Privacy Policy

Kutunova Labs ("we", "us", "our") is the operator of kutunovalabs.com and dhruvid.com, and the developer of associated products including Authgate, Billwise, Deployr, Sentinel, Nudge, Chattr, Hub, and Domains.

We are the data controller for personal data collected through these services. For any questions about this policy or to exercise your rights, contact us at legal@kutunovalabs.com.

We collect only what is necessary to provide and improve our services:

Contact and enquiry data — when you email us or use a contact form, we store your name (if provided), email address, and message content.

Account and authentication data — if you use Authgate or related services, we store credential hashes, session tokens, API key records, and access logs as part of normal authentication service operation. We never store passwords in plain text.

Usage and technical data — when you use our products, we may collect log data including IP addresses, request timestamps, browser type, and error information. This is used for security monitoring and service reliability.

Payment data — if you purchase a paid service, payment is processed by our third-party payment providers (Razorpay or Stripe). We do not store full card numbers or bank details. We retain transaction references and amounts for billing and compliance purposes.

We do not collect personal data through advertising networks or passive tracking pixels.

We use collected data to:

— Respond to enquiries and support requests — Create and manage your account and access to our services — Process payments and issue receipts — Operate, secure, and improve our products — Detect and prevent abuse, fraud, and security incidents — Send transactional communications (e.g. account alerts, receipts) via Zeptomail — Meet legal and compliance obligations

We do not sell personal data to third parties. We do not use your data for advertising.

We process personal data on the following legal bases depending on your jurisdiction:

Contractual necessity — processing required to deliver services you have signed up for or requested.

Legitimate interests — operating and securing our services, responding to enquiries, preventing abuse, and improving reliability. We balance our legitimate interests against your rights before relying on this basis.

Legal obligation — where processing is required to comply with applicable law.

Consent — where we have explicitly requested and received your consent (for example, optional communications). You may withdraw consent at any time without affecting prior processing.

For users in the European Economic Area and UK, these bases apply under the GDPR. For California residents, we comply with the CCPA. For users in India, we comply with the Digital Personal Data Protection Act 2023 (DPDP Act).

We share personal data with third parties only where necessary to deliver our services. The third parties we work with include:

Cloudflare — provides our DNS, CDN, and edge network infrastructure. Cloudflare may process IP addresses and request metadata as part of delivering and securing our services. See cloudflare.com/privacypolicy.

Razorpay — payment processing for users in India and selected regions. See razorpay.com/privacy.

Stripe — payment processing for international users. See stripe.com/privacy.

Zeptomail — transactional email delivery (account alerts, receipts). See zeptomail.com/privacy-policy.

OpenProvider — domain registration and DNS management infrastructure. See openprovider.com/privacy-policy.

All third parties are required to handle your data in accordance with applicable data protection laws and our data processing agreements. We do not share data with advertising networks, data brokers, or analytics companies.

Our services operate globally and your data may be processed in countries outside your own. Where data is transferred outside the European Economic Area or India, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (for EEA transfers) or equivalent protections required by applicable law.

We retain personal data for as long as it is needed for the purpose it was collected, or as required by law:

— Contact and enquiry data: up to 2 years from last contact — Account and authentication data: for the duration of your account plus up to 1 year after closure — Payment transaction records: up to 7 years for tax and legal compliance — Server and security logs: up to 90 days

You may request deletion of your data at any time (see Your Rights below).

Our websites use a minimal set of cookies. Essential cookies are required for session management and authentication. We do not use advertising or tracking cookies. See our Cookie Policy at kutunovalabs.com/cookies for full details.

Depending on where you are located, you have the following rights regarding your personal data:

Right to access — request a copy of the personal data we hold about you.

Right to correction — request that inaccurate or incomplete data be corrected.

Right to deletion — request that we delete your personal data ("right to be forgotten"), subject to legal retention obligations.

Right to restriction — request that we limit how we process your data in certain circumstances.

Right to portability — receive your data in a structured, machine-readable format.

Right to object — object to processing based on legitimate interests or for direct marketing.

Right to withdraw consent — where processing is based on consent, withdraw it at any time.

Complaints — if you are in the EU or UK, you may lodge a complaint with your national data protection authority. In India, you may contact the Data Protection Board under the DPDP Act 2023. In California, you have rights under the CCPA including the right to know, delete, and opt out of sale (we do not sell data).

To exercise any of these rights, email us at legal@kutunovalabs.com. We will respond within 30 days.

We use industry-standard security measures including encryption in transit (TLS), hashed credential storage, and access controls. Our infrastructure is managed through Cloudflare and Dhruvid, both of which maintain their own security programmes.

No method of transmission over the internet is 100% secure. If you have reason to believe your data has been compromised, contact us immediately at legal@kutunovalabs.com.

Our services are not directed at children under 18. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected such data, please contact us at legal@kutunovalabs.com and we will delete it promptly.

We may update this Privacy Policy as our services or applicable laws evolve. Material changes will be reflected in an updated effective date at the top of this page. Where required by law, we will notify affected users directly. Continued use of our services after changes take effect constitutes acceptance of the updated policy.