Your privacy choices

We use optional Google Analytics to understand which Emladris pages are useful and how visitors use public website features. We do not send contact-form entries, dashboard activity, or account details to Google. Analytics stays off unless you accept it.

Necessary storage

Always active. Remembers your privacy choice and supports requested dashboard sign-in behavior.

Always active
Contact
Back

Privacy

This operational privacy draft explains current repository behavior and unresolved production decisions. It is pending qualified legal review and does not claim compliance certification.

Controller and contact

Emladris AI Private Limited is intended to act as controller or, under India's Digital Personal Data Protection Act, 2023, Data Fiduciary for data handled through Emladris services. Registered-office details, dedicated privacy contact, grievance contact, and any required UK or Western-market representative are not yet published in company source truth. These are production blockers. Rights requests cannot be given a reliable submission process until an authorized privacy contact is approved and published.

Data categories and sources

  • Public site: requested URLs and technical request data such as IP address, time, browser, device, referrer, and server diagnostics may be processed by future hosting or CDN infrastructure. No production hosting provider, log retention, or CDN is approved yet.
  • Contact form: names, email addresses, messages, IP-derived rate-limit keys, and Cloudflare Turnstile verification data are processed to deliver enquiries by email. Form values are not stored in the application database or used as analytics parameters.
  • Accounts and invites: the private dashboard can process Google sign-in identity, allowlisted email, access and refresh tokens, invite email/status, and administrative actions. Public analytics is suspended on dashboard and invite flows.
  • Email: dashboard invite delivery can use a configured SMTP provider. Provider identity, processing location, message-log retention, and production approval remain unresolved.
  • Diagnostics: application, web-server, database, security, and delivery logs may contain identifiers and request metadata if production infrastructure enables them. No third-party diagnostic service or retention schedule is currently approved.
  • Consented analytics: after opt-in, Google Analytics receives sanitized public page and event data described in Cookies and storage. It does not intentionally receive public form values, account identities, tokens, queries, fragments, customer data, or free text.

Purposes and legal grounds

Optional analytics uses consent to understand consented public-site use and improve page usefulness. Requested communications or services may require contract or steps requested before a contract when a real submission channel exists. Account administration, service operation, fraud prevention, and proportionate security may rely on legitimate interests after a documented necessity and balancing assessment. Record keeping and responses to valid authorities may rely on legal obligation. India's consent and certain-legitimate-use framework, UK GDPR lawful bases, and any other market-specific grounds require qualified review before production; this draft does not select grounds for systems whose purpose or operator is unresolved.

Recipients, processors, and international transfer

Google receives consented analytics as analytics service provider and may process it internationally. Emladris treats Google as processor/service provider for this limited purpose pending contract and legal confirmation. Actual contracting entity, international transfer destination, data-processing terms, UK transfer mechanism, and transfer-risk assessment are unresolved production blockers.

Cloudflare processes security-check data for contact-form abuse prevention. Production hosting provider, API/Postgres host, backup provider, SMTP/email provider, observability provider, and support-access boundaries remain unresolved. Website fonts and static assets are bundled and served from same-origin paths; current public code does not request Google Fonts. Provider names, subprocessors, locations, contracts, deletion paths, and transfer safeguards must be recorded before deployment.

Retention

  • Analytics consent choice: six calendar months.
  • GA cookies: configured maximum 390 days, subject to shorter browser limits or earlier deletion.
  • GA event-data retention: required production setting 14 months with reset-on-new-activity off, not yet confirmed in GA Admin. Aggregated or derived reports may persist longer.
  • Dashboard access token: browser session storage; server-configured validity defaults to 24 hours.
  • Dashboard refresh token: browser session storage and hashed server record; server-configured validity defaults to 30 days, with rotation and revocation.
  • Invites: links expire after seven days, but database retention after acceptance, expiry, or revocation has no approved deletion schedule.
  • Contact messages and delivery metadata may remain in configured sender and recipient mailboxes. No approved production retention schedule exists.
  • Accounts, blog administration, email logs, hosting logs, diagnostics, backups, and legal records: no approved production retention schedule. Deployment remains blocked until owners define one.

Your choices and rights

Visitors can reject or withdraw optional analytics as easily as accepting it. Depending on applicable law and circumstances, people may request access, correction, completion, erasure, restriction, objection, portability, consent withdrawal, information about processing, grievance handling, or complaint to a regulator. India's Digital Personal Data Protection Rules, 2025 include phased commencement, so legal review must identify which duties are in force at deployment. UK GDPR reach, representative duties, complaint route, response deadlines, identity verification, exemptions, and regulator details must also be confirmed for actual targeting.

Because approved privacy contact and grievance process are missing, this page cannot yet offer a complete rights-request channel. Publishing that channel remains a release blocker. The public contact form is for general enquiries, not a dedicated rights-request process.

Changes

Any material analytics or purpose change requires policy review and, where consent would no longer cover changed processing, renewed consent before new collection begins. Emladris must keep this notice aligned with deployed systems and actual processors.

See India's DPDP Rules source, UK ICO data-protection guidance, and Google's Privacy Policy.

Last reviewed: