Privacy Policy

1. Who We Are and How to Reach Us

Zunderdog LLP decides why and how the personal information described here is used. Under India's data protection law that makes us the data fiduciary. Under the GDPR and UK GDPR it makes us the controller.

Registered Address: Zunderdog LLP, #120/A, Velsao, P.O. Cansaulim, Goa 403712, India

Email: sales@zunderdog.com

Phone: +91-9940285902

Grievance Officer: Zubin Souza, Founder & CEO, Zunderdog LLP, #120/A, Velsao, P.O. Cansaulim, Goa 403712, India. Email: privacy@zunderdog.com. Send questions, complaints and requests about your personal information here. We settle grievances within one month.

2. Information We Collect

Giving us your details is up to you. On a job application some fields are marked as required.

• Personal Information: Name, email, phone number, company/project details and other data you provide voluntarily through forms, communications or inquiries. That covers the contact form (including the optional "how did you hear about us" answer), the enquiry pop-up, Find My Domain (and the domain names you search), the UI/UX Auditor (the website address you enter, your name and email, an optional phone number and the report we email you) and the Zoho partner sign-up form (name, phone, email, company, website, message and the Zoho product, plan and service level you pick). The enquiry pop-up also saves the page you were on and which version of the pop-up you saw. UI/UX Auditor reports made before they were sent by email can still be opened by anyone who has their link.
• Job Applications: If you apply for an opening on our careers page, we collect what you enter in the application form: your name, email address, phone number, gender, education, work experience, notice period, the country, state and city you live in, your current and expected salary, an optional LinkedIn profile link and message, plus the resume (PDF) you upload. Please leave sensitive details out of your resume, such as a photo, date of birth, marital status, ID numbers or health information. We also keep our own notes on your application and a status mark (Pending, Good or Bad).
• Technical Information Collected Automatically with Forms and Tools: When you submit a form or use one of our tools (the contact form, the enquiry pop-up, Find My Domain, the UI/UX Auditor or a job application) our server also records, without your having to enter it: the approximate country, region, city and time zone of your internet connection (worked out from your IP address so it may be wrong, for example on mobile data or a VPN), your browser and operating system, your browser language and the website or campaign link that brought you to us. We do not save your IP address with your submission. If you have accepted analytics cookies, your browser also keeps the page where your visit started (or the page you were on when you accepted) and the link that brought you there in its session storage (not a cookie) until you close the tab. A short summary of that link is saved with a form or tool submission you make.
• Analytics Information (only if you accept analytics cookies): Google Analytics and Microsoft Clarity record the pages you visit and for how long, your clicks and scrolling, your device type, browser, approximate location and how you arrived. Clarity also records what happens on the page as a replay (mouse movement, taps and scrolling) and masks what you type into form fields by default. If you reject analytics cookies, neither tool runs. Separately, Vercel Speed Insights measures how fast pages load for a sample of visits. It sets no cookies and does not identify you. See section 4.
• Things Your Browser Remembers: a few small items that remember what you did on the Website, such as your cookie choice and whether you have seen our enquiry pop-up. They are listed in our Cookie Policy.
• Server Logs and Error Log: When something on the Website breaks, a short error record (the page address, your browser and the error) is saved for us. Our hosting provider (Vercel) sees every request to the Website, including your IP address, browser and the page asked for. It needs them to deliver the page and keep the service secure.
• Business Contact Details: We also collect work contact details (name, job title, company and work email address) that you or your company have made public. If your company is hiring for work we could help with, we may note its public details: the company name, the job posting, the company website and a business email address or contact name the company published itself on its own website or in its own job advertisement. We never take addresses from job boards or social networks. We do not buy contact lists. We use them to write to you about services that may suit your business. See section 7.
• Sensitive Information: We do not ask visitors for passwords, bank or card details, government IDs or health information. (A client who opens a private demo types an access code we gave them.) A job application does ask for your current and expected salary. Please do not put other sensitive details in free-text boxes. If you do, we treat them with the same care.
• Children's Information: Our Website is not intended for children under 18. We do not knowingly collect personal data from children. If we find that we have, we will delete it promptly.

3. Why We Use Your Information

For visitors in the UK and EU the legal basis is shown in brackets. Under India's data protection law we rely on your consent or on a use the law allows.

