Privacy Policy

Last Updated: June 12, 2026

Kastrick ("we," "us," or "our") respects the privacy of our Clients and is committed to protecting the confidentiality, integrity, and security of information entrusted to us.

This Privacy Policy explains how Kastrick collects, processes, stores, protects, and manages information when providing software development, website development, backend engineering, hosting, infrastructure management, custom APIs, business email services, and ongoing maintenance.

This Privacy Policy applies to all services directly provided, deployed, hosted, or managed by Kastrick unless otherwise stated in a separate written agreement.

1. Definitions

For the purposes of this Privacy Policy:

Client

Any individual, business, organization, or entity that purchases or uses services provided by Kastrick.

Client Data

Any information, files, databases, website content, uploaded media, customer records, configuration data, documents, emails, API payloads, analytics data, or other information belonging to the Client that is processed through services directly provided by Kastrick.

Services

Any website, backend, hosting environment, API, database, email infrastructure, cloud deployment, maintenance agreement, or related engineering service supplied by Kastrick.

Third-Party Provider

Any external company whose products or services are used alongside Kastrick's services, including but not limited to hosting providers, cloud platforms, domain registrars, payment processors, email providers, analytics providers, or CDN providers.

2. Information We Collect

Kastrick follows a data minimization approach. We collect only the information reasonably necessary to provide, maintain, improve, and secure our services.

Depending on the services provided, we may collect:

Contact Information

• Name
• Business name
• Business email address
• Telephone number
• Billing information
• Project communications

Account Information

Where administrative dashboards or management portals are provided, we may collect:

• Username
• Authentication credentials
• Account identifiers
• Account preferences
• Security settings

Passwords are never intentionally stored in plain text and are handled using industry-standard security practices where applicable.

Operational Data

To maintain secure and reliable infrastructure, Kastrick may process operational information including:

• Server logs
• API request logs
• Error reports
• Authentication attempts
• IP addresses
• Browser or device information
• System performance metrics
• Resource utilization
• Security event logs

Operational information is used solely for administration, troubleshooting, security monitoring, abuse prevention, and service improvement.

Client Project Data

Depending on the project, Kastrick may process:

• Website content
• Images
• Videos
• Documents
• Uploaded files
• Databases
• Customer records
• Contact form submissions
• Product information
• Inventory data
• Email archives
• API data
• Configuration files
• Application settings

Kastrick does not use Client Project Data for advertising, profiling, resale, or unrelated commercial purposes.

Cookies and Similar Technologies

Where applicable, Kastrick may use cookies or similar technologies to:

• maintain secure sessions;
• remember user preferences;
• improve website functionality;
• enhance security;
• analyze website performance.

Cookies are not used to sell personal information or build advertising profiles.

3. Legal Roles

The specific legal responsibilities for personal information depend on the services provided.

Client as Data Controller / Data Fiduciary

For systems developed or hosted by Kastrick on behalf of a Client, the Client determines:

• what information is collected;
• why it is collected;
• how long it is retained;
• who may access it;
• when it should be deleted.

Accordingly, the Client generally acts as the Data Controller under applicable privacy laws or the Data Fiduciary under India's Digital Personal Data Protection Act (DPDPA).

Kastrick as Data Processor

Kastrick generally acts as a Data Processor.

We process Client Data solely for the purpose of providing the agreed services and only in accordance with the Client's documented instructions, applicable law, and our contractual obligations.

Kastrick does not independently sell, license, monetize, profile, or commercially exploit Client Data.

4. Ownership of Client Data

Kastrick recognizes that information entrusted to us remains the property of its rightful owner.

Unless otherwise required by law or expressly agreed in writing:

• The Client retains ownership of all Client Data.
• Kastrick claims no ownership over Client databases, uploaded files, customer information, business records, website content, emails, documents, or other Client Data.
• Kastrick processes Client Data solely for the purpose of delivering the requested services.

