Privacy policy

Who this is

SamaStack is a software studio based in Hyderabad, India. For anything about your information, write to hello@samastack.com and a person will answer.

What we collect on this website

Five things, and only five.

What you type into the enquiry form. Your name, your email address, your phone number, what you said you are interested in, and a short note about your business. If you book a call back, the day and time you picked, so a person can call you then. Which page you sent it from is recorded too. If you used the scope builder, the layers you picked, the timeline and price shown, and, if you gave them, the software you use today and your team size are included so we can reply usefully. Your phone number is used only to call you about your enquiry.

A private copy of each enquiry on our server. Because email can go astray, the server keeps one line per enquiry in a file outside the web folder, where it cannot be opened from the internet: what you typed, the time, a reference number, whether the email went out, a scrambled fingerprint of the sending address (a one way hash, never the address itself) and the name of your browser. It exists so that no enquiry is lost and so we can find yours if you ask about it.

A count of pages opened. Every page asks our own server to add one line to a private file: the time, which page, which website you arrived from if any, the name of your browser, and a scrambled fingerprint made from the day, your address and your browser, so that two views by the same person on the same day can be told apart from two different people. The fingerprint changes every day and cannot be turned back into an address. Nothing is stored on your device for this, so there is nothing to accept or refuse, and the file is deleted after twelve months.

Anonymous usage statistics from Google Analytics. This records which pages are opened, roughly where in the world the visitor is, and how they arrived. Your IP address is shortened before it is stored. In the European Economic Area, the United Kingdom and Switzerland it stays switched off until you accept the banner. Everywhere else it is on when you arrive, and one click on this page switches it off for good in that browser.

A short lived abuse check on the enquiry form. When the form is submitted, our server keeps the same scrambled fingerprint of the sending address for fifteen minutes, purely to stop a script flooding our inbox. It is never shared and deletes itself.

Beyond this website

Emails you send us. We keep them to reply, and for as long as the conversation needs them.

Payments from clients. Clients pay by bank transfer in India, and by the method agreed with each client outside India. Payment details are exchanged privately with the contract, never through this website. Payment details are shared privately with your contract. We will only ever ask you to pay to the account named in your signed contract. If a payment provider is used for a client, it will be named here as a processor at that time.

Calls. If we call you back, we may note what was agreed so the next person who writes to you knows it. We do not record calls.

What we send you

One email, automatically, when your enquiry has reached us: it repeats what you sent, gives you the reference number, and says what happens next. That is the only automatic message this site sends. Everything after it is written by a person. We do not add you to a mailing list, and there is nothing to unsubscribe from. If we ever offer guides by email, you will be asked separately, with a box that is not ticked for you.

What we do not collect

We do not run accounts, logins or passwords on this website. There is no customer database behind it: your enquiry lives in our mailbox and in the private file described above, and nowhere else. We do not take payments here, so no card or bank details ever reach us through this site. We do not buy information about you, we do not sell or rent anything you give us, and we do not use it to advertise to you elsewhere.

Why we hold it, and on what basis

Enquiry details are used to reply to your enquiry and to prepare a quote if you want one. The lawful basis is your own request: you sent it so that we would get in touch. The count of pages opened, and Google Analytics where it runs without a banner, are used to see which pages actually help people. In the European Economic Area, the United Kingdom and Switzerland the basis for analytics is your consent, asked for in the banner. Elsewhere the basis is our legitimate interest in knowing whether this website works, weighed against a count that identifies nobody, and you can switch it off in one click at any time.

Who else sees it

Your enquiry arrives as an email in a mailbox we control, hosted by our web and email hosting provider, who processes it only to deliver the message. The website, the enquiry form and the private copy are hosted by Hostinger, our web hosting provider. Analytics data is processed by Google, through Google Analytics 4. Nobody else receives your information, and we do not pass it to other businesses.

Where it goes

Our hosting is in India. Google Analytics may process data on servers outside India, including in the United States, under the safeguards Google publishes for international transfers. If you would rather this did not happen, decline analytics and it will not.

How long we keep it

Enquiry emails and the private copy are kept while a conversation is live and for up to two years afterwards, so that we can pick up where we left off if you come back. Ask us to delete yours sooner and we will remove both. Records about clients are kept for as long as the contract and Indian tax law require. The count of pages opened is kept for twelve months and then deleted automatically. Google Analytics records are kept for fourteen months and are not linked to your name.

Your rights

Under India's Digital Personal Data Protection Act 2023 and its Rules, you can ask what we hold about you and who we shared it with, ask for it to be corrected, completed or brought up to date, ask for it to be deleted, withdraw your consent as easily as you gave it, and name someone to use these rights for you if you die or cannot. You can switch analytics off whenever you like, with the link in the Cookies section below, through the cookie choice where this site shows one, or by clearing this site's data in your browser. Write to hello@samastack.com and we will act within thirty days. If you are not satisfied with our answer, that email is also our grievance contact, and in India you may then complain to the Data Protection Board of India. If you are in the European Economic Area or the United Kingdom you may also complain to your national data protection authority.

If you are outside India

We work with clients in other countries, and their own privacy laws apply to them as well as ours. In the UAE: the Federal Decree Law No. 45 of 2021 on the Protection of Personal Data. In the Philippines: the Data Privacy Act of 2012 (Republic Act 10173). In the United Kingdom and the European Union: the UK GDPR and the EU GDPR, which is why analytics waits for your consent there. In the United States, state privacy laws vary; we offer everyone the same rights described above. Whichever law applies to you, use your rights the same way: write to hello@samastack.com.

Cookies

This website sets no cookies of its own, and the count of pages opened uses none either. If Google Analytics is running, it sets cookies to tell repeat visits apart from new ones. In the European Economic Area, the United Kingdom and Switzerland nothing is set until you accept the banner. Elsewhere analytics starts on, and this link switches it off in this browser and remembers that: switch analytics off. Refusing changes nothing about how the site works: every page, the scope builder and the enquiry form all behave exactly the same.

Data inside the systems we run for clients

When we build and run software for a client, the client decides what it collects about its own customers and staff, and we handle that data only on the client's instructions, to run the system. In the words of the law, the client is the data fiduciary and we are its processor. The client's own privacy notice covers that data; our part is set out in our terms and in the client's contract.

Security

Every page and the enquiry form are served over HTTPS. Access to enquiries, the private copy and client systems is limited to the people who need it for the work. If a breach ever affects your information, we will tell you and the Data Protection Board of India as the law requires.

Children

This site is aimed at businesses and is not directed at children. We do not knowingly collect anything about anyone under eighteen.

Changes

If this policy changes, the date below changes with it. Material changes will be obvious on this page rather than buried, and we will send you the previous version if you ask.

Last updated 11 October 2026 · Privacy · Terms · Accessibility · hello@samastack.com