations of a data fiduciary, the rights of a data principal) and sections 27 to 34 among others — come into force on 13 May 2027, eighteen months from the commencement notification of 13 November 2025 (G.S.R. 843(E), read in the Gazette text on 20 September 2026); sections 18 to 26 and the Board provisions are already in force. We are not waiting for the date.

Grievance contact: Sattyam Jain, hello@provael.com, who answers a grievance within the period the Rules prescribe and in any case within 30 days.

Breach: if personal data we hold is breached, we notify the affected data principals and the Data Protection Board of India without delay, and provide the full account within 72 hours of becoming aware.

Data principals may exercise the rights above by email; the same address serves as the consent-manager-free withdrawal route, since we hold no consent-based processing beyond what this page states.

EU/UK representative

Provael is a small, non-EU open-source project. We will appoint a GDPR Article 27 representative in the EU (and a corresponding representative under the UK GDPR) if and when our processing of EU or UK personal data reaches a level that requires one. Until then, EU and UK data subjects may exercise their rights and raise any concern directly with us at hello@provael.com, and may also complain to their local supervisory authority.

Changes

We will update this page as our processing changes and revise the effective date.

Provael is built and maintained by one person. That is a real dependency for anything you rely on. The tool is Apache-2.0 and can be forked, and every result can be reproduced from a committed recipe, so evidence you already hold stays valid if the project stops. One person cannot offer a service level, so none is published.

These are standard terms provided in good faith and are not a substitute for legal advice.