Privacy Policy

1. Data Controller Information

This Privacy Policy applies to HEWN CRAFT STUDIO (hereinafter referred to as "HEWN CRAFT", "we", "us", or "our"), founded and operated by Dharmik Gohil, headquartered in Surat, Gujarat, India.

HEWN CRAFT acts as the primary Data Controller for personal data gathered directly via our website (hewncraftstudio.tech), lead forms, communication channels, and direct inquiry portals. When executing custom software development, CRM integrations, ERPNext implementations, or client-hosted VR/AR environments, HEWN CRAFT acts as a Data Processor under strict client agreements.

2. Personal Data We Collect

We adhere to strict data minimization principles. We only collect personal information strictly necessary for contract fulfillment, client communication, technical provisioning, and business operations.

A. Information You Provide Voluntarily

• Contact & Identity Data: Full name, professional email address, mobile phone number, job title, and company legal name provided during contact inquiries or consultation requests.
• Project Scope Requirements: Technical specifications, architecture goals, target platform choices, budget estimations, and custom notes submitted via lead forms.
• Job Applicant Data: Resumes, portfolios, code repository links, and application notes submitted via our Careers portal.
• Billing & Financial Metadata: Company tax identifiers (GST/VAT/EIN), billing address, invoice records, and bank transfer metadata. Payment details are processed by compliant gateway providers; HEWN CRAFT does not store raw credit card numbers.

3. Technical, Usage & Spatial Sensor Telemetry

When accessing our digital platforms, web applications, or spatial computing demonstrations, automated systems collect non-identifiable technical diagnostics:

4. How We Use Collected Data

We process personal and technical data exclusively under lawful bases outlined in global privacy legislation:

1. Contractual Performance: To fulfill project agreements, deliver custom software, deploy ERPNext/CRM platforms, and provide ongoing technical support.
2. Legitimate Business Interests: To maintain system security, audit server stability, prevent fraud, and refine our service capabilities.
3. Explicit Consent: To send requested project quotes, respond to developer applications, or distribute technical research newsletters.
4. Legal Obligation: To maintain tax invoices, accounting records, and comply with legal requirements under Indian law and international trade regulations.

5. Cookies & Tracking Technologies

Our website utilizes essential and analytical cookies to ensure optimal performance:

• Strictly Necessary Cookies: Essential for core website functionality, security tokens, and state preservation during session navigation.
• Performance & Analytics Cookies: We utilize Google Analytics (Tag ID: G-D68W62EP5J) configured with IP anonymization to analyze aggregate site traffic patterns and user behavior.

You can disable non-essential cookies at any time through your browser's security settings. Disabling cookies will not hinder your access to core studio information.

6. Data Sharing & Third-Party Processors

We engage vetted third-party service providers solely to perform essential infrastructure operations under strict data protection addendums (DPAs):

• Infrastructure & Hosting: Vercel Inc., Amazon Web Services (AWS), and Cloudflare for global CDN delivery, static asset hosting, and edge network security.
• Form Integration APIs: SheetDB API for secure HTTP transmission of lead inquiry records into encrypted database repositories.
• Analytics Services: Google LLC for site traffic metrics under anonymized measurement protocol.
• Legal Requirements: Disclosure to law enforcement or legal authorities if mandatory under valid court orders or legal process.

7. Encryption & Data Retention Protocols

We implement bank-grade technical and organizational safeguards to ensure data security:

• Data Encryption: All data transmitted to or from our infrastructure is encrypted in transit using Transport Layer Security (TLS 1.3/HTTPS). Stored database records are encrypted at rest using AES-256 standards.
• Access Security: Administrative access to client databases and server environments is restricted to authorized studio personnel via multi-factor authentication (MFA) and SSH key authorization.
• Retention Schedule: Active client data is retained for the duration of the engagement contract plus 7 years to meet tax, accounting, and warranty audit mandates. Lead inquiries without active contracts are purged after 24 months.

8. Your International Privacy Rights

Depending on your physical jurisdiction, you possess specific statutory rights regarding your personal data under the EU General Data Protection Regulation (GDPR), California Consumer Privacy Act (CCPA), and India Digital Personal Data Protection (DPDP) Act 2023:

• Right to Access: Request a copy of all personal information held regarding you.
• Right to Rectification: Request correction of inaccurate or incomplete records.
• Right to Erasure ("Right to be Forgotten"): Request complete deletion of your personal data, subject to statutory retention obligations.
• Right to Restrict & Object: Limit or object to specific processing activities.
• Right to Data Portability: Receive your data in a structured, machine-readable JSON/CSV format.

To exercise any of these rights, contact our Data Protection Officer at hewncraftstudio@gmail.com. Requests are fulfilled within 30 business days at zero cost.

9. Children's Privacy Protocol

HEWN CRAFT STUDIO services and software engineering products are exclusively designed for enterprise clients, businesses, and adults over 18 years of age. We do not knowingly collect personal information from individuals under the age of 18. If you believe a minor has provided us with personal data, please contact us immediately for swift record removal.

10. Policy Updates & DPO Contact

We reserve the right to modify this Privacy Policy periodically to reflect technological advancements, operational changes, or statutory requirements. All changes take effect immediately upon publication with an updated "Last Updated" timestamp.