Privacy notice
Last updated · September 26, 2026
The short version: we collect only what you choose to send us, use it only to reply and work with you, never sell it, and don’t track you around the web. The details follow.
Who we are
This website is operated by Tanaloom (“Tanaloom”, “we”), a software company based in Ahmedabad, Gujarat, India. For personal data you send us through this website, we are the data fiduciary (under India’s Digital Personal Data Protection Act, 2023) and the controller (under the EU and UK GDPR).
Questions about privacy go to privacy@tanaloom.com.
What we collect
Information you give us
- Project briefs and messages: your name, email, and optionally company, role, country and phone number, plus what you tell us about your project, budget and timeline.
- Job applications: the details and documents you choose to send.
- Emails you send us directly.
Information collected automatically
- Privacy-friendly analytics: we use Vercel Web Analytics, which counts page views and performance without cookies and without identifying you.
- Abuse prevention: when you submit a form, we store a salted, one-way hash of your IP address (never the address itself) to limit spam, and Cloudflare Turnstile checks that you’re a person.
- How you found us: if you arrived from a link with campaign tags or from another website, we note that in your browser’s session storage and send it with a form only if you submit one. We also record your time zone to schedule calls sensibly.
- Server logs kept by our hosting provider for security and reliability.
Why we use it
| Purpose | Legal basis |
|---|---|
| Replying to your brief or message and discussing a project | Your consent, given by submitting; steps toward a contract at your request |
| Preventing spam, fraud and abuse of our forms | Legitimate interests; reasonable purposes under the DPDP Act |
| Understanding which pages are useful (aggregated, anonymous) | Legitimate interests |
| Occasional studio notes by email | Only if you tick the box. Withdraw anytime |
| Considering your job application | Your consent; steps toward an employment contract |
We do not sell personal data, and we do not use it for advertising or to train AI models.
Who we share it with
Only with service providers who process data on our behalf, under contracts that require them to protect it:
- Vercel: website hosting and cookieless analytics
- Neon: database hosting for the enquiries we receive
- Resend: delivery of the emails our forms send
- Cloudflare: Turnstile, the human check on our forms
- Google Workspace: our email and documents
Some of these providers process data outside India, including in the United States and the European Union. Where required, transfers are covered by appropriate safeguards such as standard contractual clauses. We may also disclose information if the law requires it.
How long we keep it
- Briefs and messages: up to 24 months after our last contact, unless we start working together.
- Client records: for the duration of the engagement plus the period required by Indian tax and company law.
- Job applications: up to 12 months, unless you ask us to delete them sooner.
- Studio notes (newsletter): until you unsubscribe. Sign-ups that are never confirmed are deleted after 30 days.
- Rate-limiting records: 24 hours.
These periods are enforced automatically every day, not just by policy.
Your rights
Wherever you are, you can ask us to:
- tell you what personal data we hold about you and how it’s used;
- correct, complete or update it;
- delete it, or stop using it for a particular purpose;
- withdraw consent you’ve given (this doesn’t affect what we did before);
- send you a copy in a portable format (GDPR).
Under the DPDP Act you may also nominate someone to exercise these rights on your behalf. Write to privacy@tanaloom.com; we reply within 30 days. If you’re not satisfied, you may complain to the Data Protection Board of India or, in the EU/UK, to your local supervisory authority.
Cookies & browser storage
We don’t use advertising or tracking cookies, so there’s no cookie banner. The site stores two small things in your own browser:
- your light/dark theme choice (
localStorage, if you pick one); and - how you arrived, for this visit only (
sessionStorage), sent to us only with a form you submit.
Cloudflare Turnstile may process technical signals from your browser to tell people from bots.
Security
Data is encrypted in transit and at rest, access is limited to the people who need it, and IP addresses are hashed rather than stored. No system is perfectly secure; if you find a weakness, please tell us. See our security page.
Children
This website is for businesses and professionals. We don’t knowingly collect data from anyone under 18.
Changes & contact
If we change this notice, we’ll update the date at the top; significant changes will be highlighted on this page. For anything privacy-related, including grievances, contact privacy@tanaloom.com.