/legal · privacy

Privacy Policy

Effective Date: July 15, 2026 · Last updated: September 1, 2026

1. Who We Are

This Site — codejainfotech.com (the "Site") — is operated by Codeja Infotech ("we," "our," or "us"), a digital engineering studio based in Pune, Maharashtra, India. For the purposes of India's Digital Personal Data Protection Act, 2023 (the "DPDP Act"), we are the Data Fiduciary for personal data collected through this Site.

This Privacy Policy explains what personal data we collect, why, who we share it with, how long we keep it, and the rights you have. It covers the Site and the purchase of our software products (Quicky and Bonky). The apps themselves are covered by their own policies — see Quicky and Bonky — and, in short, they collect nothing.

WhatsApp messaging for businesses we serve. Some businesses — for example salons — use our WhatsApp-based booking and messaging product to communicate with their own customers. In that arrangement the business is the one you are a customer of, and it decides what messages are sent and why. Codeja Infotech acts as its technology provider, processing that information on the business's instructions and not for our own purposes. We do not sell this data, and we do not use one business's customer data to serve another. See Section 15.

2. Information We Collect

When you contact us: Through our ./contact form we collect your Name, Email Address, and Project Brief / Message. Submission is handled by our form provider (Web3Forms), which relays it to us by email.
When you buy a product: We collect the email address you enter at checkout so we can send your license key. Your payment (card, UPI, netbanking, wallet, or PayPal) is processed by our payment gateway — we never see or store your full card number, CVV, UPI PIN, or bank credentials. We receive only a confirmation, an order/payment reference, and the amount.
Automatically: Like every website, our host records standard server logs — IP address, browser/user-agent, and pages requested — for security, abuse-prevention, and reliability.
On your device: We store a small cookieConsent flag in your browser's local storage to remember your cookie choice, and (as a Progressive Web App) a service-worker cache so the Site loads offline. These are functional, stay on your device, and are not used to track you.

We use Google Tag Manager to load Google Analytics for basic traffic measurement. By default — and if you decline — analytics and advertising storage are turned off using Google Consent Mode, so no analytics cookies are set (Google may receive only anonymous, cookieless signals). Analytics cookies are set only after you select ./accept-all in the cookie banner, and you can withdraw consent at any time by clearing your choice. We do not run advertising, remarketing, or Meta/ad-network pixels, and we never sell your data.

3. Why We Use It, and Our Legal Basis

Under the DPDP Act we process your personal data with your consent and for the following legitimate purposes:

To respond to your inquiries and provide estimates (consent).
To fulfil your purchase — verify payment, issue your license key, and provide support (performance of the transaction you requested).
To keep the Site secure and prevent fraud and abuse (legitimate use).
To meet legal, accounting, and tax obligations in India, including retaining invoices and transaction records (legal obligation).

We do not sell, rent, or trade your personal data, and we do not use it for automated profiling or advertising.

4. Payments

Purchases on this Site are processed by Razorpay (for cards, UPI, netbanking, and wallets) and, for international buyers, PayPal via Razorpay Checkout. These providers are the parties that collect and handle your payment details, under their own privacy policies and PCI-DSS security standards. We receive only the information needed to confirm your order and issue your license — not your financial credentials. Your license key is delivered to your email through our transactional email provider (Resend).

5. Who We Share It With

We share the minimum necessary data with service providers ("Data Processors") who act on our instructions:

Web3Forms — delivers contact-form submissions to us.
Razorpay and PayPal — process payments.
Resend — sends your license-key and support emails.
Vercel — hosts the Site and generates server logs.
Google (Tag Manager & Analytics) — measures site traffic, and only after you accept analytics cookies via the cookie banner.
Meta Platforms — messages sent through our WhatsApp product are delivered over the WhatsApp Business Platform, so message content and the phone numbers involved pass through Meta's infrastructure. Meta processes them under its own WhatsApp Privacy Policy and Meta Privacy Policy. We do not control Meta's handling of that data.
The business you booked with — where you are a customer of a business using our WhatsApp product, that business has access to the records of its own customers, including your contact details, your bookings and the message history between you.

