Privacy notice

011. Who I am

quietlybuild is run by GrowMint Media (proprietor Aditya Vashistha), Phagwara, Punjab 144401, India; the full postal address is given by email and on every invoice.

I decide why and how your personal data is used, so under the Digital Personal Data Protection Act, 2023 I am the data fiduciary. This notice is written to the standard of that Act. It covers quietlybuild.in, its checkout, the Studio’s enquiry form and the emails they send. For people in the United Kingdom and the European Union who write to me about Studio work, or who join the teardown list or ask for the pricing page self-check, section 11 adds what the UK GDPR and the GDPR ask for.

Grievance officer for privacy, and for any other complaint: Aditya Vashistha, Proprietor, hello@quietlybuild.in.

022. What I collect, and why

When you buy

• Your email address and name, to deliver your files, issue your invoice and answer you about your order.
• Your state or union territory, because GST law requires it on your invoice and it decides the tax (CBIC Circular 242/36/2024-GST).
• GST details, if you add them: your GSTIN, legal name, address, city and PIN code, to make the invoice out to your business.
• Your two checkout choices, and when you made them: the refund acknowledgement, and whether you asked for update emails.
• The order: its reference, the product, the price and its GST split, the invoice number, and from Razorpay the order and payment IDs, the payment status and the kind of method used, such as UPI or card.
• Which files you download, and when, to apply the download limits and the refund policy, and to answer a payment dispute.
• Where you came from: the first page you opened and any campaign tags in the link you followed, such as utm_source=instagram. They are kept with your order, so that I know which posts and pages are useful; they are never used to follow you around the web.
• The referral code your visit came with, if you followed someone’s referral link (section 13).

When you join the email list

• Your email address, the lists you joined (the free page, the Sunday Review Card, the monthly note, the teardown list or the pricing page self-check), which version of the consent text you agreed to, and when you signed up, confirmed and left.
• The references of emails scheduled for you, so that they can be cancelled if you unsubscribe.
• Where you came from, as above.

When you write to me or make a complaint

• Your name, email address, order number if you give one, the topic and your message, with the ticket number and the dates it was received, acknowledged and resolved.

When you visit

• Page views, counted by Cloudflare Web Analytics. It uses no cookies or local storage for analytics, and Cloudflare says it doesn’t track visitors over time by IP address or browser details.
• To stop abuse of my forms and checkout, a one-way, keyed code made from your IP address or email address, which expires within an hour. I don’t store your IP address itself.
• Like any web host, Cloudflare receives your IP address and browser details in order to deliver the pages to you.

What I don’t collect

• Card numbers, UPI PINs or bank logins: these go only to Razorpay.
• Your phone number. Razorpay may ask for it in its payment window; I don’t keep it.
• Aadhaar, PAN or any identity document.
• Whether you open my emails or click their links: that tracking is switched off.

033. The basis for using it

I use what you give me at checkout, in the contact form and in your messages for the purpose you gave it for: your order, its invoice and your question. The Act calls this a legitimate use, and it needs no separate consent. I keep invoices and order records because GST law requires it.

I send list emails only to people who have asked for them, with a box that is never ticked for you, and who have confirmed their address. You can withdraw that consent at any time, as easily as you gave it, with the unsubscribe link in every list email or by writing to me.

044. Who processes your data for me

I use three service providers. Each receives your data in order to provide its service to me.

Razorpay Software Limited

In India. Takes your payment, for a kit or for a Studio invoice. It processes your payment details under its own privacy policy.

Resend

Outside India. Sends my emails: sign-up confirmations, your files and invoice, complaint acknowledgements, the acknowledgement of a Studio enquiry, and the emails you asked for. Read its privacy policy.

Cloudflare, Inc.

A worldwide network, in and outside India. Hosts the site, runs the code behind the checkout and the forms, stores my database, and provides Web Analytics. Read its privacy policy.

I also share records with:

• my chartered accountant, who prepares my GST returns and accounts from the order and invoice records; and
• government authorities where the law requires it, for example in GST returns, which include the GSTIN of buyers who gave one.

