Privacy policy.

Who we are

GritFlair is a brand of GritFlair LLC, a Texas limited liability company (“we”, “us”). This policy covers gritflair.com and the enquiries you send us. For the details you send us here, we decide how they are used: under India’s Digital Personal Data Protection Act, 2023 (DPDP Act) we are the Data Fiduciary; under the Texas Data Privacy and Security Act (TDPSA), and under the EU and UK General Data Protection Regulation (GDPR and UK GDPR), we are the controller.

If you use GritFlair CRM through your employer or a business you work with, that business decides how its CRM data is used, and we process it on its behalf. Please contact that business first; we will help it reply.

What we collect

• What you send us. Through the contact or teardown form: your name, email, company (optional), what you need, an optional budget range, a website link and your message. If you email, call or WhatsApp us, we get what you send that way.
• Basic technical data. Our host, Cloudflare, processes your IP address, browser type and the pages requested, so it can deliver the site and block attacks.
• Nothing else. No analytics or advertising tools run on this website. We never ask for payment details here, and we ask you not to send sensitive information (such as health, financial or ID details) through the form.

Why we use it

• To reply to your enquiry, prepare a teardown, plan or quote, and work with you if you become a client. You give us these details for that purpose (a “legitimate use” under the DPDP Act, and steps you asked for before a contract).
• To keep basic business and tax records, where the law requires it.
• To keep the website secure.

Legal basis (EU and UK GDPR). Replying to you and preparing a quote: steps you asked for before a contract (Article 6(1)(b)). Keeping the site secure and following up on your own enquiry: our legitimate interests (Article 6(1)(f)), which you can object to at any time. Business and tax records: legal obligation (Article 6(1)(c)). Any marketing emails: your consent (Article 6(1)(a)).

We do not sell your personal data, use it for targeted advertising or profiling, or add you to a marketing list. We will only send marketing emails if you agree to them, and every one will have a way to stop them.

Who helps us

These service providers process your details only on our instructions, under their own security and data-protection terms:

• Cloudflare, Inc. (USA): hosts and protects this website and routes email sent to hello@gritflair.com.
• Formspree, Inc. (USA): receives what you type in our forms and delivers it to our inbox.
• Google LLC (USA): our email inbox (Gmail), where your enquiry is kept.
• WhatsApp (Meta Platforms): only if we offer WhatsApp and you choose to message us there.

The fonts on this site are stored on our own server, so your browser does not contact Google Fonts or any other font service.

Where your data is kept

Our providers store data mainly in the United States. If you are in the EU or UK, your data is transferred to the US with the safeguards the GDPR requires: the EU–US Data Privacy Framework (and its UK Extension) where the provider is certified, or the European Commission’s Standard Contractual Clauses with the UK Addendum. You can ask us for details. If you are in India, your data may be transferred outside India, which the DPDP Act allows except to countries the Government of India restricts. We will follow any such restriction.

How long we keep it

• Enquiries that do not lead to work: deleted within 24 months of our last contact.
• Client records: for as long as we work together, then as long as tax and accounting law requires (generally up to 8 years).
• You can ask us to delete your enquiry sooner at any time.

Security

The site is served only over HTTPS. Access to our inbox and accounts is limited to the people who need it and protected with two-step sign-in. No system is perfectly secure; if a breach affects your data, we will tell you and, where the law requires, the Data Protection Board of India or the relevant US authority, without undue delay.

Children

This website is for businesses. It is not meant for anyone under 18, and we do not knowingly collect their data.

Your rights

Everyone can ask us to see, correct or delete the details we hold about them.

In India (DPDP Act) you can also ask for a summary of your data and how we use it, have it completed or updated, withdraw any consent you gave (as easily as you gave it), have a grievance resolved, and nominate someone to use these rights for you if you die or cannot act. If you are not satisfied with our answer to a grievance, you can complain to the Data Protection Board of India.

In Texas and other US states with privacy laws (such as the TDPSA) you can confirm whether we process your data, get a copy in a portable format, correct it, delete it, and opt out of sale, targeted advertising and profiling (we do none of these). If we decline your request, you can appeal by replying to our answer with the word “Appeal”. If you are still not satisfied, you can contact the Texas Attorney General at texasattorneygeneral.gov.

In the EU and UK (GDPR and UK GDPR) you can also ask us to restrict how we use your data, object to processing based on our legitimate interests, receive your data in a portable format, and withdraw consent at any time. You can complain to the data protection authority in your country, or in the UK to the Information Commissioner’s Office (ico.org.uk), though we would like the chance to help first.

We reply within 30 days (one month under the GDPR), free of charge. We may ask you to confirm who you are before we act, so we never share your data with the wrong person.

How to contact us

Email hello@gritflair.com with the subject “Privacy request”. Privacy contact and grievance officer: Poornima Pathak, Founder & CEO, GritFlair LLC, Texas, USA.

Changes

If we change this policy, we will update it here and change the date below. If a change is significant, we will say so at the top of this page.

Last updated: 1 November 2026