We may also disclose data where required by law or to protect our legal rights. We do not share your data with anyone else.

6. How Long We Keep It

We keep contact-form messages only as long as needed to handle your inquiry and our relationship. Purchase and tax records are retained for as long as Indian law requires (financial and tax records are generally kept for up to eight years), and license records are kept for the lifetime of your license so we can validate and support it. When data is no longer needed, we delete or anonymise it.

7. Cookies & Local Storage

Before you choose — and if you decline — we use only essential and functional browser storage: the cookieConsent preference and the PWA offline cache. If you select ./accept-all, Google Analytics (loaded via Google Tag Manager) also sets first-party measurement cookies so we can understand site traffic. You can decline via the cookie banner, clear this storage in your browser at any time, or block it in your browser settings — the Site will still work. We do not set advertising or cross-site tracking cookies.

8. International Data Transfers

We operate from India and serve customers worldwide. Some of our processors (e.g., Vercel, PayPal, Resend) may store or process data on servers outside India. Where this happens, we rely on providers that offer appropriate contractual and security safeguards for your data.

Messages sent through the WhatsApp Business Platform are transmitted and processed by Meta, which operates infrastructure outside India. Where this results in a transfer of your data outside your country, that transfer is governed by Meta's own terms and safeguards, which we do not control.

9. Your Rights

Subject to applicable law — the DPDP Act in India, and where relevant the GDPR (EU/UK) or CCPA (California) — you may:

Access a summary of the personal data we hold about you, and request its correction, completion, or updating.
Request erasure of your personal data where it is no longer needed and no law requires us to keep it.
Withdraw your consent at any time (this does not affect processing already carried out).
Nominate another person to exercise your rights in the event of death or incapacity (DPDP Act).

To exercise any of these, email support@codejainfotech.com. We may need to verify your identity before acting on a request.

If you are a customer of a business that uses our WhatsApp product, that business decides what is collected about you and why, so it is the right first point of contact for access, correction, erasure or any question about the messages you receive from it. If you contact us directly we will pass your request to that business and support them in answering it.

10. Grievance Redressal

If you have a concern about how we handle your personal data, contact our Grievance Officer, Akshay Dodeja, at support@codejainfotech.com (subject line: "Data Grievance"). We will acknowledge and address your grievance within the timelines required by law. If you are in India and remain unsatisfied, you have the right to complain to the Data Protection Board of India.

If your concern is about messages you received from a business that uses our WhatsApp product, contact that business first — it decides what is sent to its customers. You can also reach our Grievance Officer at the address above and we will route it appropriately and support the business in resolving it.

11. Children

This Site and our products are intended for adults and are not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us data, contact us and we will delete it.

12. Security

We take reasonable technical and organisational measures to protect your data — including HTTPS across the Site, keeping payment handling with PCI-compliant gateways, and limiting access to the data we hold. No method of transmission or storage is perfectly secure, but we work to protect your information and will notify affected users and the authorities of a reportable breach as required by law.

13. Changes to This Policy

We may update this policy as our Site or the law evolves. Material changes will be reflected in the "Last updated" date above, and where appropriate we will notify you.

14. Contact

Questions about this policy or your data? Email support@codejainfotech.com. Codeja Infotech, Pune, Maharashtra, India.

15. WhatsApp Business Messaging

Some businesses use Codeja Infotech's WhatsApp product to book appointments and message their customers. If you have messaged one of those businesses on WhatsApp, this section applies to you.

Who holds your data. The business you contacted decides what is collected about you and why, and holds the records of its own customers. We provide the technology and process that information on its behalf, under its instructions — not for our own purposes.

How your messages travel. Messages are delivered over the WhatsApp Business Platform and pass through Meta's systems, under Meta's own WhatsApp Privacy Policy and Meta Privacy Policy.

Marketing messages. You can ask the business to stop sending you marketing messages at any time, and it must act on that request. Messages about a booking you actually made — such as a confirmation or a reminder — are separate from marketing messages.

Raising a concern. Contact the business first. You can also reach our Grievance Officer as set out in Section 10 above.