Privacy policy.

Last updated: 8 November 2026 · Version 1.0

This policy explains how Kumo Works (“kumoworks”, “we”, “us”) collects, uses, shares, and protects personal data. It applies to this website and to enquiries and bookings made through it. It does not replace the data processing agreement (DPA) we sign with clients for delivery work; where those documents conflict, the DPA and the signed contract prevail for client data.

1. Who we are

Kumo Works is a studio based in Bengaluru, India. For questions about this policy, contact [email protected]. For data protection grievances, write to the same address with “Grievance” in the subject line.

2. What we collect

Website enquiries and bookings

• Identity and contact data: name, email address, phone number (if you provide it), company name, role.
• Enquiry data: the workflow you want to discuss, your message, preferred times, and any context you choose to share.
• Booking data: the time you select, the meeting link, and any questions the scheduling provider asks. Our scheduling provider is Calendly; Google Meet provides the video call.
• Technical data: IP address, browser type, device type, pages viewed, referring URL, and server logs. We use this to keep the site working and understand aggregate interest.

Client delivery data

When we deliver a workflow, we may access business data (for example, customer messages, invoices, or CRM records) as a data processor acting on your instructions. That processing is governed by the DPA and the statement of work. We access only what the workflow needs, and we do not use it for our own purposes or to train models.

What we do not collect

We do not ask for passwords, payment card numbers, government IDs, health data, or biometric data through this website. If someone claiming to be from kumoworks asks for those, verify by emailing [email protected].

3. Why we use it

• To respond to you and schedule a call. We use your contact and enquiry data for that purpose.
• To prepare for the call. We may review the context you share so the conversation is useful.
• To deliver and improve our services. We use client data only under the DPA and only for the agreed workflow.
• To keep the site secure and understand aggregate use. We use technical logs and, if enabled, privacy-friendly analytics without advertising cookies.
• To meet legal obligations. For example, tax and accounting records.

Under India’s Digital Personal Data Protection Act, 2023 (DPDP Act), we rely on your consent for website enquiries and marketing communications, and on the performance of a contract or your instructions for delivery work. You can withdraw consent at any time; that does not affect processing already carried out.

4. Cookies and third parties

This site does not use advertising or cross-site tracking cookies. We use Cloudflare Web Analytics, a cookieless analytics service that reports aggregate traffic — pages, referrers, country, device, and Core Web Vitals — without setting cookies or building an individual profile. If we add another analytics tool, it will be cookieless or consent-gated. The Calendly booking widget and Google Meet may set cookies or similar technologies when you interact with them; those are controlled by those providers. See Cloudflare’s privacy policy, Calendly’s privacy policy, and Google’s privacy policy.

You can block cookies in your browser. The site will still work; the booking widget may not.

5. Who we share it with

We share personal data only with service providers who help us run the business, and only as needed:

• Scheduling and video: Calendly, Google Meet.
• Email and documents: our email and workspace provider.
• Hosting and infrastructure: our website host and cloud provider.
• Analytics: Cloudflare Web Analytics (cookieless, aggregate); Plausible or Umami if enabled later.
• Professional advisers: accountants and lawyers, where necessary.

We do not sell personal data. We may disclose data if required by law or to protect our rights, and we will tell you unless legally prohibited. A current list of sub-processors for delivery work is available on request and is included in client DPAs.

6. Where it goes

We are based in India and aim to keep personal data in India where practical. Some service providers may process data outside India. Where that happens, we use contractual safeguards and select providers with appropriate security commitments. For client delivery, hosting location is agreed in the statement of work.

7. How long we keep it

• Website enquiries and booking data: up to 24 months from the last interaction, unless you ask us to delete it sooner.
• Client delivery data: for the period in the DPA, then deleted or returned.
• Server logs: up to 90 days.
• Analytics: aggregate only; no individual profile.
• Invoices and tax records: as required by Indian law.

8. How we protect it

We use encryption in transit, access controls, least-privilege credentials, separate environments, and a documented incident response process. No system is perfectly secure. If a personal data breach affects you, we will notify you and the relevant authority as required by applicable law.

9. Your rights

Subject to applicable law, you can ask us to:

• confirm what personal data we hold about you and provide a copy;
• correct inaccurate data;
• erase data we no longer need;
• withdraw consent for future processing;
• nominate someone to exercise your rights in the event of death or incapacity.

Email [email protected] with “Data request” in the subject. We will respond within 30 days. We may need to verify your identity. If you are unhappy with our response, you can complain to the Data Protection Board of India.

10. Children

This site and our services are for businesses and adults. We do not knowingly collect personal data from children under 18. If you believe a child has provided data, contact us and we will delete it.

11. Changes

We may update this policy. The version and date at the top will change, and material changes will be announced on this page. Continued use of the site after an update means you accept the revised policy.

12. Contact

Kumo Works
Bengaluru, India
Email: [email protected]
Phone: +91 80 4000 0000

This policy is a good-faith summary of our practices. It is not legal advice. If you need a signed DPA or a security questionnaire completed, ask us.