Privacy Policy

1. Overview & Data Minimization Principle

MD Speed ('we', 'our', 'us') engineers software applications and provides digital development services with privacy and local-first reliability as core engineering principles. We adhere strictly to the principle of data minimization: we only collect the minimum personal data strictly necessary to communicate with you, process development requests, provide technical support, and maintain platform security. We never sell, rent, monetize, or trade your personal data.

2. What Personal Data We Collect & How It Is Collected

Depending on how you interact with our website and products, we collect the following limited categories of information:

• Contact & Project Requests: When you submit a project enquiry or website/mobile app development request, we collect your Name, WhatsApp/Mobile Number (for our 2-hour response guarantee), Email Address, Requested Service Type, Subject, and Project Details.
• Product Support Tickets: When you request assistance regarding OneTap AI or other products, we collect your Name, Email Address, Product/Issue Summary, and Issue Details.
• Consent Metadata: Every form submission records an affirmative consent flag, consent policy version (e.g., '2026-10-26'), user language, submission timestamp, and source page.
• Hosting & Technical Diagnostics: Standard web server connection metadata (IP address, user-agent, timestamp) may be temporarily processed by Google Firebase Hosting infrastructure strictly to serve requests, defend against DDoS attacks, and prevent spam.

3. Purpose & Legal Basis of Processing

We process personal data only for specific, explicit, and legitimate purposes:

• To respond to your inquiries and deliver verified updates within our 2-hour WhatsApp/phone guarantee.
• To provide technical support, diagnose reported defects, and resolve customer issues.
• To secure our website endpoints from unauthorized write access, bot abuse, spam, and denial-of-service threats.

4. OneTap AI Local Processing & Offline Privacy

OneTap AI is built with an offline-first privacy architecture:

• Device-Local Processing: Personal images, scanned documents, extracted OCR text, files, and notes processed via local utility features remain strictly on your personal device. They are not transmitted to or stored on our servers.
• No Silent Uploads: OneTap AI does NOT silently upload or sync your files without your explicit knowledge and explicit affirmative action.
• Cloud Connectivity Scope: Cloud communication is limited to fetching public release metadata, maintenance announcements, and optional user-initiated support queries.

5. Consent & Consent Revocation

Merely browsing our website does not imply consent for personal data collection. Where personal data is collected (such as on our Contact Form and Support Ticket Form), we require an explicit, unbundled affirmative action (a mandatory checkbox) before data can be transmitted. You have the right to withdraw your consent at any time by emailing us at support@mdspeed.in or contacting our Grievance Officer. Upon consent withdrawal, your personal data will be erased from our active database within 48 hours.

6. Third-Party Infrastructure & Data Sharing

We do NOT sell, rent, monetize, or disclose your personal data to data brokers, third-party advertising networks, or marketing agencies. We engage trusted enterprise infrastructure processors solely to operate our software:

• Google Cloud / Firebase (Google LLC): We utilize Firebase Hosting, Cloud Firestore, and Firebase Authentication to host web assets, store support requests, and secure admin sessions. Data is protected under Google Cloud's SOC 1/2/3, ISO/IEC 27001 certifications and enterprise security standards.
• WhatsApp (Meta Platforms): When you initiate a chat on our official WhatsApp number (+91 6299841352), communications are transmitted through WhatsApp's end-to-end encrypted protocol as per their service terms.

7. Data Retention & Erasure Schedule (7 to 10 Days Policy)

Under the principle of data minimisation (Digital Personal Data Protection Act and IT Rules), personal data is retained only for the minimal timeframe required to address your enquiry. Because long-term storage is NOT required for our software development and client communication services, we enforce a strict 7 to 10 days retention schedule:

• Direct Requests & Project Enquiries: Retained for a maximum of 7 to 10 days only to evaluate requirements, reply within 2 hours, and discuss your website or mobile app project. All submitted contact details and messages are permanently purged from Cloud Firestore within 7 to 10 days.
• Support Tickets: Technical inquiries and assistance tickets are retained for 7 to 10 days only during active troubleshooting, and are permanently deleted thereafter.
• Spam & Blocked Submissions: Filtered and permanently purged within 7 to 10 days.
• Right to Immediate Erasure: You do not have to wait 7 to 10 days; you can request immediate, permanent deletion of your contact records at any time by emailing grievance@mdspeed.in or support@mdspeed.in.

8. Cookies & Local Storage Controls

We believe in transparent, tracker-free web browsing. We do NOT use third-party advertising cookies, behavioural profiling trackers, or marketing pixels. We only utilize strictly necessary local browser storage:

• mdspeed_lang (Local Storage): Remembers your preferred display language (English or Hindi).
• mdspeed_cookie_consent (Local Storage): Stores your consent preference ('accepted' or 'essential_only').
• mdspeed_last_ticket_ts (Session Storage): Prevents duplicate form submissions and bot spamming.

⚙️ Manage Cookie Preferences

9. Children’s Personal Data (Minors Protection)

Our website and software services are designed for general productivity, utility, and business audiences. We do NOT knowingly solicit, collect, or process personal data from children under 18 years of age without verifiable parental or guardian consent. All public forms require users to confirm that they are 18 years or older, or submitting with guardian authorization. If you are a parent or legal guardian and believe that your minor child has submitted personal details to our website without your consent, please contact us immediately at grievance@mdspeed.in or support@mdspeed.in. We will promptly investigate and permanently erase such information within 48 hours.

10. Technical Security Measures & Data Breach Response

We implement defense-in-depth technical and operational safeguards to protect your information:

• Encryption: All web traffic is strictly encrypted in transit using Transport Layer Security (HTTPS / TLS 1.3) with HSTS enabled. Data in Cloud Firestore is encrypted at rest using industry-standard 256-bit AES.
• Role-Based Firestore Security Rules: Client-side self-registration for administrators is strictly disabled. Public users can ONLY write validated tickets with explicit consent, and can NEVER read or list tickets. Only authenticated, active administrators can access submitted enquiries.
• Audit Logging: All administrative accesses, status updates, and deletions are recorded in append-only Firestore audit logs.
• Data Breach Response Protocol: In the unlikely event of a security incident or data breach affecting personal data, MD Speed maintains an incident response procedure: (1) Immediate containment and isolation; (2) Forensic assessment of affected records; (3) Mandatory statutory notification to Indian CERT-In (Computer Emergency Response Team) and relevant authorities within the required timeframe; (4) Direct notification to affected individuals via email/WhatsApp with clear mitigation guidance.

11. Your Statutory Rights (DPDP Act & Global Standards)

Under applicable data protection laws, you possess the following rights regarding your personal data:

• Right to Access: You may request a summary of personal data held about you.
• Right to Correction / Rectification: You may request corrections to inaccurate or incomplete information.
• Right to Erasure ('Right to be Forgotten'): You may request the permanent deletion of your contact or support history.
• Right to Grievance Redressal: You may file a complaint with our designated Grievance Officer regarding any privacy concern.

To exercise any of these rights, email us at privacy@mdspeed.in or support@mdspeed.in. Requests are verified and fulfilled free of charge within 30 days.

12. Grievance Officer & Statutory Redressal Contact

In accordance with the Information Technology Act, 2000, the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, and the Digital Personal Data Protection Act, the designated Grievance Officer for MD Speed is: