PVPV COLAB

Privacy Policy

Effective: 2026-09-24

1. Who we are

PV Colab ("we", "us", "our") is a digital agency providing web and mobile development, security audits, SEO, workflow automation, AI agents, design, social media and video services. This policy explains how we collect, use, store and protect personal data across our public website, our client portal and related services.

2. Data we collect

  • Enquiry data you submit on our contact form: name, email, phone, company, service of interest, budget and message.
  • Client account data: contact name, company, email, phone, billing address and GST number (if provided).
  • Project data you upload to the client portal: brand assets, documents, images, videos, credentials you choose to share, text content and messages.
  • Payment records: amounts, dates, payment method and references. We do not store card numbers — card payments are processed by the payment provider.
  • Technical data: IP address, browser user-agent and timestamps, used for security (rate limiting, fraud and abuse prevention) and audit logs.
  • We do not use advertising trackers on the client portal or dashboard.

3. How we use your data

  • To respond to enquiries and prepare quotations.
  • To deliver the services you contracted, communicate progress and share deliverables.
  • To issue invoices, record payments and meet tax and accounting obligations.
  • To secure our systems, investigate incidents and prevent abuse.
  • To publish testimonials or case studies — only after your explicit approval.

We process data to perform our contract with you, to comply with legal obligations (e.g. tax records), on the basis of legitimate interest (security, service improvement) and, where required, with your consent (testimonials, marketing emails). This policy is written to align with India's Digital Personal Data Protection Act, 2023 and, for clients in the EU/UK, the GDPR.

5. Where your data is stored

  • Database: Neon (managed PostgreSQL), encrypted at rest and in transit.
  • Files: Cloudflare R2 object storage in private buckets. Downloads are authorized by the application and streamed only after login; public image URLs exist only for approved portfolio covers and email banners.
  • Application: Cloudflare Workers (global edge network).
  • Email delivery: Resend.
  • Public page fonts and optional anti-abuse challenge: Google Fonts and Cloudflare Turnstile, which may receive technical request data under their own terms.

These providers act as our processors under data processing terms. Data may be processed outside your country with appropriate safeguards.

6. Sharing

We never sell your data. We share it only with the processors listed above, with professionals (e.g. accountants) under confidentiality, or when required by law.

7. Retention

  • Unconverted enquiries, email logs and audit/security logs: deleted after 12 months by the scheduled privacy-cleanup job.
  • Project assets: retained while the project is active and for 24 months after completion unless you delete them sooner, the project remains published as a case study, or a legal/contract requirement applies.
  • Invoices and payment records: kept for the period required by applicable tax law.
  • Audit and security logs: 12 months.

8. Your rights

You may request access to, correction of, export of, or deletion of your personal data, and withdraw consent at any time. From the client portal you can delete your own uploaded files at any time. For other requests email us — we respond within 30 days.

9. Security

Passwords are hashed with a strong key-derivation function; sessions use secure, HTTP-only cookies; all traffic is served over HTTPS with HSTS; access to client data is restricted per project and material administrative actions are recorded in an audit log. No system is perfectly secure, but we will notify affected users and authorities of a personal data breach as required by law.

10. Cookies

We use only essential session cookies to keep an authorised user signed in to the dashboard or portal. Password-reset and invitation links use one-time tokens rather than tracking cookies. The public site does not set advertising or analytics cookies.

11. Children

Our services are intended for businesses and are not directed to children under 18.

12. Changes

We may update this policy. Material changes will be announced on this page and, for clients, by email.

13. Contact

Questions or requests: privacy contact email listed on our Contact page.