Privacy Policy

We ask for your details so that a person can reply to you about survey equipment. That is the whole purpose. This page sets out exactly what we collect, why, who else sees it, how long we keep it, and how you get it deleted.

Who is responsible for your data

Dragonfly Labs ("Dragonfly", "we", "us") is the Data Fiduciary under the Digital Personal Data Protection Act, 2023, and the Data Controller for the purposes of the UK and EU GDPR.

Registered address: New Delhi, India
Contact for privacy questions: prashantkr2804@gmail.com
Grievance Officer / authorised representative: Prashant Kumar, Founder, prashantkr2804@gmail.com

What we collect

When you submit a form

Only what you type, plus a little context about where you came from:

Name, and organisation if you give one
Email address
Phone or WhatsApp number, if you give one
City or country, if you give one
What you tell us you are trying to solve
Which use case you selected
The page you submitted from, the site that referred you, and any campaign parameters in the link you followed
The date and time of submission

Name and email are required because we cannot reply without them. Everything else is optional and the form works without it.

When you simply browse

We use Ahrefs Web Analytics, which is cookie-free and does not build a profile of you. It reports aggregate figures — pages viewed, country, referring site, device type — and does not store data that identifies you personally. We set no advertising cookies and no tracking cookies, which is why this site shows you no cookie banner. If we ever add a tool that needs cookies, we will ask you first.

Our hosting provider, Vercel, processes standard server request logs, including IP addresses, for the short period needed to serve the site securely and defend against abuse.

Why we process it, and on what basis

Purpose	Basis (DPDP Act)	Basis (GDPR)
Replying to your enquiry, sending the price sheet, arranging a demonstration	Your consent, given when you submit the form	Art. 6(1)(b) steps prior to a contract, and Art. 6(1)(f) legitimate interest in responding to a business enquiry
Following up about the pilot programme	Your consent	Art. 6(1)(f) legitimate interest
Keeping the site secure and preventing form abuse	Legitimate use	Art. 6(1)(f) legitimate interest
Understanding aggregate site usage	Not personal data — aggregate only	Not personal data — aggregate only

We do not sell your data. We do not share it with advertisers. We do not add you to a marketing newsletter without asking. If we ever want to use your details for something other than the purpose above, we will ask for fresh consent.

Who else processes it

We use a small number of established service providers, each bound to process data only on our instructions:

Google (Google Sheets) — stores enquiries. Servers may be outside India.
Apollo.io — our customer relationship system, so a follow-up does not get lost. Servers in the United States.
Resend — sends us the notification email that alerts us to your enquiry.
Vercel — hosts the website and runs the form endpoint.
Ahrefs — aggregate, cookie-free web analytics.

Cross-border transfer. Some of these providers store data outside India, and outside the European Economic Area. Where we transfer personal data internationally we rely on the providers' standard contractual clauses and equivalent safeguards. The DPDP Act permits transfer other than to countries the Central Government restricts; we will stop using any provider that becomes non-compliant.

How long we keep it

Enquiries: up to 36 months from our last contact with you, then deleted. If you tell us you are not interested, we delete sooner.
Server logs: retained by our host for a short operational period only.
Analytics: aggregate only, never tied to you.

If you ask us to delete your data, we delete it from the spreadsheet and from Apollo, and we confirm when it is done.

Your rights

Whoever and wherever you are, you can ask us to:

Tell you what we hold about you and who we have shared it with
Correct or complete anything inaccurate
Erase your data
Withdraw your consent — as easily as you gave it, and with no consequence other than that we stop contacting you
Nominate another person to exercise these rights on your behalf if you die or become incapacitated (a right specific to the DPDP Act)
Object to, or restrict, processing, and receive your data in a portable form (rights under GDPR, which we extend to everyone)

To exercise any of these, email prashantkr2804@gmail.com with the word "privacy" in the subject. We respond within 30 days, usually far sooner because there are not many of us and it does not take long.

If you are unhappy with our response

Tell our Grievance Officer first, at prashantkr2804@gmail.com — we would rather fix it ourselves. If that does not resolve it, you may complain to the Data Protection Board of India. If you are in the EEA or the UK, you may also complain to your local supervisory authority.

Security

The site is served only over HTTPS. Form submissions are sent to our own endpoint, validated server-side, rate-limited, and stored in access-controlled systems. Credentials are held as encrypted environment variables and never appear in the website's code. No system is perfectly secure, and we will not claim otherwise — but if a personal data breach occurs we will report it to the Data Protection Board within 72 hours of becoming aware, and tell affected individuals directly, as the DPDP Rules require.

Children

This site is intended for surveying and mapping professionals. It is not directed at children, and we do not knowingly collect data from anyone under 18. If you believe a child has submitted their details, tell us and we will delete them.

Automated decisions

We do not make automated decisions with legal or similarly significant effects about you. A person reads every enquiry.

Changes

If we change this policy we will update the date at the top. If a change is significant — a new purpose, a new category of data, a new recipient — we will tell anyone whose data we hold before it takes effect.