Privacy Policy & Enterprise Data Protection

1. Corporate Scope & Legal Entity

This Privacy Policy applies to all digital services, software engineering engagements, technical consulting projects, APIs, and websites operated by DigantaLabs Studio Inc. and its corporate affiliations (collectively, "DigantaLabs", "we", "us", or "our").

DigantaLabs operates its Global Corporate Headquarters at Bhimpura No.1 Ballia, Uttar Pradesh, India 221716, and maintains its primary Engineering Studio in Noida, Uttar Pradesh, India. We deliver technology, software, design, and digital growth services to institutional, enterprise, and venture clients situated across India, North America, Europe, the United Kingdom, the United Arab Emirates, and internationally.

When you engage our specialized teams, visit digantalabs.studio, or interact with our software environments, this document delineates the technical, operational, and organizational mechanisms deployed to protect your personal and proprietary data.

2. The Algorithmic Isolation Guarantee

In modern digital software development, privacy concerns frequently center on generative models and unconsented training regimes. DigantaLabs operates under an ironclad technical and legal commitment:

3. Categories of Information We Process

We collect and process only the minimal volume of data strictly necessary to fulfill our contractual commitments, maintain platform availability, and communicate with partners:

• Contact & Account Identifiers: Name, work email address, telephone number, job title, company name, billing physical address, and associated communications exchanged via our booking intake or direct email.
• Project & Technical Assets: Git repository commits, software specifications, Figma assets, API keys provided for sandbox staging, environmental configurations, database credentials (exclusively stored via secret managers), and backlog deliverables.
• Operational & Infrastructure Telemetry: Server request logs, IP addresses, browser user agent strings, HTTP referrers, error stack traces, edge CDN latency metrics, and timestamp records required for intrusion prevention and DDoS mitigation.
• Recruitment & Candidate Submissions: Resumes, portfolio URLs, GitHub profiles, employment histories, and interview assessments submitted via our careers portal.

4. Lawful Bases for Processing

Under the European Union General Data Protection Regulation (GDPR Article 6), the United Kingdom Data Protection Act, California Consumer Privacy Act (CCPA/CPRA), and the Indian Digital Personal Data Protection Act 2023 (DPDP Act), we process information strictly under the following lawful bases:

5. Zero-Retention Memory Gateways

For AI-powered operations or automated API workflows deployed on behalf of our enterprise clients, DigantaLabs mandates Zero-Retention Memory Gateways.

Payloads transferred to LLM inference gateways are processed entirely in ephemeral RAM without persisting to secondary storage (disk or long-term caching). Once the token stream completes and the client handshake concludes, the memory buffer undergoes cryptographic zeroing. No historical conversational telemetry is logged unless explicitly mandated by the client's own compliance archiving policies.

6. Cryptographic Standards & Storage Security

DigantaLabs enforces cryptographic defense-in-depth across our entire engineering lifecycle:

• Data in Transit: 100% of external and inter-service communications are encrypted using TLS 1.3 with Perfect Forward Secrecy (PFS), utilizing robust cipher suites (ChaCha20-Poly1305 and AES-256-GCM). Weak protocols (SSLv3, TLS 1.0, TLS 1.1) are rejected at the edge gateway.
• Data at Rest: Database volumes, file repositories, and snapshot backups are encrypted using AES-256 via FIPS 140-2 validated Hardware Security Modules (HSMs).
• Credential Management: Production secrets, database credentials, and service tokens are never stored in source code. They are injected at runtime via secret managers (AWS Secrets Manager, HashiCorp Vault) with automated 90-day rotation schedules.

7. Enterprise Sub-Processors & Cloud Infrastructure

DigantaLabs partners exclusively with certified, SOC 2 Type II, ISO/IEC 27001, and FedRAMP authorized infrastructure sub-processors. Each sub-processor is bound by rigorous Data Processing Addendums (DPAs) incorporating standard contractual clauses:

8. International Data Transfers

Because DigantaLabs delivers software solutions to a worldwide clientele, data may be transferred between India, the United States, the European Economic Area, the United Kingdom, and the United Arab Emirates.

For transfers originating in the European Economic Area or Switzerland to third countries, we execute European Commission approved Standard Contractual Clauses (SCCs) alongside Transfer Impact Assessments (TIAs). For international transfers originating in India, processing strictly adheres to the data transfer guidelines established under the Indian DPDP Act 2023.

9. Global Data Subject Rights (DSAR)

Regardless of your physical residence, DigantaLabs provides transparent, universal rights regarding your personal information:

To exercise these rights, submit a written Data Subject Access Request (DSAR) to privacy@digantalabs.studio. Requests are verified and fulfilled within thirty (30) calendar days at zero fee.

10. Telemetry & Cookie Standards

DigantaLabs does NOT deploy third-party advertising cookies, behavioural cross-site tracking scripts, or data-broker pixels (e.g. Facebook Pixel, TikTok trackers) on our marketing site or client applications.

We utilize strictly necessary technical session cookies to sustain site navigation and authenticated application states, alongside cookieless, privacy-preserving server-side analytics (such as anonymized latency histograms) that collect no identifiable personal identifiers.

11. Retention & Cryptographic Destruction

We retain client data solely for the period required to fulfill our contractual deliverables and satisfy statutory tax or legal obligations.

Upon conclusion of an engineering contract, complete repository handovers are executed. Following client confirmation, staging environments, development databases, and temporary artifacts are permanently purged via multi-pass cryptographic zeroing (DoD 5220.22-M compliant deletion).

12. Data Protection Officer (DPO) Contact

DigantaLabs has appointed a dedicated Data Protection Officer to supervise privacy governance and regulatory compliance across all studio operations.