What this site collects, and what it does not.

This website runs no analytics, sets no advertising or tracking cookies, and embeds nothing from a social network. There is no tag manager, no pixel and no session recorder anywhere in it. Nobody is profiled for visiting.

Two forms collect personal data, and only because they cannot work otherwise: the enquiry form and the compliance calendar subscription. Everything below is the detail of those two.

The contact form stores what you type so that somebody can reply to it. Nothing is inferred, enriched or bought in from anywhere else.

Name

Required, so a reply can be addressed to someone.

Email address

Required. This is how we reply.

Phone number

Optional. Given only if you would rather be called.

Company

Optional. Helps scope the answer.

Service of interest

Optional. Whichever service you arrived from.

Your message

Required, and kept as written.

The subscription stores your email address so the monthly reminder can be sent, and an optional name so it can be addressed properly. You also pick which set of dates applies to you, which decides what the email contains.

Every email carries a one-click unsubscribe link and an unsubscribe header your mail client can act on directly. Unsubscribing removes you from the sending list immediately; you do not have to ask anyone.

Enquiries and subscriptions are stored in a Postgres database hosted by Supabase in the Mumbai (ap-south-1) region, so this data does not leave India in normal operation.

Enquiries are retained while the matter is live and for as long afterwards as a professional engagement requires records to be kept. Subscriptions are retained until you unsubscribe. Ask and we will delete either sooner, unless a statutory retention obligation applies to an engagement that has already begun.

Three service providers process data on our behalf, each for one narrow purpose, and none of them are permitted to use it for their own:

Supabase

Database and authentication. Hosts the enquiry and subscription records, in India.

Vercel

Website hosting. Serves the pages and keeps standard server request logs.

Resend

Email delivery. Sends the enquiry notification and the monthly calendar email.

One value: whether you chose the light or dark theme, under the key `pp.theme`. It stays on your device, is never transmitted, and exists so the site does not flash the wrong colour at you on the next page.

There are no cookies on the public site. The administrative console, which only the practice can reach, uses a session cookie to keep a signed-in user signed in.

Under the Digital Personal Data Protection Act, 2023 you have specific rights over the data this practice holds about you, and none of them require a reason:

Access

A summary of the personal data held about you, what it is being processed for, and which of the providers below it has been shared with.

Correction

Correction of anything inaccurate, completion of anything incomplete, and updating of anything out of date.

Erasure

Deletion, unless a statutory retention obligation applies to an engagement already under way — in which case you are told which one and for how long.

Withdraw consent

As easily as it was given. The calendar email carries a one-click unsubscribe; for anything else, one line to the address below.

Nominate

Nominate someone to exercise these rights on your behalf in the event of death or incapacity, under section 14.

Complain

Raise a grievance with us first — see below — and, if you are not satisfied with how it is handled, complain to the Data Protection Board of India.

Grievances about personal data are handled by the practice’s Data Protection contact, reachable at contact@thepaperplane.co.in with “Data protection” in the subject line, or on +91 90255 65526.

You will get an acknowledgement within two working days and a substantive answer within thirty days, which is the period the Act works to. If a request is refused you are told which provision it is refused under, not simply that it cannot be done.

If that does not resolve it, you can escalate to the Data Protection Board of India. Doing so does not require our permission and will not affect any engagement.

This is a website for businesses and the people who run them. It is not directed at children, it does not knowingly collect data from anyone under eighteen, and there is no behavioural tracking or advertising on it of the kind section 9 prohibits in relation to children — because there is none of that on it for anyone.

If you believe a child has sent us personal data through this site, tell us and it will be deleted.

Write to contact@thepaperplane.co.in, or call +91 90255 65526. The practice operates remotely across India, so there is no counter to visit — but there is always a named person answering.