Privacy Notice

This notice describes how atyantik.com actually works, checked against the code that runs it on the date shown above. It is short because the site does little with personal data. If you read this site and submit nothing, the only record of your visit is in the server logs our infrastructure provider keeps for a month.

Who we are

Atyantik Technologies is a software engineering firm serving clients worldwide. Our registered office is at Office 501, Privilege Avenue, Behind Atlantis, Sarabhai Campus, Sarabhai Road, Vadiwadi, Vadodara, Gujarat 390007, India. Our GST registration number is 24AANCA6054A1Z1.

For anything you send us through a form on this site, we are the controller. We decide what happens to it, and this notice is our account of that.

For data we handle inside a client engagement, we are a processor. Our client controls that data, the engagement contract governs it, and this notice does not cover it.

We apply one standard everywhere rather than varying it by where you live. That standard is the strictest of the ones that reach us, so the protections below apply to you whether or not your local law requires them.

What we collect

Personal data reaches us in one way: you fill in a form and submit it. There is no other collection surface.

What you type. Your name, your work email address, and whatever you write in the message. Some forms ask which role best describes you. If you attach a file, we receive the file. A job application usually attaches a CV, and a CV holds a lot about you, so send only what you want us to have.

The newsletter form takes an email address and nothing else.

Context recorded alongside a submission, so that a reply makes sense and so that abuse can be traced:

• the page you submitted from, by its path, without anything after a question mark except three campaign tags, if that page's address carried them: utm_source, utm_medium and utm_campaign. They say which site, which kind of link and which campaign brought you. We drop any tag shaped like an email address or a long code, and cut each one to 100 characters. Two more tags, utm_content and utm_term, often carry a code for one person, so we keep them only if you switched Analytics on
• your answer to the optional question How did you hear about us?, if you gave one, and anything you typed in the box beside it
• the cookie choices your browser held when you sent it, which our server reads from the atyantik_consent cookie described below: the version you answered, when, whether you allowed analytics and marketing, the random code of that answer, and whether your browser sent Do Not Track or Global Privacy Control
• your browser's preferred language
• your IP address and your browser identification string, as they arrived, together with a one-way salted hash of each and of the page address your browser reported sending the form from
• what our edge network reads from that connection at that moment: the country, region and city it appears to come from, the time zone there, the network provider it arrived through, and the browser, operating system and kind of device you used
• the result of each anti-abuse check: whether the bot check passed, whether the hidden field that only an automated submitter fills in was left empty, whether the request carried a valid token from the page it claimed to come from, and whether your email domain is a known disposable-address provider
• for an attachment, its size, its declared type, and whether its contents match that declared type

LinkedIn. We also read the performance statistics of our own LinkedIn company page and, with each person's consent, of posts published by Atyantik staff from their own profiles, through LinkedIn's reporting exports and its Marketing API. What we receive is counts: impressions, reactions, comments, clicks, follower growth, and follower and visitor totals grouped by country, industry, job function and seniority. LinkedIn never tells us who an individual viewer or follower is, and we have no way to find out. Those counts are stored in our own systems and shown only to Atyantik staff.

Facebook and Instagram. In the same way we read the performance statistics of our own Facebook Page and Instagram account through Meta's Graph API: views, reach, reactions, comments, saves, shares, follows, and follower totals grouped by country, city, age band and gender. Meta never tells us who an individual viewer or follower is, and we do not receive names, profiles or messages. Those counts are stored in our own systems and shown only to Atyantik staff.

How you found us, and what your cookie choices change. An enquiry keeps the items above whatever you chose in the cookie banner, because we need them to handle and route it. Without the Analytics switch we do not read the page that sent you to this site; we ask instead, with the optional question. The two lists below say what each switch adds. They apply to an enquiry or a partnership request only, never to a job application, a newsletter sign-up or a data request.

With Analytics on, this site keeps a record of your visit in your browser from the moment you switch it on, and an enquiry you send carries it to us. The cookie policy lists that record by name. With your enquiry we keep:

• the first page we recorded in your visit, and when. That is the page you landed on, or the page you were on when you switched Analytics on, with a mark saying the record began part way through your visit
• the site that sent you to that first page, if it was the page you landed on: only the site's name, such as www.google.com, never the page or what you searched for
• the first and last campaign tags you arrived with, which can include utm_content and utm_term
• each page you opened, in order, by its path, with the seconds you spent on it, up to the last 50 pages
• your screen size, and how far down the page you had scrolled when you sent the form
• the Google Analytics client and session codes, which our server reads from the Google Analytics cookies when the form arrives