I don’t sell or rent your data, and I don’t share it with advertisers. There are no advertising pixels, tag managers or social media widgets on this site.

055. How long I keep it

When a period ends, the record is deleted.

066. Cookies and storage in your browser

• I set one cookie, named qb_lib, and only after you open the link to your library. It keeps your library open on that device for 7 days. It is needed for the library to work and is never used for tracking. “Sign out of this device” in your library removes it.
• Your theme choice (light, dark or automatic) is saved in your browser’s local storage.
• While the checkout is open, the details you type are kept in your browser’s session storage, so that you don’t have to type them again if a payment is retried. They are cleared when you close the tab.
• If you arrive through someone’s referral link, its code is kept in your browser’s session storage for that visit, with the first page you visited, so that they can be paid if you buy or write to me. It is cleared when you close the tab. No cookie is set.
• Razorpay’s payment window is run by Razorpay and may use its own cookies, under its privacy policy.

Because I use no advertising or tracking cookies, there is no cookie banner.

077. Your rights

You can ask me to:

• tell you what personal data I hold about you, what I do with it, and who I have shared it with;
• correct it, fill in anything missing, or bring it up to date;
• delete it, except what the law requires me to keep, such as invoices (for an order with no invoice, I remove your name and email address);
• stop using it for anything you consented to, such as list emails;
• record someone who may use these rights for you if you die or become unable to act; and
• answer a complaint about how I have handled your data.

Write to the grievance officer at hello@quietlybuild.in, from the email address the request is about, so that I know it is you. I acknowledge your request within 48 hours and answer it within one month. If you are not satisfied with my answer, you can complain to the Data Protection Board of India.

088. Security

I keep personal data to the minimum set out above, and payment details stay with Razorpay. The site is served only over HTTPS. Links to your files and invoices are signed and expire, and I store only one-way codes of them, never the links themselves. The admin pages are password-protected and used only by the proprietor. If a breach ever affects your data, I will tell you and the Data Protection Board as the law requires.

099. Children

My products are for adults: you must be 18 or over to buy or to join the email list. I don’t knowingly collect data from anyone under 18. If you think a child has given me their details, write to me and I will delete them.

1010. The emails I send

• Emails about an order you placed or a message you sent are part of the service: your files, your invoice, a link back to your orders, and complaint acknowledgements.
• Ten days after a purchase, I send one short email asking whether anything in the kit is unclear. I never send sales emails for a product you already own.
• Anything else, such as the emails that follow the free page, the monthly note, the pricing page self-check or a new teardown, is sent only if you asked for it and confirmed your address.
• Every list email has a one-click unsubscribe link, and I don’t track opens or clicks.

1111. Studio enquiries and clients

quietlybuild Studio does fixed-scope product and AI work for software teams, mostly in the United Kingdom, the European Union and the United States. This section covers what I keep when you write to me about that work, when you become a client, and when you join one of the Studio’s two email lists. Everything above applies as well.

What I keep when you send the Studio form

When you send the form at quietlybuild.in/start, or write to me about Studio work, I keep:

• your name and work email address;
• your company and its website, if you give them;
• the country you choose, the offer, your note in your own words, and when you would like to start;
• your two ticks (that the price fits, and that I may keep your note) and when your note arrived;
• the referral code your visit came with, if you followed someone’s referral link (section 13);
• the country Cloudflare reports for your connection, and a one-way code made from your email address, so that the form can limit repeated messages. I don’t keep your IP address itself.

I use it only to reply and, if we go ahead, to write the scope, the agreement and the invoices. It is never added to a mailing list. There is no phone number on the form, and none is asked for.

When you become a client

• For the agreement and the invoices: your company’s name, address, country and any tax number you give me, and the name and work email of the person I work with.
• The agreement, the statements of work, the invoices and the payment records. A card payment goes through a Razorpay payment link; a bank transfer goes to the account on the invoice.
• What you share for the work, such as test accounts and screenshots, handled as the Studio client terms say: as little personal data as possible, and deleted within 30 days of the work ending.

