Privacy Policy

1. Who we are

Shanti Infosoft ("Shanti Infosoft", "we", "us" or "our") is a software and AI product-engineering company that designs, builds and maintains web, mobile, cloud and AI applications for clients worldwide. For the personal data described in this policy, Shanti Infosoft is the data controller — we decide why and how that data is processed.

If you have any question about this policy or about how we handle your data, you can reach us at [email protected]. Full contact details are in section 16.

2. Scope of this policy

This policy applies to personal data we collect through:

• this website, shantiinfosoft.com, and its sub-pages;
• the enquiry, contact, career and training forms on this site;
• email, phone, WhatsApp and other messages you send us; and
• our delivery of software, design, consulting and support services to clients.

It does not cover third-party websites we link to, or data we process strictly on a client's behalf as their service provider (a "data processor"). Where we build or host a product for a client, that client is the controller of their own users' data and their own privacy policy governs it; we process that data only under our agreement with them and on their instructions.

3. Information we collect

We only collect what we need. Depending on how you interact with us, this may include:

Information you give us

• Identity & contact details — your name, email address, phone number, company name and country, submitted through our contact, project-enquiry, training or newsletter forms.
• Project information — the details you choose to share about your requirements, budget or timeline when you ask us for a proposal.
• Recruitment information — if you apply for a role or a training program, your CV/resume, work history, qualifications and any details in your application.
• Correspondence — the content of emails, calls, WhatsApp or chat messages exchanged with our sales, delivery or support teams.

Information we collect automatically

• Usage & device data — your IP address, browser type and version, device type and operating system, referring pages, the pages you view on our site, and the date, time and duration of your visit.
• Cookies & similar technologies — small files and identifiers used to make the site work and, with your consent, to measure and improve it. See section 6.

We do not intentionally collect special-category data (such as health, religion or biometric data) through this website, and we ask that you do not send it to us unless it is strictly necessary for an application you are making.

4. How we use your information

We use personal data to:

• respond to your enquiries and prepare proposals or estimates;
• provide, deliver and support the services you or your organisation engage us for;
• manage our relationship with you, including scheduling calls and sending service-related updates;
• assess and administer job or training applications;
• operate, secure, troubleshoot and improve our website;
• send you marketing about our services where you have asked us to or where we are permitted to, always with an easy way to opt out; and
• meet our legal, accounting and regulatory obligations, and protect our rights.

We do not sell your personal data, and we do not use it to make decisions about you by fully automated means.

5. Legal bases for processing

Where the EU or UK GDPR applies, we rely on one or more of the following legal bases:

• Consent — for non-essential cookies, analytics and marketing communications. You can withdraw consent at any time.
• Contract — to take steps at your request before entering an agreement and to deliver the services you have engaged us for.
• Legitimate interests — to run and secure our business, respond to enquiries, and improve our services, where those interests are not overridden by your rights.
• Legal obligation — where we must process data to comply with the law.

6. Cookies, analytics & tracking

Our site uses cookies and similar technologies for two purposes: to make the site function, and — only after you accept — to understand how it is used so we can improve it.

We use Google Analytics and Google Tag Manager to measure traffic and page performance, and Google reCAPTCHA to protect our forms from spam and abuse. Analytics and marketing tags load in a "denied by default" state using Google Consent Mode, and only run once you accept them through our cookie banner. With your consent we may also load remarketing tags (for example from Google, Meta or LinkedIn) so we can show relevant ads about our services.

7. How we share information

We share personal data only where necessary, and only with parties who are bound to protect it. These may include:

• Service providers who process data on our behalf — such as cloud hosting and infrastructure providers, email-delivery services, analytics providers, CRM and scheduling tools, and communication platforms — strictly to provide services to us.
• Professional advisers such as accountants, auditors and lawyers, where needed.
• Authorities or other parties where we are required to by law, to enforce our agreements, or to protect the rights, property or safety of Shanti Infosoft, our clients or others.
• A successor in the event of a merger, acquisition or reorganisation of our business.

We require our service providers to use your data only for the purposes we specify and to keep it secure. We never sell your personal data to third parties.

8. International data transfers

We are based in India and work with clients and service providers in different countries, so your personal data may be processed outside your home country, including in India. Where we transfer data across borders, we take steps to ensure it remains protected — for example by working with providers that offer recognised safeguards such as Standard Contractual Clauses or an adequacy decision. If you would like more information about these safeguards, please contact us.

9. How long we keep data

We keep personal data only for as long as we need it for the purposes described in this policy, and to meet our legal, tax and accounting obligations. In practice that means:

• enquiry and contact data is kept for as long as we are in contact and for a reasonable period afterwards;
• client and project records are kept for the duration of the engagement and as long as required for legal and financial reasons;
• recruitment data is kept for the hiring process and, unless you ask us to remove it sooner, for a limited period afterwards in case a suitable role arises.

When data is no longer needed, we securely delete or anonymise it.

10. How we protect data

We use appropriate technical and organisational measures to protect personal data against loss, misuse and unauthorised access — including encryption in transit (HTTPS), access controls, hardened servers, monitoring and regular security reviews. No method of transmission or storage is completely secure, but we work continuously to safeguard the information you entrust to us and to respond promptly if an issue arises.

11. Your data protection rights (GDPR / UK)

If you are in the EU, UK or a region with similar laws, you have the right to:

• access the personal data we hold about you;
• rectify data that is inaccurate or incomplete;
• erase your data ("right to be forgotten") in certain circumstances;
• restrict or object to our processing;
• data portability — to receive your data in a portable format;
• withdraw consent at any time where we rely on consent; and
• lodge a complaint with your local data protection authority.

To exercise any of these rights, email us at [email protected]. We will respond within the timeframe required by law. We may need to verify your identity first.

12. California privacy rights (CalOPPA & CCPA/CPRA)

If you are a California resident, you have additional rights over your personal information, including the right to know what we collect and how we use it, the right to request deletion, the right to correct inaccurate information, and the right not to be discriminated against for exercising these rights.

We do not sell or share your personal information as those terms are defined under the CCPA/CPRA. Under CalOPPA, we honour "Do Not Track" preferences where technically feasible, our privacy policy link includes the word "Privacy", and we notify users of changes here on this page. To make a request, contact us using the details in section 16.

13. Links to other sites

Our website may link to sites we do not operate — for example client projects, partner sites or social platforms. If you click such a link, you will be taken to that third party's site, and we encourage you to read their privacy policy. We are not responsible for the content or privacy practices of any third-party sites or services.

14. Children's privacy

Our website and services are intended for businesses and adults. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us and we will delete it.

15. Changes to this policy

We may update this policy from time to time to reflect changes in our practices or in the law. When we do, we will revise the "Last updated" date at the top of this page, and for significant changes we will take reasonable steps to let you know. We encourage you to review this page periodically.

16. How to contact us

If you have any questions, requests or concerns about this Privacy Policy or your personal data, please get in touch: