This notice
This is the notice given under section 5 of the Digital Personal Data Protection Act, 2023. It describes what Nirwan Goel (https://nirwangoel.com/) does with personal data, why, and what you can do about it. The data fiduciary — the person who decides how and why your data is handled here — is Nirwan Goel.
The Act entitles you to this notice in English or in any language listed in the Eighth Schedule to the Constitution. Ask at hello@nirwangoel.com and it will be provided.
This policy covers the website. It does not cover correspondence about legal matters, which is governed by professional obligations of confidentiality far wider than anything set out here.
What this site does not do
The absences are deliberate, and they are most of the answer:
- There is no contact form and no enquiry form anywhere on this site.
- No visitor account is ever created. There is no registration, no login and no customer profile, and buying something does not make one.
- There is no newsletter and no mailing list.
- There is no analytics package, no advertising, no remarketing, no profiling and no social media tracking pixel of any kind.
- Your data is never sold, rented, bartered or shared with anyone for their own purposes.
- The only first-party cookie on an ordinary visit remembers a privacy choice. It is not used to identify, profile or follow you.
What is collected, why, and on what basis
Only three things ever cause personal data to be handled here, and one of them applies only if you choose it.
Buying a build or paid resource. Payment is taken through Razorpay Software Private Limited. Card numbers, UPI identifiers, net-banking credentials, CVVs and one-time passwords are entered inside Razorpay's own checkout and go to Razorpay. They never reach this website and are never stored on its server, so they could not be disclosed from here even on demand.
Once a payment is verified, this site keeps a purchase record consisting of exactly the following, and nothing else:
- the Razorpay payment reference and order reference;
- which build or resource was bought;
- the amount and the currency;
- the status Razorpay reports for the payment;
- the email address and telephone number you gave Razorpay at checkout;
- the broad payment method used, such as card, UPI or net banking;
- whether the payment was a live one or a test.
- for a paid resource, whether the delivery email was sent and when its temporary access link expires.
Why that record is kept
The purposes are these and no others: to prove that you paid, to deliver what you bought, to answer you if something goes wrong, to process a refund, and to keep the accounting and tax records that Indian law requires of anyone who takes money. It is not used for marketing and it is not profiled.
The basis is your own act. Starting a payment is the clear affirmative action by which you provide this data for the specified purpose of completing that purchase — a legitimate use under section 7(a) of the Act — and retaining proof of the transaction afterwards is a legal obligation under section 7(b).
If you book a time
A booking button stands in the header of every page, and appears again on the contact page and in the contact section of the home page. All three open the same scheduling window, provided by Cal.com. Using it is entirely voluntary; nothing on this site requires it, and every other way of getting in touch is a plain address.
The name, email address, time zone and any note you type go to Cal.com, which collects them under its own privacy policy rather than this one. What comes back here is a calendar invitation carrying your name, your email address and your note. That is used to hold the appointment and for nothing else, and it is deleted once the appointment has passed and any follow-up is finished.
The Cal.com embed is an optional enhanced-functionality service. Its script is not requested unless you allow that purpose in Privacy choices. If you do not allow it, the booking button remains an ordinary link to Cal.com; following that link takes you to Cal.com under its own notice.
Server logs
This site is hosted by Hostinger. Like every web server it writes an access log entry for each request: the originating IP address, the browser's user-agent string, the address requested, the response code and the time. These are held by the host, used to deliver and secure the request and to diagnose faults, and rotated on the host's own schedule. This processing is necessary to provide the page you requested and to meet the security duties in section 8; it does not rest on optional consent.
Privacy choices and consent evidence
Optional services are blocked until you make a purpose-level choice in the privacy controls. Necessary operation, security and a payment you expressly request are not switched off, because the site cannot provide those actions without them.
This browser stores one first-party privacy-choice cookie and the same preference in local storage. They contain a random receipt ID, the notice version, the purposes you selected and the time. They do not contain your name, email address, IP address or browsing history.
To demonstrate that notice and choice were provided, the server keeps anonymous, signed events for 730 days.
A receipt contains the random ID, selected purposes, notice version, choice or withdrawal event, time, source and whether the browser sent Global Privacy Control or Do Not Track. The audit table does not store an IP address, user agent, email address or account identifier.
Comments
Where comments are open, submitting one stores the name, email address and comment you typed, together with your IP address and browser user-agent string, which are used to catch spam. Submitting a comment is voluntary and is the act by which that data is provided. An anonymised hash of your email address may be sent to the Gravatar service to see whether you have a profile picture there.
Consent, and taking it back
Where anything here rests on consent, that consent is limited to the data actually necessary for the purpose it was given for. Nothing is bundled: agreeing to one thing is never treated as agreeing to another.
You may withdraw it at any time. Use Privacy choices in the footer—the same control used to give consent—or write to hello@nirwangoel.com. Withdrawal stops further optional processing and requires the relevant processor to cease, unless a law permits or requires continued processing. It does not undo anything lawfully done before withdrawal.