The Studio’s email lists

Two lists are the Studio’s: the teardown list (an email when a new teardown goes live, at most once a month) and the pricing page self-check (the PDF, and the email that sends it). For them I keep what section 2 lists for the email list. They are never joined to the kits’ monthly note.

The basis for using it, in the UK and the EU

If you are in the United Kingdom or the European Union, the UK GDPR or the GDPR applies to what I keep about you. For an enquiry, my basis is the steps you asked me to take before we might agree a contract; for a client’s records, the contract itself (article 6(1)(b) of both). Keeping invoices and accounts after the work ends rests on my legitimate interest in meeting the tax and foreign-exchange law that applies to my business in India (article 6(1)(f)). For the Studio’s email lists, my basis is your consent (article 6(1)(a)): given on the form, confirmed by email, and withdrawn in one click with the link in every list email.

Sending it to India, and the safeguards

I work from India, so what you send is read and kept by me in India. It is stored in my database at Cloudflare, whose network is worldwide, and my reply and your acknowledgement are sent through Resend; both handle it under their own data processing terms. Neither the United Kingdom nor the European Union has found that India’s law protects personal data to their standard, so:

• an enquiry is sent to India because it is needed to answer the request you made (article 49(1)(b) of the GDPR and of the UK GDPR), and only what you choose to send goes;
• client work is designed to need no personal data; when a piece of work truly needs some, we sign a data processing schedule first, with the EU or UK standard contractual clauses for the transfer;
• the security measures in section 8 apply, and the Studio’s admin pages are password-protected and used only by me.

How long I keep it

An enquiry that doesn’t lead to work is deleted 24 months after my last reply. A client’s agreement, invoices and payment records are kept for 8 years, so that they outlast the periods Indian tax and foreign-exchange law requires. Materials you share for the work are deleted within 30 days of the work ending. The table in section 5 lists them all.

Your rights, in the UK and the EU

As well as the rights in section 7, you may ask me to restrict how I use your data, to object to my using it, and to give you what you sent in a form you can take elsewhere. Write to hello@quietlybuild.in; I answer within one month. If you are not satisfied, you may complain to the Information Commissioner’s Office in the United Kingdom, or to the data protection authority where you live or work in the European Union.

1212. If I contacted you about the Studio

I sometimes write to people at software companies whose work my Studio’s services concern: founders, CEOs and product leads. I keep your name, your work email address, your company and role, the public page where I found them (for example your company’s team page or a funding announcement), and the dates I wrote and you replied.

I do this on the basis of legitimate interests: offering a relevant service to someone whose job it concerns, one email at a time. I never buy lists, never share your details, and never add you to a mailing list.

You can object at any time, and I will stop. Reply “no” to any email, or write to hello@quietlybuild.in. I delete the details of anyone who hasn’t replied six months after my last email, and of anyone who objects within a week, keeping only your address on a do-not-contact list so that I never write again.

1313. If you refer people to me

If you agree to refer people to me, as a Studio partner or under the kit referral terms, I keep your name, your email address, your referral code, the terms you agreed to and when, and what I paid you and when. I keep them to pay you and to keep my payment records, for 8 years, as section 5 says. I pay by hand, from my bank; I never store your bank details on this site.

Your code is public, because it is in the links you share, so it names a business or a handle, never anything private. When someone follows your link, the code goes with their visit (section 6) and, if they buy or write to me, it is kept with their order or enquiry (sections 2 and 11).

1414. Changes to this notice

When this notice changes, it gets a new version number and date at the top. If a change affects how I use data you have already given me, I tell you before it applies. Version 1.1, of 19 October 2026, added sections 11 and 12 for the Studio and its rows in the table in section 5; nothing about kit orders changed. Version 1.2, of 2026-10-21, added the teardown list and the pricing page self-check to sections 1, 2, 10 and 11; the referral code to sections 2, 6 and 11; section 13 for referrers, with its row in the table in section 5. Sections 13 and 14 became 14 and 15.

1515. Contact

Questions, requests and complaints about your data go to the grievance officer: Aditya Vashistha, Proprietor, hello@quietlybuild.in. You can also use the form on the Contact and complaints page, which gives you a ticket number.