• Provide our services and respond to enquiries (steps you ask us to take before a contract or a contract with you)
• Follow up on an enquiry or a tool report you asked for, for example to discuss your site after the UI/UX Auditor (our legitimate interest in following up on enquiries made to us. You can object)
• Review job applications and get back to applicants (steps you ask us to take before a contract and our legitimate interest in recruiting). The tick box on the application form is also your consent under Indian law and records that you have read this policy and agree to us keeping the application
• Understand where enquiries come from and which channels and job boards work. Spot spam and duplicate or fraudulent submissions using the technical information above (our legitimate interests in measuring our marketing and protecting the Website)
• Analyze Website usage and performance with Google Analytics and Clarity (your consent to analytics cookies)
• Write to businesses about our services (our legitimate interest in B2B outreach. You can object. See section 7)
• Comply with legal obligations (legal obligation) and protect our legal rights (our legitimate interest in defending claims)

4. Cookies and Similar Technologies

Nothing that tracks you across visits runs until you choose. Vercel Speed Insights measures page speed without cookies (section 2). The first time you visit a banner asks whether you accept analytics cookies. Rejecting is as easy as accepting and you can still use the whole Website. Before you choose we store only the few items that remember what you did, such as your choice itself. Our Cookie Policy lists every one.

If you accept: Google Analytics 4 and Microsoft Clarity (both loaded through Google Tag Manager) set cookies to count visits and show how people use the pages. Where your visit started is kept in your browser until you close the tab. We run no advertising of our own and we tell Google not to use this data for advertising. Microsoft says one of its identifiers (MUID) is also used for its own advertising and analytics. See the Cookie Policy.

Changing your mind: choose "Cookie settings" in the footer or on the Cookie Policy page. You can also clear the cookies in your browser.

Embedded content: the Google Map on our contact page and Goa page loads only when you click "Show the map". The one exception to the opening sentence of this section is the Calendly booking calendar on the founder's consultation page (/founder/consult). It loads when that page opens and Calendly may set its own cookies then. Opening the page sends your IP address and browser details to Calendly. We hide Calendly's own cookie banner in the embed. This policy is the only notice we give you before the calendar loads. We do not control Calendly's cookies. See Calendly's privacy notice.

5. Who We Share Information With

We do not sell personal data. We share it with the providers below and in the other cases that follow. We do not share it with anyone else. The only advertising link is the Microsoft identifier described in section 4, which exists only if you accept analytics cookies.

• Vercel: hosts the Website, holds a job application's resume until it reaches Google Drive (section 6) and stores the open-tracking data of the emails mentioned in section 7.
• Neon (database on Amazon Web Services, United States): stores enquiries, tool use and job applications.
• Google: Drive stores resumes through a script that runs on a Google account held by our founder. The Gemini service analyses a page for the UI/UX Auditor. Google Analytics runs only if you accept. Google Maps loads only when you ask for the map.
• Microsoft: Clarity (heatmaps and session replays) runs only if you accept. GitHub, which Microsoft owns, may hold private backup copies of our sales records.
• Anthropic: when you send an enquiry, an AI model (Claude) reads your name, company, country, earlier notes about you and your message in our sales system to help draft the reply. It also helps us draft outreach emails and read replies to them. A person reads and approves what is sent. We also use Claude as an assistant to look after our systems. It can read stored enquiries and job applications when we ask it to.
• EmailJS: sends the confirmation email you receive after a form and the UI/UX Auditor's report, so it receives your name, email address and the report. For Find My Domain and the Zoho sign-up form it also sends us a notification email with the details you entered.
• Hostinger: hosts our email. Every message you send us or we send you passes through it.
• Domainr (through RapidAPI): checks whether the domain names you search for in Find My Domain are free.
• Microlink: takes the screenshot of the website you enter in the UI/UX Auditor. Your browser asks Microlink directly so Microlink sees your IP address.
• Calendly: runs the booking calendar on the founder's page and receives the name, email and notes of anyone who books. It also receives the IP address and browser details of anyone who opens the page.
• WhatsApp (Meta): if you choose to message us there, WhatsApp handles the chat under its own terms.
• Our own sales system and phone alerts: enquiries are copied into the internal system we use to follow up with you, and so are UI/UX Auditor requests for a site that looks like a business (section 10). An alert with the sender's company, name or email and the start of their message goes to our phone through a push notification service.
• Legal compliance and advisers: where the law, a court or a regulator requires it. It also covers our lawyers and accountants, who owe us a duty of confidence.
• Business transfers: if Zunderdog LLP merges, is acquired or sells assets, your information may pass to the new owner. The new owner must honour this policy.

