Data protection notes

This is not a certificate

This note explains how datadoodles.site relates to data-protection ideas people associate with the GDPR. It does not say that datadoodles has been certified, audited, or registered under the GDPR or under any Indian statute. Certified compliance is not claimed anywhere on the site. If you need a signed data-processing agreement and a named controller, those details have not been supplied and must be confirmed before you rely on them.

The cookie notice describes the browser keys. This note describes the role of the storefront. They match on purpose: both say the frontend keeps account data on the device, both refuse a fake certification, and both send questions to the contact form.

What the storefront is

The pages are a hosting catalogue and a client area that runs in the browser. The operator of the brand datadoodles is the party who would be accountable for a real service. Questions go to contact@datadoodles.site or the contact form. This note does not invent a legal entity.

Until a server-side account exists, there is no operator database of customers to export. That fact limits the usefulness of a formal access request, and it is better to say so than to pretend a portal is coming in 30 days.

Categories

Identification data you type: name and email. Credentials: a password stored locally, which you should treat as disposable. Order data: plan name, term, optional domain, coupon, INR total, and an order id. Support data: ticket subject and body. Messages: contact-form text. Technical data: whatever your own browser keeps in its normal history. The site does not add a location trace from the geo pages.

Payment card data, government identity numbers, and special-category data are not requested. Do not put them in a ticket. There is nowhere appropriate for them on this frontend, and a future live desk should still refuse to collect them in a free-text box.

Purposes that would apply to a live service

If the same orders were later stored on a server, the purposes would be to provide the hosting account, to bill in INR, to answer tickets, and to keep the shared platform free of spam and abuse. Those purposes are the contract and the legitimate running of a host, not an open licence to market other companies' products. This note does not sign you up for a newsletter.

The 48-hour refund, the non-refundable domain rule, and the end-of-term cancellation rule are business rules. They are not a lawful basis essay. They do tell you how long an account is supposed to exist, which is the retention question customers actually ask.

International readers

The site is written for customers who pay in INR and often host sites for visitors in India. People elsewhere can read it. Hosting a site does not, by itself, place a filing in every country your visitors come from. If you are in the EU and you want a named representative, ask, and expect the honest answer that one has not been appointed in the brand brief.

Location pages for the Gulf and for Indian cities do not mean servers in each city and do not mean a local controller in each city. The Mumbai cache, when a site is hosted, is a performance feature described on the plan pages.

Security and breaches

Browser storage is only as safe as the device. Full-disk encryption and a locked session are your controls. The site cannot notify you of a breach of a database it does not have. If a live service is launched and a breach of real customer data occurs, the operator will need a real channel to tell affected people. The contact form on this copy is not that channel for the outside world, because it does not send.

Phishing that copies the wordmark is not a breach of this site's storage, but it is a reason to check the domain before you type a password. The domain you want is datadoodles.site.

Your requests

You can read and correct the name on the account page. You can delete the data by clearing site storage. You can stop using the site. Those are the access, correction and erasure tools this frontend actually has. A formal complaint to a regulator is your right where the law gives it. This note does not name a regulator and does not claim the operator has appointed one.

Requests that assume a postal identity check cannot be completed on this page. Do not post identity cards to a guessed city. Email contact@datadoodles.site or use the contact form. The form keeps the message in this browser.

Children and automated decisions

The service is not directed at children. There is no automated decision that refuses a plan based on profiling. The coupon field accepts one published code. It does not score you. Resource caps are the same for every customer on a given plan.

If a future fraud check refuses an order, the refusal should be explainable in a ticket. It should not be a silent score you cannot see. That system does not exist on this frontend.

Are you GDPR certified?

No. The site does not say that it is. This note is an explanation, not a seal, not an audit, and not a registration certificate.

Do you appoint a data protection officer?

No appointment was supplied with the brand. If one is named later, the name belongs on this page. Until then, the contact form is the route, with the limits already described.

Can I demand a copy from a server?

There is no customer server behind this frontend. The copy is in your browser. A demand letter sent to a guessed city will not produce a file.

Do geo pages mean you process my location?

No. Opening the Kerala page does not store Kerala as your location. The page is the same plans with a local introduction.

Does the uptime target process personal data?

No. It is a service target on the marketing page. It is not a monitoring profile of you.

Will you sign a DPA?

A meaningful DPA needs a legal entity and a description of real processing. Those are not on this page. A signature on this static note would be decorative. Ask when the operator publishes the entity.

What if I host my own customers' data?

You are responsible for the personal data your site collects. datadoodles, on a live account, would be the host. Your privacy notice to your users is still your job. The plan caps do not replace that notice.

Which policy wins if pages disagree?

The operational rules are the same: 48-hour hosting refund, domains not refundable, cancellation at term end, exchange by prorated upgrade or renewal-time downgrade, delivery by provisioning rather than courier. The privacy and cookie notes win on data questions. The terms win on acceptable use and caps.

What a person can actually do on this copy

Access, on this frontend, means looking at the account page and at the browser's storage for this site. The name on the profile can be corrected in the form, and the correction stays on the device. Erasure means clearing site data. There is no second copy on a datadoodles server for this static site to delete. Restriction and objection, in the formal sense, presume a controller who is still processing. Here the practical version is to stop typing data into the forms and to clear what was stored. Portability is the same storage: the orders and tickets are JSON in the browser, not a file this site emails to you.

A request that needs a passport check or a postal identity cannot be completed. Do not post documents to a city you guessed from the brand name. Email contact@datadoodles.site or use the contact form. The form keeps the message in this browser. A live service, if one is later operated, will need a real channel before it can answer formal requests from people who are not already looking at their own browser.

What this note refuses to pretend

It does not say the site is certified. It does not name a supervisory authority as if one had been appointed for the brand. It does not appoint a data protection officer, because no appointment was in the brief. It does not claim a representative in the European Union. Readers outside India are welcome. Hosting a website for visitors in many countries is not, by itself, a filing in each of those countries. Location pages for Indian cities and for places in the Gulf describe the same INR plans. They do not store the reader's city and they do not create a local controller in each city.

The Mumbai cache, when a hosted site uses it, is a performance feature. It is not a map of the visitor's life. Logins, carts and uploads are described as staying on the origin. That description lives on the plan pages and is not a hidden profile.

How long information is supposed to exist

In this browser, information lasts until it is cleared. On a future live service, the periods that matter to customers are the ones already written in the other policies. A hosting term lasts for the month, year or three years that was paid, and then renewal continues until it is cancelled. A 48-hour refund closes the hosting account rather than keeping a free copy. Domain registrations follow the registry's dates and are not refundable. Tickets about abuse may need to be kept long enough to show why an account was suspended. None of those periods is a licence to build a marketing profile, and this site does not run a newsletter signup.

Special-category data, card numbers and government identity numbers are not required for a plan. Do not put them in a ticket. There is no automated score that refuses a plan. The coupon field accepts the published code or it does not. Resource caps are the same for every customer on a given plan. If a future fraud check refuses an order, the refusal should be explainable. That check is not on this frontend.

Security in plain language

Anyone who can open the browser profile can read the local account. Lock the device. The site cannot email you about a database breach it does not have. Phishing pages that copy the wordmark are a reason to check that the host is datadoodles.site before you type a password. The operational rules stay aligned with the other pages: 48 hours to return a first hosting purchase, domains not refundable, cancellation at the end of the term, upgrades prorated, downgrades at renewal, and delivery by provisioning rather than by courier. All prices are INR. No payment processor is named, and no QR code is part of this notice.