With Marketing on as well, an enquiry also carries:

• the ad click code in the address of a page you opened while Marketing was on, if there was one: gclid, gbraid or wbraid from Google, fbclid from Meta, li_fat_id from LinkedIn, or msclkid from Microsoft. We never go back for a code from a page you opened before you switched Marketing on
• the Microsoft Clarity session code, which lets us find the Clarity recording of that visit. We never tell Clarity who you are or what you sent

Our server checks your cookie choices again at the moment the form arrives and keeps only what they allow, so a record left in your browser from earlier is never kept against your current choice. Switching Analytics off deletes the record from your browser at once. Switching Marketing off removes the click code and the Clarity code from it. What we keep stays with us: none of it goes to Google, Meta, LinkedIn or Microsoft to report an enquiry. Only Atyantik's management and the people who handle sales see how an enquiry found us.

Your IP address and browser identification string are stored with your submission, as they arrived. We keep them so that the people who read your message know where in the world it came from and what you were using, and so that repeated abuse from one source can be recognised. They are kept for the same period as the rest of your submission, they are deleted with it, and they are seen only by the people at Atyantik who handle enquiries. Alongside them we keep a one-way salted hash of each, computed with a secret value only we hold, which is what our automated abuse checks compare against.

What we do not collect

• No cookie while you are reading. Browsing this site sets none. Submitting a form sets one, and answering the cookie banner sets one more. The next paragraph describes both. If you switch Analytics on, the record of your visit described above is kept in your browser's session storage, which is not a cookie and which the cookie policy lists.
• One page counter, and it sets nothing on your device. This site loads Cloudflare Web Analytics, a small script from Cloudflare that counts page views and measures how fast pages load. It sets no cookie, writes nothing to your browser's storage, and does not fingerprint your address or your browser to recognise you later. Beyond that counter and the bot check described below, the only script this site loads on its own is its own: no tag manager, no measurement pixel and no advertising tag. The one session recorder this site can load, Microsoft Clarity, is described below and runs only if you switch it on.
• Google Analytics, measuring only if you switch it on. Every page loads the Google Analytics 4 script with every permission denied, in what Google calls consent mode. In that state it sets no cookie and sends Google only a cookieless signal that a page was viewed, with no identifier that could recognise you again. Turn the Analytics switch on in the cookie banner and it sets two cookies and lets us see which pages get read and where visitors arrive from. It then also records, with no name attached: which call-to-action buttons and navigation links you click, which outside links you follow (the site they lead to, never the page), how far down a page you scrolled in quarters, whether a page stayed open for 30, 60 or 180 seconds, when you started filling in a form, and when a form you sent was accepted, with the form's subject and an opaque submission number. That number identifies the message, not you; we use it to match the count in Google Analytics against the message in our own records, and it is the only thing about a form that goes to Google. The cookie policy lists those cookies, what they hold and how long they last.
• Microsoft Clarity, recording only if you switch on Analytics and Marketing. With both switches on, this site loads Microsoft Clarity, which records how you move through a page: where you click, how far you scroll, and the shape of the page as you saw it, so we can replay a visit and see where pages confuse people. The text of the page and everything in a form are hidden before anything leaves your browser: Clarity sees placeholders, never what you typed. With either switch off, Clarity is not loaded at all. An enquiry you send with both switches on keeps the Clarity session code, so we can find the recording of that visit; Clarity is never told who you are.
• One signal from our own server, only if Analytics is on. When a form you sent is accepted, our server also tells Google Analytics that an enquiry, a partnership request or a job application arrived, with the same opaque submission number and the same consent check: if you did not switch Analytics on, or Google Analytics never set its cookies in your browser, nothing is sent. Your name, address and message never go with it.
• Audiences, defined now, used for advertising by nobody yet. Google Analytics groups visitors who did similar things, such as reading for a minute, clicking through on a hire page, starting a form, or sending one, into named audiences. We could use those audiences to target advertising later. No advertising campaign runs today, an audience can only be used for advertising if you have also switched Marketing on, and this page will say so before that changes.
• No third-party tracking of any kind. Every outside address in a page here is either our own content network or a link you can choose to follow.
• No profile of you. The page counter cannot tell a return visit from a first one, and there is no advertising cookie unless you switch Marketing on, and then only Microsoft's, described below. Google Analytics, if you allowed it, can recognise a return visit to this site and can place you in one of the audiences described above; it is not used to follow you to any other site today. What links it to a form you send is the opaque submission number and, on an enquiry sent with Analytics on, the Google Analytics client and session codes we keep with it. None of that goes back to Google.
• No sale of personal data. We give personal data to no data broker and no advertising network. The one advertising company that can receive anything is Microsoft, and only the Clarity recording, if you switch on both Analytics and Marketing, as described below.