Each provider's own privacy policy also applies to what it does with your data. If we add a provider that receives personal data, we update this list.

6. Where Your Information Is Stored

Job applications and enquiries are saved in a database hosted by Neon on AWS in the United States and uploaded resumes are saved in Google Drive. When you apply, we first keep your resume in private storage at Vercel in Mumbai, India, usually for under a minute, until it has been moved to Google Drive. If Google Drive can't take it then, it stays there until Drive can. Then we delete it there. Our website is hosted by Vercel, whose servers also see your request, including your IP address. Only our team can open applications. We do not email applications to anyone and we do not sell or share them with other companies except the providers in section 5. Enquiries and business contacts are also kept in our own sales system, hosted by Vercel and Neon. We send business emails through our email provider, Hostinger. Backup copies of its records may be kept in a private repository on GitHub.

7. Marketing and Business Outreach

• Marketing emails: we do not send a newsletter. If we start one, we will ask for your consent first.
• Business outreach: we may email people at businesses that look like a fit for our services using work contact details their company has published on its own website or in its own job advertisement. We write to businesses in the UK and the US. In the UK we write only to companies and LLPs. We do not cold-email sole traders or people in the EU. We rely on our legitimate interest in B2B outreach. We write to you about your work and not about your private life. We send no more than three messages. A person reviews each one before it goes. Every message tells you how to stop them. An AI model (Claude) helps us draft these emails and read replies to them. Some emails we send by hand include a small image that tells us when the email was opened, in which mail app and from which country. We do not use it on cold outreach. Tell us if you want us to stop. Where the law asks for it, we link to this policy in the first email.
• Saying no: tell us and we stop. Reply "stop" to any email or write to privacy@zunderdog.com. We then keep your email address on a do-not-contact list so we do not write to you again. Objecting to outreach always works. It is not a request we can refuse.
• Where your details came from: if we hold your details but you never gave them to us, ask and we tell you the source.

8. Your Rights

Depending on where you live (India, the UK, the EU and elsewhere) you have these rights over your personal data:

• Access it and get a copy.
• Correct inaccurate or incomplete data.
• Ask us to delete it.
• Obtain it in a portable format.
• Withdraw consent you gave. Withdrawing does not undo what we did before.
• Object to uses based on our legitimate interests or ask us to restrict them.
• Name another person to exercise your rights if you die or cannot act for yourself.
• Complain to a regulator (section 17).

To use a right, write to privacy@zunderdog.com. We may ask you to confirm who you are first. We reply within 30 days. If a request is complex, we tell you why we need longer and by when. We do not charge for a request unless it is clearly unfounded or excessive.

9. How Long We Keep Your Information

We keep personal information only as long as we need it for the purpose it was given for. We review what we hold at least once a year (stored job applications at least once every two years) and delete what we no longer need.

• Contact and enquiry data: we delete an enquiry that did not lead to work once it is 3 years old. If an enquiry becomes a client engagement we keep the records the law requires for it
• Job applications with their resumes and technical information: kept for as long as we may need to review your application and get back to you. We review stored applications at least once every two years and delete the ones we no longer need. You can ask us to delete your application at any time. We delete it from our database at once. We remove its resume from Google Drive by hand within 30 days. Google keeps deleted files in its bin for up to 30 days more. A small record of the removed file (your email, the opening and a date) stays in our clean-up list for a while. Copies in our providers' restore history and in backups age out over time. A resume you replace stays in Drive until our monthly clean-up
• Technical information recorded with a form or tool (section 2): kept with the record it belongs to and deleted with it
• Find My Domain searches, UI/UX audits and error logs: kept for as long as we need them and reviewed at least once a year
• Business contact details used for outreach: up to 2 years after our last message unless you become a client. A do-not-contact entry (your email address only) is kept so we honour your request
• Backup copies of our sales records: they are kept in a version history so a deleted record can stay in older backups. We use them only to restore data and we clear old backups at least once a year
• Analytics data: Google Analytics up to 14 months. Clarity keeps recordings for 30 days and some for up to 9 months. Then they are deleted or turned into anonymous totals