Ownership of software, source code, frameworks, reusable libraries, deployment tools, and other intellectual property created or retained by Kastrick is governed by the applicable Terms of Service and any separate written agreement.

5. How Client Data Is Used

Client Data is processed only where reasonably necessary to:

• provide contracted services;
• deploy websites and applications;
• host infrastructure;
• maintain backend systems;
• process API requests;
• troubleshoot technical issues;
• provide maintenance and support;
• improve service reliability;
• protect systems against abuse or unauthorized access;
• comply with applicable legal obligations.

Kastrick does not access Client Data unless access is reasonably necessary to perform requested services, investigate technical issues, respond to security incidents, comply with legal obligations, or where otherwise authorized by the Client.

6. Access Controls

Access to Client Data is restricted to authorized personnel who require access to perform their responsibilities.

Access is granted according to the principle of least privilege.

Where practical, administrative access is limited, monitored, and protected through appropriate authentication and security measures.

Kastrick does not routinely inspect, monitor, or review Client content unless such access is necessary to provide the requested services or required by law.

7. Client Data Requests & Data Portability

Kastrick believes Clients should have reasonable access to the information that belongs to them.

Subject to applicable law, contractual obligations, outstanding invoices, and technical feasibility, Clients may submit a written request to obtain copies of their Client Data.

Where possible, Kastrick will provide requested information in a commonly used, machine-readable format.

7.1 Website Data

Where Kastrick develops or hosts a website for the Client, the Client may request copies of data that they own, including:

• Website content
• Images and media
• Uploaded documents
• Product information
• Blog articles
• Forms and submissions
• Downloadable assets
• Website configuration created specifically for the Client

Where the applicable agreement includes ownership of the website source code, Kastrick will also provide the website's source files upon request following full payment of all applicable invoices.

7.2 Backend Data

Where Kastrick provides backend infrastructure or database services, Clients may request copies of operational data that belongs to them, including:

• Database exports
• Customer records
• Business records
• Application-generated data
• API-generated records
• Uploaded files
• Configuration data specific to the Client
• Log data where appropriate and technically feasible

Unless otherwise agreed in writing or purchased as part of the project, backend application source code, reusable frameworks, internal development tools, deployment systems, monitoring software, automation scripts, and proprietary engineering components remain the intellectual property of Kastrick and are not considered Client Data.

7.3 API Data

Where APIs process or store Client information, the Client may request:

• API-generated records
• Data submitted through API endpoints
• API response data belonging to the Client
• Documentation relating to purchased APIs where applicable

Ownership of the API software itself is governed by the applicable project agreement and Terms of Service.

7.4 File System Data

Clients may request copies of files that they legally own and that are stored within systems managed by Kastrick.

Examples include:

• Uploaded media
• Images
• Documents
• Reports
• PDF files
• Downloads
• Business assets
• Email attachments
• Backup archives created specifically for the Client

Requests do not include Kastrick's internal operating systems, development environments, deployment infrastructure, reusable frameworks, monitoring systems, or other proprietary software unless explicitly transferred by written agreement.

7.5 Export Formats

Where technically feasible, Client Data may be provided in commonly used formats, including:

• ZIP archives
• SQL database exports
• CSV
• JSON
• XML
• PDF
• Image files
• Video files
• Source files (where ownership has transferred)
• Other commercially reasonable formats

The specific format provided may depend on the technologies used within the project.

8. Data Retention

Kastrick retains Client Data only for as long as reasonably necessary to:

• provide the agreed services;
• fulfill contractual obligations;
• maintain operational backups;
• resolve disputes;
• comply with applicable legal requirements;
• enforce contractual rights.

Retention periods may vary depending on the nature of the service and applicable legal obligations.

8.1 Active Projects

During an active engagement, Client Data is retained for the duration of the project and any applicable maintenance agreement.