The two cookies. When you submit a form, we set a cookie named __Host-anima-csrf. It holds a random value, lasts 24 hours, cannot be read by any script, and is never sent to another site. Its only job is to prove your submission came from a page we served rather than from somewhere else pretending to be us. It says nothing about you and it is not used to recognise you on a later visit. When you answer the cookie banner, we set a second cookie named atyantik_consent. It records the version you answered, when you answered, whether you allowed analytics and marketing, and a random code that lets us match your answer to the record of it we keep: a record of each answer on our own server, with that code, your choices, the time, whether your browser sent Do Not Track or Global Privacy Control, and the page you were on, kept 24 months. That record holds no name and no address. If you send us a form, the same code goes with it, so your answer and your message can be matched. Both cookies are strictly necessary and both are set without asking: the first delivers something you asked for, and the second is the record of your answer, including an answer of no.

Cookies are covered on their own in our cookie policy. Site usage terms sit in our terms of use.

Why we are allowed to hold it

The basis differs by purpose, and treating every purpose the same would be wrong in one direction or the other.

• Answering what you sent us, whether that is a project enquiry, a job application, a legal notice, a security report or a bug report. The basis is legitimate interest. You approached us about a specific thing, and we cannot answer without reading it.
• Marketing email. The basis is consent, and consent means the confirmation step. Submitting the newsletter form does not put you on the list. We email you a link, and only if you follow it does the subscription become active, with the confirmation date recorded against your subscription. Nobody is added without that.
• Keeping the forms usable. Blocking automated abuse and enforcing rate limits rest on legitimate interest. Without it the forms would be unusable within a day.

Where the basis is legitimate interest you can object, and where it is consent you can withdraw. Both are covered under your rights below.

Nothing here obliges you to give us anything. No law and no contract requires you to fill in a form on this site. The fields marked as required are required only so that we can reply: without a name and an email address we have no way to reply to you. If you would rather not give us your details, do not send the form, and nothing follows from that.

What happens to a submission

One endpoint receives every form on this site. A submission passes through it in this order.

• A Cloudflare Turnstile bot check runs in your browser as you submit, and we verify the result. The check script loads at that moment rather than on page load, which is why it is absent until you submit something.
• The hidden honeypot field, the page token and the rate limit are all checked.
• Any attachment is written to our file storage and its contents are checked against its declared type.
• The submission is given an identifier, and the complete record is written to our object storage before anything else touches it. That ordering is deliberate: if a later step fails, your message still exists and is not silently lost.
• A routing record is then written to our database, and an audit entry records that a submission was received. Where the classifier below could not place your message, that routing record carries the whole submission so it can be read again.

Your message body sits in the stored record, and reading it is limited to the people who handle submissions.

If one of those checks refuses a submission, we record that a refusal happened, which check refused it, and the IP address it arrived from. On that path the address is recorded as given rather than hashed. We do not record what you wrote. That refusal record is an audit entry and is kept for the period given below.

Automated processing

Something automated reads what you write, and you are entitled to know what it is.

Every submission goes through a classifier that decides where it belongs: a project enquiry, a job application, a legal notice, a privacy request, a security report, a bug report, a partnership enquiry or a newsletter subscription. It works on keywords in your text and on whether a file is attached.

That classifier is a set of rules, with no language model in it. Where the rules cannot decide, the submission is set aside for a person rather than routed on a guess.

You choose whether AI is used. Our forms carry an optional box, never ticked for you. If you tick it, AI may help us: on a project enquiry or a job application, a colleague may ask an AI tool to draft our reply, which a person reads, changes and sends; on an internship application, AI helps screen it as described below. If you leave it unticked, a person handles what you sent without AI. The newsletter form and the data request forms have no box, because no AI reads them.

Internship applications are screened with AI assistance when the applicant ticks the box. The CV is turned into text and into a structured summary of what it states, the public links the applicant gives us are checked, and the application is assessed against evidence of real work. Applicants who tick the box receive questions by email about their own work, written with AI assistance and checked before they are sent, and their replies are read the same way. Replying "stop" ends our emails about the application. A person makes every decision about who is invited to the next round. An applicant who leaves the box unticked is reviewed by a person, with no AI step. Applicants can also ask for a human-only review, or opt out, later, by replying to any email from us. The internship form also asks for gender as an optional question. We use the answer only to check, in aggregate, that our screening treats every group fairly: it is never sent to an AI service, never scored, and it is deleted with the rest of the application. The form also asks, as an optional question, which city you live in now. It shows the people reading applications where you live, and it is never scored. We match it to a standard place name. If you ticked the AI box and our code cannot match it, the AI that reads your CV helps. Our Internship screening process sets out what is read, what is never read and how automated tools are used.

