Privacy Policy

Last updated 28 September 2026.

This policy explains what Elevare Designs ("we", "us") collects when you use elevaredesigns.com or work with us, why we collect it, who else handles it, how long we keep it, and what you can ask us to do. It applies wherever you are. Where the law of your country gives you more rights than this page describes, you have those rights too.

Who we are

Elevare Designs is a design and software studio based in India, run by Krishom Sharma. For the purposes of India's Digital Personal Data Protection Act, 2023, we are the Data Fiduciary for the personal data described here. Under the EU and UK GDPR we are the controller.

Contact for anything on this page: info@elevaredesigns.com, +91 99152 68969, Thakurdwara, District Kangra, Himachal Pradesh, India. Our Grievance Officer is named on the Grievance Redressal page.

What we collect

When you send an enquiry (the form on the home page, the package builder, the festive offer page or the demo sites page) we receive what you type: your name, email address, phone or WhatsApp number, business name, the service and budget you choose, any package you build, and your message.

Alongside it we record the page you sent it from, the date and time, your browser's user-agent string, and a one-way hash of your IP address. The hash lets us spot and block spam without storing your actual IP address.

When you become a client we also hold what is needed to do the work and bill for it: contact people, project files and content you send us, invoices, payment records and, for Indian clients, GST details.

When you message us on WhatsApp or email, we have the messages and whatever you attach.

When you browse the site we do not use advertising trackers. If analytics is switched on, Google Analytics runs only after you accept it in the cookie banner. See the Cookie Policy.

We do not ask for, and do not want, sensitive information such as health data, financial account numbers, passwords or government ID numbers through the website. Please do not send them.

Why we use it, and on what basis

What we do with it	Legal basis
Reply to your enquiry and prepare a quote	India: data you gave us voluntarily for this purpose (DPDP Act, section 7(a)). EU/UK: steps taken at your request before a contract (GDPR Art. 6(1)(b))
Send you the confirmation email with your reference	Same as above
Carry out and invoice a project	Performance of our contract with you or your business; legal obligation for tax records
Keep the website secure and stop spam	Legitimate interest in protecting the service (GDPR Art. 6(1)(f)); for India, reasonable purposes connected to the service
Count visits with Google Analytics, if it is switched on	Your consent, which you can withdraw at any time
Meet tax, accounting and legal duties	Legal obligation

We do not sell your personal data, rent it, or share it for cross-context behavioural advertising. We do not add you to a mailing list. We do not make decisions about you by automated means alone.

Who else handles it

We use a small number of service providers who process data for us, under contract, and only for the purposes above:

• Resend (United States): delivers the confirmation email you receive and the notification our team receives.
• Hostinger: hosts this website, its database and the uploaded files.
• Our email provider: hosts the inbox where enquiry notifications and your emails arrive.
• Google Analytics, only if analytics is switched on and you accept it: visit statistics.
• Meta / WhatsApp: if you choose to message us on WhatsApp, under WhatsApp's own terms.
• Payment processors and banks: when you pay an invoice.

We may also disclose information when the law requires it, to protect our rights in a dispute, or to a buyer of the business, who would be bound by this policy.

International transfers

We are in India, and some of our providers store data in other countries, including the United States and the European Union. Where the GDPR or UK GDPR applies, transfers rely on the European Commission's Standard Contractual Clauses (and the UK Addendum) or an adequacy decision, as offered by each provider. India's DPDP Act allows transfers except to countries the Government of India restricts; we will follow any such restriction.

How long we keep it

• Enquiries that do not become a project: up to 24 months after our last conversation, then deleted.
• Client and project records: for the life of the project and afterwards for as long as Indian tax, GST and accounting law requires us to keep invoices and books.
• Security logs: short periods, usually weeks.
• Backups roll over automatically and are overwritten within about two weeks.

You can ask us to delete your data sooner (see below). We will, unless the law requires us to keep it.

How we protect it

The site runs over HTTPS. The admin area requires individual accounts, strong passwords and supports two-factor sign-in; every change is logged. IP addresses are stored only as one-way hashes. Access to client data is limited to the people working on your project. No system is perfectly secure, but if a breach affecting your data happens we will tell you and the relevant authorities as the law requires, including the Data Protection Board of India and CERT-In within the time limits they set.

Your rights

Wherever you are, you can ask us to:

• access the personal data we hold about you, and get a summary of how it is used;
• correct or complete it;
• delete it;
• withdraw consent where we rely on consent (for example analytics), as easily as you gave it;
• nominate someone to exercise your rights if you die or become unable to (India, DPDP Act section 14);
• object to or restrict processing, and port your data to another provider (EU, UK and several other countries);
• opt out of any sale or sharing of personal data (California and other US states). We do not sell or share it, and we honour the Global Privacy Control signal;
• not be discriminated against for using these rights.

To use any of them, email info@elevaredesigns.com from the address you used with us, or tell us how to verify it is you. We reply within 30 days, and sooner where the law requires. There is no charge.

If you are not satisfied, you can complain to our Grievance Officer, and then to your regulator: in India the Data Protection Board of India; in the EU your national data protection authority; in the UK the Information Commissioner's Office; in Canada the Office of the Privacy Commissioner; in Australia the OAIC; in the UAE the UAE Data Office.

Children

This website and our services are for businesses and adults. We do not knowingly collect personal data from anyone under 18. If you believe a child has sent us their details, tell us and we will delete them.

Changes

If we change this policy we will update the date at the top. If a change is significant we will say so on the site, and tell clients directly.