8.2 Completed Projects

Following project completion, Client Data may continue to be retained where necessary to:

• provide future maintenance;
• fulfill support obligations;
• maintain backups;
• assist with migrations;
• satisfy legal requirements.

8.3 Data Deletion

Upon written request, Kastrick will make commercially reasonable efforts to delete Client Data that is no longer required for active services, legal compliance, contractual obligations, or security purposes.

Deletion requests may not immediately remove information from backup systems where such removal is technically impractical.

Backup copies will be securely removed in accordance with Kastrick's normal backup lifecycle.

9. Account Suspension & Termination

Where services are suspended or terminated, Kastrick aims to protect both the Client's legitimate interests and the security of its infrastructure.

9.1 Voluntary Termination

Where a Client voluntarily terminates services, the Client may request copies of Client Data prior to permanent deletion, subject to:

• completion of identity verification;
• fulfillment of outstanding contractual obligations;
• payment of outstanding invoices where applicable;
• technical feasibility.

9.2 Suspension or Termination for Policy Violations

Where services are suspended or terminated due to violations of the Terms of Service or Acceptable Use Policy, Kastrick may immediately restrict access to hosted systems in order to protect infrastructure, other Clients, or comply with legal obligations.

Where legally permitted and technically feasible, Clients may still request copies of their Client Data.

However, Kastrick may refuse requests that would:

• expose another Client's information;
• compromise system security;
• disclose Kastrick proprietary software;
• interfere with ongoing legal investigations;
• violate applicable law.

9.3 Expired Data

Following the applicable retention period after termination, Client Data may be permanently deleted from production systems and backup storage.

Once securely deleted, recovery may no longer be possible.

10. Third-Party Services

Some projects may utilize services provided by independent third-party providers.

Examples include:

• Cloud hosting providers
• Domain registrars
• DNS providers
• Email providers
• Payment processors
• CDN providers
• Analytics providers
• External APIs

Where such services are supplied directly by Kastrick as part of the agreed solution, Kastrick will use commercially reasonable efforts to select reputable providers appropriate for the requested services.

Where the Client independently purchases or contracts with third-party providers that are not supplied, provisioned, or managed by Kastrick, those providers operate under their own terms, privacy policies, and data handling practices.

Kastrick is not responsible for the privacy, security, availability, or operational practices of independently selected third-party services.

11. Security Measures

Kastrick employs commercially reasonable administrative, technical, and organizational safeguards designed to protect Client Data.

Depending on the services provided, these measures may include:

• Transport Layer Security (TLS)
• Encrypted communications
• Authentication controls
• Role-based access controls
• Secure credential management
• Infrastructure monitoring
• Firewall protections
• Backup systems
• Security logging
• Regular software updates
• Access auditing where appropriate

While Kastrick strives to maintain a secure environment, no system connected to the Internet can be guaranteed to be completely secure.

Clients are encouraged to maintain strong passwords, secure their own devices, and promptly report suspected security incidents.

12. Security Incidents & Data Breach Response

Kastrick takes the protection of Client Data seriously and maintains procedures designed to identify, investigate, contain, and respond to suspected security incidents.

Where Kastrick becomes aware of a confirmed security incident affecting Client Data that we are responsible for processing, we will take commercially reasonable steps to:

• contain and investigate the incident;
• minimize any continuing risk;
• restore affected services where practical;
• preserve relevant evidence where appropriate;
• notify affected Clients where required by applicable law or contractual obligations.

Where notification is required, Kastrick will use commercially reasonable efforts to notify the affected Client without undue delay after confirming the incident and gathering sufficient information to provide a meaningful update.

Notifications may include, where available:

• a general description of the incident;
• the categories of information involved;
• the known or reasonably suspected impact;
• actions already taken by Kastrick;
• recommended steps the Client may take to reduce potential risk.

Kastrick cannot guarantee that every attempted attack, scan, or unauthorized access attempt will result in a reportable security incident. Only confirmed incidents affecting Client Data are subject to this notification process.

