What we hold, and why.

Who this covers

VALUEARC TECHNOLOGIES PRIVATE LIMITED ("ValueArc", "we", "us") operates www.valuearc.tech and the products and services described on it. This notice explains what personal data we collect through the website and in the course of client work, why we hold it, and what you can ask us to do about it.

Where we decide why and how your data is used — an enquiry you send us, this site's analytics — we are the data fiduciary, or controller under GDPR. Where we build or operate a system for a client and process data inside it on their instructions, that client is the fiduciary and we act as their processor. This notice describes the first case; the second is governed by the contract we sign with that client.

What we collect

We collect only what a given interaction needs:

• Enquiries. The name, work email, company, project type, budget range, timeline and free-text description you submit through the contact form, plus a phone or WhatsApp number if you choose to give one.
• Correspondence. Email, WhatsApp and call notes exchanged while we scope, deliver or support work.
• Client project data. Whatever a signed engagement requires us to access, held under that contract and its confidentiality terms.
• Analytics. If you accept analytics cookies, aggregate usage data about pages viewed, referrer, approximate region and device or browser type. Traffic and performance data is also collected by our host in aggregate.
• Applications. If you write to us about a role, the CV and details you send.

We do not ask for financial account details, government identifiers or special-category data through this website, and we ask you not to send them in the enquiry form.

Why we hold it, and on what basis

Enquiry details are used to reply to you, scope the work, prepare a proposal and — if we go ahead — deliver and support it. The lawful basis is our legitimate interest in responding to someone who has contacted us, and then performance of a contract once one exists.

Analytics are used to understand which pages are worth keeping and where the site is slow. The basis is your consent, which is why nothing analytics-related loads until you accept it.

Some records are kept because we are required to: invoices and tax records, and the correspondence that evidences a contract.

We do not sell personal data, we do not share it with advertising networks, and we do not use it to train models.

Who else touches it

We keep the processor list short and name it honestly:

• Supabase — the managed Postgres database holding contact form submissions and blog content.
• Our SMTP email provider — delivers the notification email raised by a new enquiry, and our replies to you.
• Plivo — sends an internal WhatsApp alert when an enquiry arrives, so it is not missed.
• Google Analytics 4 — site analytics, loaded only after you accept analytics cookies.
• Vercel — hosting, and aggregate traffic and performance analytics.

Each is bound by its own data-processing terms. Some of them, and some of our own staff and contractors, are located outside India; where data moves across a border we rely on the transfer terms in the relevant provider's agreement. We will name any additional processor here when we add one.

How long we keep it

Enquiries that do not become projects are kept for up to 24 months, so we have context if you come back, and then deleted. Project records are kept for the life of the engagement and for as long afterwards as our contract, professional obligations or Indian tax law require — commonly eight years for financial records. Analytics data follows the retention set in Google Analytics, currently 14 months. Job applications are kept for 12 months unless you ask us to remove them sooner.

How we protect it

Access is limited to the people who need it to answer you or do the agreed work. Administrative access to the database and mail systems is restricted to named individuals and protected by multi-factor authentication. Traffic to this site is encrypted in transit, and data at rest is encrypted by our database and hosting providers. Laptops used for client work are disk-encrypted.

No system is perfectly secure. If a breach affects your personal data, we will notify you and the Data Protection Board of India as required, without undue delay once we understand what happened.

Your rights

You can ask us to:

• tell you what personal data of yours we hold and why;
• correct anything inaccurate or incomplete;
• delete it, where we are not required to keep it;
• withdraw consent for analytics at any time, which you can also do yourself by clearing this site's stored preference;
• nominate someone to exercise these rights on your behalf, as the DPDP Act allows.

Write to neeraj@valuearc.co and we will respond within 30 days. If you are in the EU or UK you also have the right to complain to your local supervisory authority; in India you may escalate to the Data Protection Board if our response does not resolve matters.

Grievance redressal

Complaints about how we have handled personal data should go to our grievance officer at neeraj@valuearc.co, with "Grievance" in the subject line. We acknowledge within 72 hours and aim to resolve within 30 days. The officer's name and our registered office address are available on request and are being added to this page.

Children

This site and our services are aimed at businesses, not children. We do not knowingly collect personal data from anyone under 18. If you believe a child has sent us personal data, tell us and we will delete it.

Changes

When this notice changes materially we update the date at the top of this page and, where the change affects how we use data you have already given us, we tell you directly.