One consequence is worth stating plainly rather than leaving you to discover it: withdrawing consent to hold a purchase record after a purchase does not undo the purchase, and the record of it may still have to be retained for tax purposes.
Who else handles your data
Three companies are involved, each under a contract, and responsibility for what they do with data on this site's behalf remains with the data fiduciary named at the top of this notice.
- Razorpay, which processes payments. It is also a data fiduciary in its own right for the payment instrument data it collects directly from you, under its own policy.
- Cal.com, which provides scheduling if you choose to use it, and which handles what you type into its booking window under its own policy.
- Hostinger, which hosts the site and holds the server logs.
Third parties your browser contacts
Depending on the page and the choice or action you make, your browser may contact the following. Each can see your IP address, because making a request at all reveals it.
- Google Fonts, only if you allow enhanced functionality, to fetch the two typefaces the site is set in. Decline and the site is set in your own device's faces instead.
- Razorpay, only after you press the buy button, to load the checkout needed for the payment you requested.
- Cal.com, only if you allow enhanced functionality so the scheduling overlay can load, or if you follow the ordinary link to Cal.com.
- Hostinger, which serves the site itself.
Cookies
If you make a privacy choice, the site sets one first-party cookie named nirwan_privacy to remember and evidence it. The cookie is strictly necessary for the control you requested, carries no direct identifier and is not used for analytics or marketing. WordPress sets session cookies only for someone signing in to administer the site, which is not a visitor.
Razorpay may set its own cookies after you begin a payment. Cal.com may do so after you allow its embedded scheduling service or visit Cal.com. Those are governed by their policies and are not used by this site for advertising.
How long it is kept, and when it is erased
Personal data is erased once the purpose it was collected for is served and no law requires it to be kept — which the Act treats as the default rather than as a favour.
In practice: purchase records are kept for three financial years, because tax and accounting rules fix that period rather than because it is preferred. Test payment records are deleted once testing is finished. Booking details are deleted after the appointment and any follow-up. Privacy-choice receipts follow the period stated above. Server logs are rotated by the host. Erasure extends to any processor holding the same data.
Keeping it safe
Reasonable security safeguards are in place, as section 8(5) requires. The site is served only over HTTPS. Payment credentials are never received, so they cannot leak from here. Administrative access is restricted and password-protected. The gateway secret is held as a server-side constant, is never sent to a browser, and every payment is accepted only after its cryptographic signature has been checked. Paid resource links are signed, scoped to the verified purchase and expire after seven days.
No safeguard is absolute, and it would be dishonest to claim one is.
If there is a breach
If personal data held here is lost, disclosed or accessed without authority, every affected person will be told without delay in clear language. The Data Protection Board of India will receive an initial intimation without delay and the detailed information required by the Rules within seventy-two hours, unless the Board allows longer.
Transfers outside India
Some of the services above operate servers outside India, so data may be handled outside the country. Section 16 of the Act permits this except to territories the Central Government has restricted by notification, and no data is transferred to any such territory.
Your rights
Write to hello@nirwangoel.com to exercise any of these. You will be asked to identify yourself well enough that data is not handed to the wrong person.
- Access. A summary of the personal data about you held here, what is being done with it, and who it has been shared with — section 11.
- Correction. Correction of anything inaccurate, completion of anything incomplete, and updating of anything out of date — section 12.
- Erasure. Deletion of your data, unless a law requires it to be retained — section 12.
- Grievance redressal. A readily available means of complaining, described below — section 13.
- Nomination. You may nominate another person to exercise these rights on your behalf if you die or become incapable of exercising them — section 14.
- Withdrawal of consent, at any time, as easily as it was given — section 6.
Your duties
Section 15 places duties on you too, and they are set out here because the Act attaches a penalty to them. Do not impersonate someone else when giving data or making a request. Do not suppress material information when providing data. Do not register a false or frivolous grievance or complaint. Give only information that is verifiably authentic when asking for correction or erasure.
Complaints
Complaints about how data is handled here go to Nirwan Goel, who is the person answerable for this policy and for anything done under it, at hello@nirwangoel.com. A complaint is acknowledged and answered within seven business days.
If the answer does not satisfy you, you may complain to the Data Protection Board of India in the manner the Board prescribes. The Act requires the grievance above to be exhausted first, so please start there — it is also much the faster of the two.
Children
Nothing here is directed at children. Personal data of anyone under eighteen, or of a person with a disability who has a lawful guardian, is not knowingly processed without verifiable consent from a parent or that guardian, as section 9 requires. No purchase should be made by anyone under eighteen or by anyone not competent to contract.
This site does no behavioural monitoring or tracking of children and shows no advertising targeted at them. It shows no advertising at all, so that prohibition is met by construction rather than by policy.
If you believe a child's data has reached this site, write to hello@nirwangoel.com and it will be deleted.
This is not legal advice
This policy explains how a website handles data. It is not legal advice, and reading it, writing to any address on this site or booking a time does not create an advocate-client relationship. The Disclaimer page states that position in full.
Changes
This policy is revised whenever what the site does with data changes. The date it was last revised is printed at the top of this page.