13. International Data Processing

Depending on the infrastructure selected by the Client, Client Data may be processed, stored, or backed up in jurisdictions outside the Client's country of residence.

Where international processing occurs, Kastrick will use commercially reasonable efforts to work with service providers that maintain appropriate security standards for the services provided.

The Client acknowledges that selecting infrastructure in another country may result in Client Data being processed within that jurisdiction.

14. Client Privacy Rights

Subject to applicable law, Clients may request to:

• access Client Data held by Kastrick;
• obtain copies of Client Data;
• request correction of inaccurate information;
• request deletion of Client Data where legally permissible;
• request export of Client Data in a commercially reasonable format;
• inquire about how Client Data is processed;
• withdraw consent where processing is based on consent, subject to legal or contractual limitations.

Kastrick may request reasonable identity verification before fulfilling requests involving sensitive or confidential information.

Where permitted by law, Kastrick may decline requests that are:

• manifestly unfounded;
• excessive or repetitive;
• technically impossible;
• likely to compromise another Client's privacy;
• inconsistent with legal obligations;
• inconsistent with contractual obligations that remain in effect.

15. Children's Privacy

Kastrick's professional services are intended for businesses, organizations, and individuals capable of entering legally binding agreements.

Our services are not directed toward children, and Kastrick does not knowingly collect personal information directly from children through its professional services.

If Kastrick becomes aware that information has been collected contrary to applicable law, commercially reasonable efforts will be made to remove such information where appropriate.

16. Changes to this Privacy Policy

Kastrick may update this Privacy Policy from time to time to reflect:

• changes in applicable law;
• changes to our services;
• improvements in security practices;
• operational changes;
• technological developments.

The updated version will become effective upon publication unless otherwise stated.

Clients are encouraged to periodically review the latest version of this Privacy Policy.

Continued use of Kastrick's services after an updated Privacy Policy becomes effective constitutes acceptance of the revised Privacy Policy where permitted by applicable law.

17. Relationship with the Terms of Service

This Privacy Policy explains how Kastrick collects, processes, stores, protects, and manages Client Data.

Questions relating to:

• ownership of software;
• licensing;
• intellectual property;
• maintenance services;
• project deliverables;
• payment obligations;
• service termination;

are governed by Kastrick's Terms of Service and any applicable written agreement.

If a conflict exists between this Privacy Policy and an applicable law governing personal information, the applicable law shall prevail to the extent of the conflict.

18. Contact Us

Questions regarding this Privacy Policy, Client Data, privacy rights, data export requests, deletion requests, or security practices may be submitted through Kastrick's official contact channel.

Official Contact Portal

https://kastricks.com/contact

When contacting us regarding privacy matters, please include sufficient information to identify the relevant project or account so we can process your request efficiently.

19. Summary of Client Data Rights

For convenience, the following summarizes the general rights described in this Privacy Policy.

Subject to applicable law, contractual obligations, identity verification, technical feasibility, and any outstanding obligations, Clients may request:

• Copies of Client-owned website content.
• Copies of Client-owned databases.
• Copies of uploaded media and documents.
• Export of API data belonging to the Client.
• Export of Client-owned filesystem data.
• Website source code where ownership has transferred under the applicable agreement.
• Backend source code only where it was expressly purchased or transferred under the applicable agreement.
• Copies of business records stored through Kastrick-managed services.
• Correction of inaccurate information.
• Deletion of Client Data where legally permissible.
• Information regarding how Client Data is processed.

These rights apply only to information the Client legally owns or is otherwise entitled to receive.

Nothing in this Privacy Policy requires Kastrick to disclose:

• proprietary software;
• reusable frameworks;
• internal development tools;
• deployment systems;
• security mechanisms;
• confidential information belonging to other Clients;
• information protected by law, court order, or contractual confidentiality obligations.

Kastrick - Contact

By using services provided by Kastrick, the Client acknowledges that they have read and understood this Privacy Policy.