10. Automated Tools and AI

• The UI/UX Auditor uses Google's Gemini model to analyse the public page you ask it to look at (a screenshot of it or, if we cannot get one, the start of its HTML) and write the audit. It looks at a website and not at you.
• Without a person looking, the UI/UX Auditor also decides whether the report email offers you a call with us and whether your request goes into our sales system. It goes by Gemini's view of what kind of organisation runs the site, whether the site is on a free host or looks like a portfolio and whether your email address is on a company domain, a free mailbox or a school's. Everyone gets the same report, and you can reply to it whatever it offers. No decision with legal or similar effect is made about you this way.
• When you send an enquiry, Anthropic's Claude model reads your message to draft a reply. A person reads and approves the reply before it is sent.
• To prepare business outreach (section 7) Claude reads a company's public job posting and website and drafts a message. A person reviews every message before it is sent. No decision with legal or similar effect is made about you this way.
• We do not use your personal information to make decisions that significantly affect you based only on automated processing. If that ever changes, we will tell you and give you a way to ask for a person to review it.

11. Security

We take reasonable steps to protect personal information:

• The Website uses HTTPS so what you send is encrypted on its way to us.
• Access to the database and the resume folder is limited to our team and the tools we run for it. It is protected by passwords or secret keys. Resumes are not sent by email.
• The providers in section 5 have their own security practices.
• If a breach puts your personal information at risk, we will tell you and the authorities as the law requires.

No system is completely secure. If you think your information has been misused, write to the Grievance Officer at once.

12. Transfers Outside India

• Our providers run servers in India, the United States and other countries. Your information may be processed outside the country you live in. Today the IT (SPDI) Rules 2011 govern transfers of sensitive personal data. India's Digital Personal Data Protection Act will allow them except to countries the government restricts once its transfer rules are in force.
• If you are in the UK or EU and the law requires a safeguard for a transfer we use the safeguard the provider offers, such as standard contractual clauses (with the UK addendum for UK data) or a framework such as the EU-US Data Privacy Framework or the UK-US data bridge. Ask the Grievance Officer which applies to a provider.

13. Accurate Information

Please give us accurate, complete and up-to-date information and tell us if it changes. We correct it when you tell us. We are not responsible for problems caused by details you gave us that were wrong or incomplete.

14. Limits on Our Responsibility

• We are not responsible for the content or privacy practices of other websites we link to.
• Nothing in this policy limits a right you have under the law, including a right to compensation where the law gives one.

15. Governing Law and Courts

• This Privacy Policy and any dispute about it are governed by the laws of India. The courts in Goa have exclusive jurisdiction.
• This does not limit your right to complain to the adjudicating officer, the Data Protection Board of India or your own regulator. If you live in the UK or EU it does not take away your right to go to your local court.

16. Your Choices and Consent

• We ask for consent at the point it is needed: the cookie banner for analytics cookies and the tick box on a job application. You can say no to the cookie banner and still use the Website. A job application needs the tick box because we cannot consider an application we are not allowed to keep.
• You can withdraw consent at any time. Use "Cookie settings" in the footer for cookies or write to privacy@zunderdog.com for anything else.
• Reading this policy or using the Website does not by itself mean you have agreed to optional uses of your information.

17. Laws and Regulators

• India: the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 plus the Digital Personal Data Protection Act, 2023 and its Rules as each part comes into force. Please raise a complaint with our Grievance Officer first. If you are not satisfied you may complain to the Data Protection Board of India once it can take complaints.
• UK and EU: you may complain to your data protection authority. In the UK that is the Information Commissioner's Office.

18. Changes to This Policy

• We may update this policy to reflect legal, technological or operational changes.
• The Effective Date and Version at the top show the current policy. If a change affects how we use your information in a way you agreed to, we will ask you again.

19. Contact Information

• Privacy and Grievance Officer: privacy@zunderdog.com
• General: sales@zunderdog.com
• Phone: +91-9940285902
• Address: Zunderdog LLP, #120/A, Velsao, P.O. Cansaulim, Goa 403712, India