Privacy notice | Godwit AI Labs

Who we are

Godwit AI Labs Pvt. Ltd., 911-912, 9th Floor, ILD Trade Centre, Sector 47, Gurugram, Haryana – 122018, India, is the data fiduciary for personal data collected through this website. Anything on this page (a question, a request, or a complaint) reaches Sushil Srivastwa, Grievance Officer, at privacy@godwit-tech.com.

What we collect

One thing: what you type into the contact form. Your work email, plus whatever else you choose to give us (name, phone, organisation, role) and your message and the enquiry category, and the answers you pick about the work: the kind of place, when you need it, and the few questions asked for that service. If you ask us to call you back instead, it is your name, your number and the time you chose, with an email only if you add one. If you ring, message or meet us, we note the same kind of details so we can follow up. We use it to reply, and if the conversation goes somewhere, to scope and quote the work. That is the only purpose it has.

Stored with it, because a public form is a target: the page you were on when you sent it, your browser’s user-agent string, and a one-way hash of your IP address that lets us stop a single source flooding the form. The hash cannot be turned back into an address. To keep automated submissions out, your browser also solves a small puzzle before the form is sent (it takes under a second and sends nothing anywhere), and we check that your email address’s domain can receive mail, with a public DNS lookup of the domain only (the part after the @), never the address itself. If you arrived from one of our emails or articles, a short label saying which (such as “email-network”) is kept with it, so we know which of them was useful. A tap on our phone number, WhatsApp or email address is counted per page and per day, with nothing about who tapped. We also keep the exact wording you agreed to and its version, so there is a record of what you were actually told rather than what we later say you were told.

What we remove before storing it. People describing an IT problem sometimes paste more than they meant to. Before your message is stored or emailed to anyone, we remove the secrets and identity numbers we recognise: passwords and keys (including those in pasted configurations and connection strings), access tokens, payment card numbers, Aadhaar numbers, PANs and bank account numbers. We keep only a note of what kind of thing was removed, never the value, and the page tells you when it happens. No filter catches every format, so please do not send them at all; if we need one, we will ask for it another way.

Free tools. The free tools on this site work in your own browser. A file you choose, text you paste, and the answers and figures you type are read there, and are not sent to us or stored. Three tools use our server. The email security check looks up your domain’s public DNS records once. The certificate check makes one ordinary https connection to the site you name and reads its certificate and public DNS records. The website DPDP check opens the one web page you name, and the privacy notice it links, in a browser on our server in India, the way a first-time visitor would: it clicks nothing but a cookie banner’s reject button, and types and submits nothing. None of them keeps anything about the check except an anonymous count of how many checks ran that day; the address you enter is not logged. If you ask for the full report, we record your name, email and organisation as an enquiry, with a one-line summary of the result: the tool, the domain or website checked or the headline figures, how many findings of each kind, and the short titles of the main ones (for example, “Windows Server 2012 R2 ×2”). Never your file, your pasted text, the names or addresses of your systems, or the detailed findings. The terms say what the results are, and are not.

Analytics, but only if you agree. We use Google Analytics to see which pages are worth keeping. It stores an identifier in your browser and tells Google which pages you looked at and roughly where you are. None of it loads (no script, no identifier, no request to Google) unless you accept the banner. Decline and we remember that, and never ask again for a year. We run no advertising, and advertising signals are switched off in the configuration.

Change your mind

Either direction, at any time. Declining also clears anything already stored.

Who else touches it

Two companies, each doing one job, none of them using your data for anything beyond it:

GoDaddy provides the server this site runs on: the website, the code that receives the form, and the database your enquiry is stored in. We run all of it ourselves on that server. Serving any website produces server logs that include IP addresses.
Resend delivers the notification to us and the acknowledgement to you.

When the form or the email security check needs to look up a domain (the part of an email address after the @, or a domain you type into the check), the lookup goes to the public DNS services of Cloudflare and Google, which see the domain name only.

We do not sell personal data, share it with advertisers, or use it to train anything.

How long we keep it

Enquiries are erased 24 months after they arrive. The date is set by the database when the row is written and a scheduled job does the erasing, so it does not depend on anyone remembering. If you become a client, engagement records are kept for as long as the contract and Indian tax and company law require.

Your rights

You can ask us to confirm what we hold about you, correct it, complete it, update it or erase it, and you can withdraw your consent at any time. Withdrawing is one email, and no harder than giving it was. You can also nominate someone to use these rights for you if you die or become unable to. There is no charge, and we will come back to you inside 30 days.

Ask for your data, or ask us to delete it

Enter the address you contacted us from. We will email you a confirmation link: we act only once you click it, so that nobody else can request your data or have it erased on your behalf. The link is valid for 48 hours.

We answer the same way whether or not we hold anything for an address: whether someone has contacted us is itself personal information.

If we get it wrong

Tell Sushil Srivastwa, Grievance Officer, at privacy@godwit-tech.com and we will look at it. If you are not satisfied with how we handle it, you can take it to the Data Protection Board of India.

Changes

If this notice changes in a way that affects data we already hold about you, we will tell you directly. Otherwise the date at the top moves.