Privacy Policy

Brand Bakery is a digital design and technology agency registered in India. We provide brand identity design, product design and development, AI-integrated digital experiences, strategic digital presence services, and a suite of free online tools for business owners and developers.

For any privacy-related queries, contact our designated Data Protection Point of Contact:

We use the information we collect for the following purposes:

• To respond to inquiries: processing and replying to messages you send via our contact form or email.
• To deliver our services: managing client projects, communicating project updates, and fulfilling service agreements.
• To improve our website and tools: understanding how visitors use our site to fix bugs, improve performance, and develop new features.
• To send marketing communications, only if you have expressly opted in to receive them. You may opt out at any time.
• To comply with legal obligations: meeting our obligations under applicable Indian law, including the DPDP Act, 2023 and the IT Act, 2000.
• To protect our legitimate interests: preventing fraud, ensuring the security of our systems, and enforcing our Terms of Service.

We will not use your personal data for automated decision-making that produces legal or similarly significant effects on you without your explicit consent.

Under the Digital Personal Data Protection Act, 2023, we process your personal data under the following lawful bases:

• Consent: where you have given us clear, informed consent to process your data for a specific purpose (e.g., marketing emails, AI agent interactions).
• Legitimate uses: where processing is necessary for purposes that are legitimately expected, such as responding to contact requests or providing the services you requested.
• Legal obligation: where we are required by law to process your data.

We do not sell, rent, or trade your personal data. We may share it only in the following circumstances:

• Service providers (Data Processors): We work with trusted third-party vendors who process data on our behalf, including cloud hosting providers (Vercel), analytics platforms, email delivery services, and AI API providers (Google Gemini, Sarvam AI). These vendors are contractually obligated to protect your data and may only use it for the specific purpose of providing services to us.
• Business transfers: If Brand Bakery is involved in a merger, acquisition, or asset sale, your personal data may be transferred as part of that transaction. We will notify you before your data is subject to a different privacy policy.
• Legal requirements: We may disclose your information if required to do so by law or in response to a valid request from a government authority, court order, or regulatory body under applicable Indian law.
• Protection of rights: We may disclose information where we believe it is necessary to investigate, prevent, or take action regarding illegal activities, suspected fraud, or violations of our Terms of Service.

We retain personal data only for as long as necessary for the purposes for which it was collected, or as required by law:

• Contact form submissions: Retained for up to 3 years unless you request earlier deletion, or unless we enter a business relationship that necessitates longer retention.
• Client project data: Retained for the duration of the project engagement and for 5 years after completion for accounting and legal compliance.
• Website analytics data: Aggregated, anonymised analytics data is retained indefinitely. Identifiable analytics data (e.g., IP-based) is anonymised or deleted within 26 months.
• AI agent transcripts: Any temporary transcripts are purged within 30 days.

When your data is no longer needed, we securely delete or anonymise it.

We use cookies and similar technologies to operate and improve our website. A cookie is a small text file stored on your device when you visit our site.

Brand Bakery is based in India. Some of our service providers are located outside India (e.g., Vercel in the United States, Google in the United States). When we transfer your data outside India, we ensure that adequate safeguards are in place as required by the DPDP Act, 2023, and any applicable Government of India notifications on cross-border data transfers.

As a Data Principal under the Digital Personal Data Protection Act, 2023, you have the following rights:

• Right to access: You may request a summary of the personal data we hold about you and the purposes for which it is processed.
• Right to correction: You may request that we correct inaccurate or incomplete personal data.
• Right to erasure: You may request that we erase your personal data, subject to our legal retention obligations.
• Right to grievance redressal: You may raise a grievance with us and expect a response within a reasonable time.
• Right to nominate: You may nominate another person to exercise your data rights on your behalf in the event of your death or incapacity.
• Right to withdraw consent: Where we rely on your consent to process data, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.

To exercise any of these rights, email us at support@brandbakery.tech with the subject line “Data Privacy Request”. We will respond within 30 days.

If you are dissatisfied with our response, you may lodge a complaint with the Data Protection Board of India once it is constituted under the DPDP Act, 2023.

We implement industry-standard technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These include:

• HTTPS encryption for all data in transit.
• Access controls limiting who within our team can access your data.
• Regular security reviews of our systems.
• Working only with service providers who maintain appropriate security standards.

No method of transmission over the Internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security. If you become aware of any security vulnerability related to our services, please notify us immediately at support@brandbakery.tech.

Our website and services are not directed to children under the age of 18. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected such data, please contact us immediately and we will delete it.

Our website may contain links to external websites (e.g., portfolio references, tool integrations). We are not responsible for the privacy practices of those sites. We encourage you to review their privacy policies before providing any personal data.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Update the “Last updated” date at the top of this page.
• Where required by law, notify you by email or by a prominent notice on our website.

Continued use of our website after changes are posted constitutes your acknowledgement of the revised policy.

For questions, concerns, or requests related to this Privacy Policy or your personal data, please reach out: