Visit statistics through Google Analytics and nothing more: no advertising, no other cookies, and a contact form that never sends us anything you did not press send on yourself. Here is the long version.
Last updated 14 September 2026
Mujammil Mahaldar and Shivangi Gupta, trading as Devkiln, of 94-D, Kamgar Nagar, Kurla East, Mumbai, Maharashtra 400024, India. Under the Digital Personal Data Protection Act, 2023 we are the Data Fiduciary for personal data collected through this website.
This policy explains what we collect, why, who else sees it, and what you can make us do about it.
We use Google Analytics to count visits: which pages are opened, roughly where from, and how people found the site. It sets its own cookies to do that. Beyond that there is no advertising, no other cookie, no tracking pixel and no visitor database of our own.
The contact form does not send anything to us — it opens your own email app with the message filled in, and you press send. So apart from those visit statistics, the only personal data that reaches us from this site is the email you chose to send us.
Everything below is the long version of those two paragraphs, plus what happens once you become a client.
Visit statistics, through Google Analytics. On every page, a script from Google records the page you opened, the page or search that sent you here, your browser, device type and screen size, and an approximate location (city and country) worked out from your IP address. It stores a random identifier in cookies named _ga and _ga_ followed by an ID, so a second visit from the same browser is counted as a returning visitor rather than a new one. Google states that Analytics 4 does not log or store IP addresses.
We use this only to see, in aggregate reports, which pages are read and where visitors come from. We do not try to work out who you are, we do not combine it with the emails we receive, and we do not use it for advertising. Google keeps the data for the retention period set in our Analytics account, under its own privacy policy.
To opt out, block cookies for this site in your browser or install Google's Analytics opt-out browser add-on. The site works exactly the same either way.
Apart from those Analytics cookies the site sets none, and there is no account to create. Our hosting provider also keeps standard server logs — IP address, the page requested, browser type, timestamp — for security and to keep the site up. These are generated automatically by the infrastructure, are kept for a short retention period set by the provider, and we do not mine them or link them to a person.
Worth being precise, because most sites describe this wrongly. The form on this site does not post your details to a server. When you press send, your browser opens your own mail application with a message pre-written to us, and nothing leaves your device until you send that email yourself.
That means: if you close the mail window, we never receive anything. And what we do receive is an ordinary email — your name, your email address, and what you told us — sitting in our inbox, subject to our email provider's terms.
Typefaces on this site are served by Google Fonts. Loading them sends your IP address and basic request headers to Google, which is enough for them to know a browser at your address opened a page that uses those fonts. We have no control over what Google does with that, and their privacy policy applies.
We would rather this were not the case and intend to serve the fonts ourselves, which removes that request entirely. Until that is done, this disclosure stands.
The Google Analytics script described in section 3 is also loaded from Google, and sends its measurements back to Google.
Nothing else on the page calls a third party. No maps, no embedded video, no chat widget, no advertising network.
Enough to do the work and to invoice you: your name, business name, email, phone number, billing address, and tax registration numbers where they apply. Plus whatever you tell us about the project.
We collect this because we have a contract with you and cannot perform it otherwise. We do not use it for marketing, we do not build a mailing list out of it, and we do not sell it to anyone — that last one is not a policy position, it is simply not a business we are in.
Building and maintaining a system usually means we can see the data inside it — your customers, your staff, your orders. For that data you are the Data Fiduciary and we are a Data Processor: it is yours, we only touch it to do the job you asked for, and we act on your instructions.
We do not copy it out, we do not use it to train anything, and we do not use it for any purpose of our own. Where we need a copy to reproduce a bug, we use the smallest amount that will do and delete it afterwards.
If your work involves sensitive categories — health records, financial data, children's data — say so at the start, because it changes how we set the project up.
A short list, and only where the job needs it: Google, for the website statistics in section 3; our hosting and infrastructure providers; our email provider; our payment and banking providers; and our accountant for the purposes of tax filing.
We do not share personal data with anyone else. There is no advertising partner, no data broker, no affiliate network.
We may disclose data where a law, a court, or a lawful government request requires it. Where we are permitted to tell you first, we will.
Our analytics, our email and some infrastructure are operated by providers whose servers may sit outside India. Where personal data is transferred out of India, it is done on the basis permitted under the DPDP Act, 2023 and subject to any restrictions the Central Government notifies.
If your project has a requirement that data stays inside India, tell us before we start — it is a decision about architecture, and it is much cheaper to make at the beginning than at the end.
Enquiries that do not become projects: we clear these out once it is obvious nothing is happening.
Client records: for as long as you are a client, and afterwards for as long as tax law requires us to keep books and invoices. That period is set by statute, not by us.
Data inside a system we built for you: for as long as your arrangement with us runs. When it ends, we hand it over and delete our copies, other than backups that expire on their own schedule.
Under the Digital Personal Data Protection Act, 2023 you can ask us to:
Write to mujammilmaldar65@gmail.com and we will act on it. There is no form to fill in and no fee.
If something we have done with your data bothers you, raise it with our Grievance Officer:
Mujammil Mahaldar
mujammilmaldar65@gmail.com
94-D, Kamgar Nagar, Kurla East, Mumbai, Maharashtra 400024
We acknowledge within one working day and aim to resolve it inside thirty days. If you are not satisfied with how we handle it, you can take the complaint to the Data Protection Board of India.
This site is not aimed at children and we do not knowingly collect personal data from anyone under 18. If you believe a child has sent us something, tell us and we will delete it.
Where a project we build for a client processes children's data, the verifiable-consent and no-tracking requirements of the DPDP Act apply, and we will design for them explicitly rather than assume them.
Access to client systems is limited to the two of us. We use unique credentials per service, multi-factor authentication where it is offered, and encrypted connections throughout.
No arrangement is perfectly secure, and we will not pretend otherwise. If a breach affects your personal data we will tell you and the Data Protection Board, with what happened, what was affected, and what we are doing about it — quickly, and without waiting until we have a tidy story.
We have closed one production security issue inside 48 hours of finding it, and that is the standard we hold ourselves to.
When the site changes, this page changes with it — particularly sections 3, 4 and 5, which describe how the code actually behaves today.
The date at the top is the date of the current version.
mujammilmaldar65@gmail.com or shivangi.gupta9324@gmail.com. A person reads both.