Privacy Policy.

1. Who I am (Data Fiduciary / Controller)

This site is operated personally by Komal Vardhan Lolugu, an individual based in Hyderabad, Telangana, India. For the purpose of the Digital Personal Data Protection Act, 2023 (India) ("DPDP Act") I am the Data Fiduciary. For the General Data Protection Regulation (EU) 2016/679 ("GDPR") I am the Data Controller.

Contact for any privacy matter: komalsrinivasan.l@gmail.com.

2. Scope

This notice covers the website at komalvardhan.com and the resources subdomain at resources.komalvardhan.com. It does not cover third-party sites you reach from links here.

3. Personal data I collect, and why

3.1 Newsletter

• Data: email address.
• Purpose: sending the newsletter you asked for.
• Lawful basis: consent (DPDP s.6 / GDPR Art. 6(1)(a)).
• Retention: until you unsubscribe, then deleted within 30 days.

3.2 Contact form

• Data: name, email, message contents.
• Purpose: replying to you.
• Lawful basis: legitimate use / pre-contract communication (DPDP s.7(a) / GDPR Art. 6(1)(b)).
• Retention: 12 months after the conversation closes, then deleted.

3.3 Site usage (only with consent)

• Data: page-view events, click events, an anonymous device-level identifier; no keystrokes, no form contents.
• Purpose: understanding which posts get read so I write better ones.
• Lawful basis: consent (GDPR Art. 6(1)(a)). Off by default. Reject and nothing loads.
• Retention: 12 months from the event date.

3.4 Server logs (essential)

• Data: IP address, user-agent, requested URL, timestamp.
• Purpose: security, fraud prevention, debugging.
• Lawful basis: legitimate use (DPDP s.7(i) / GDPR Art. 6(1)(f)).
• Retention: 30 days.

4. Sensitive personal data

I do not knowingly collect financial information, biometric data, health data, caste, religion, political affiliation, sexual orientation, or any other category of sensitive personal data through this site. Do not send these in messages. If you accidentally do, I will delete the message on request.

5. Processors I rely on

The site is served and stored using these third parties. Each one is bound by a data processing agreement or terms equivalent to one.

• Vercel Inc. (United States) - hosting, edge logs.
• Supabase Inc. (United States, Postgres in us-east-1) - database.
• Resend, Inc. (United States) - transactional and newsletter email delivery.
• PostHog, Inc. (EU region, only if you consent) - product analytics.

6. Cross-border transfer

Because the processors above are in the United States and the European Union, your personal data will leave India. This transfer is permitted under DPDP s.16 (no restriction notified by the Central Government as of the date of this notice) and under GDPR Chapter V via the standard contractual clauses these providers operate under.

7. Your rights as a Data Principal / Data Subject

Under DPDP s.11-15 and GDPR Art. 15-22 you can ask me to:

• Confirm whether I hold data about you, and give you a copy (access).
• Correct or complete inaccurate data (rectification).
• Erase your data (the right to be forgotten / erasure).
• Restrict or object to certain processing.
• Withdraw consent at any time, with the same ease you gave it.
• Nominate another person to exercise these rights on your behalf in the event of your death or incapacity (DPDP s.14).
• Receive your data in a portable, machine-readable format.

To exercise any of these, email komalsrinivasan.l@gmail.comwith the subject DPDP request or GDPR request. I respond within 7 days and complete most requests within 30 days at the outside.

8. Grievance Officer

Under DPDP s.13 and the Information Technology (Reasonable Security Practices) Rules, the designated Grievance Officer is:

• Name: Komal Vardhan Lolugu
• Email: komalsrinivasan.l@gmail.com
• Address: Hyderabad, Telangana, India (full postal address provided on written request)
• Response SLA: acknowledgement within 72 hours; resolution within 30 days.

If you are unhappy with my response, you may approach the Data Protection Board of India (under DPDP s.27). For GDPR matters you may complain to your local supervisory authority.

9. Withdrawing consent

You can withdraw consent for analytics at any time by clearing site data in your browser - the consent banner will reappear. You can withdraw newsletter consent by clicking the unsubscribe link in any newsletter email or by emailing me. Withdrawal does not affect processing that was lawful before withdrawal.

10. Children's data

This site is not directed at children. Under DPDP s.9 I will not knowingly process the personal data of a child (under 18 years of age) without verifiable parental consent, nor will I monitor a child's behaviour or run targeted advertising directed at a child. If you believe I hold data of a child, email me and I will delete it.

11. Automated decision-making

I do not run any automated decision-making, profiling, or scoring that produces legal or similarly significant effects on you.

12. Data breach

If a breach affects your personal data, I will notify you and the Data Protection Board of India within the timeframe required by DPDP s.8(6) (presently as soon as reasonably practicable). I will tell you what was affected, what I am doing about it, and how to protect yourself.

13. What I do not do

• I do not sell personal data.
• I do not share data with advertisers or data brokers.
• I do not run Google Ads, Meta Pixel, LinkedIn Insight Tag, or any tracking pixel beyond consented analytics.
• I do not enrich your record with third-party data.

14. Changes to this notice

If I make material changes I will update the date above and re-prompt the consent banner for anyone whose consent was given against an older version.