Every other job application is passed to the people who do our hiring, unchanged. We do not screen, score or rank those applicants automatically, and no automated step here produces a legal effect or anything close to one.

How long we keep it

These are the periods we have committed to in writing.

• Your submission, including everything you wrote: 18 months, after which it moves to encrypted archive storage.
• How an enquiry found us, and the cookie choices sent with it: 18 months, kept with the enquiry and deleted with it, including when you ask us to delete your data.
• The routing record for your submission: 12 months.
• Audit entries, which record that something happened rather than what was in it: 24 months.
• Records of alert emails our own systems send: 12 months.
• Server logs held by Cloudflare on our behalf: their default of 30 days.
• A newsletter subscription: until you unsubscribe.
• An internship application: an applicant who asks to be kept on file is kept, and may be contacted about future internships and roles, until they ask us to stop. Otherwise the application is anonymised 18 months after it was received: the screening summary and notes go with it, and what remains, such as the track, scores and dates, no longer identifies anyone. An applicant who opts out of automated screening has the screening record deleted at once.

Changing any of these periods requires a written decision on our side. They do not drift.

Who else handles it

Cloudflare provides everything this site runs on: the network in front of it, the servers behind it, the object storage, the database and the bot check. Anything the site stores sits inside our own Cloudflare account, and backups of it are also kept on a computer Atyantik owns and runs, so that losing the account does not lose them. Those backups are deleted within 35 days, as the rest of this notice says.

Google, as our processor. Google LLC receives the cookieless page-view signal described above from every visitor, and full Google Analytics 4 measurement from visitors who switched Analytics on, including the one signal our own server sends when a form is accepted, under Google's data processing terms and with your address truncated. Page counting that needs no permission is done by Cloudflare Web Analytics inside our Cloudflare account. We use no other analytics service besides Microsoft Clarity, and that only with your permission. We use no external log collection service and no external monitoring service.

Microsoft, as an independent controller. If you switch on Analytics and Marketing, Microsoft Corporation receives the recording of your visit described above, together with identifiers from its own cookies. Microsoft is not our processor for this: it decides for itself how it uses the data, and its terms let it use it to provide and improve its services and to build profiles that include advertising. Microsoft collects or receives this data to provide Microsoft Advertising among its services. The data is stored and processed in the United States. How Microsoft uses it is set out in the Microsoft Privacy Statement. Switching either switch off stops Clarity and deletes its cookies from your browser.

For internship applications only: AI service providers and an email delivery provider, acting as our processors under contract, receive only what each task needs. Automated reading of a CV happens within our own hosting account, where this site runs. Any AI service provider outside it receives an application only with the applicant's name and contact details removed.

Where it is processed

The site runs on Cloudflare's global network, so processing may happen in more than one country depending on how a request is routed.

Cloudflare maintains standard contractual clauses for cross-border transfers along with its compliance certifications, and those are the transfer mechanism we rely on. We do not maintain separate contractual clauses of our own.

Cloudflare publishes those clauses and certifications itself, so you can read them without asking us. If you would rather have them from us, ask through the contact form and we will send you a copy of the safeguards we rely on.

For internship applications, our AI service providers and our email delivery provider may process data outside India, under contractual safeguards. Any AI service provider outside our own hosting account receives an application only with the applicant's name and contact details removed.

Your rights

Whatever your jurisdiction, you can ask us to do all of the following.

• Tell you what we hold about you, and give you a copy.
• Correct anything that is wrong.
• Delete it.
• Hand it over in a form you can take elsewhere.
• Stop using it while a dispute about it is open.
• Object to a use that rests on legitimate interest.
• Withdraw consent where consent is what we relied on, which in practice means the newsletter.

A copy asked for on our Your data page reaches you by email within a few minutes, as a download link that works for 7 days, after which we delete it. We aim to finish a deletion or a correction within 7 days, and we answer every request within 30 days.

Deletion runs as a cascade. We delete what you sent us, our emails with you, anything derived from them, and our notes. A few records survive, and the email we send lists them: a record of your request with its dates; audit records with your details removed; a record that a person was erased, with no name or contact details; if you also asked never to be contacted, a one-way code of your address so we can keep that promise; and, if the law requires us to keep your records, those records with the reason. Copies in our backups, of the database and of the files you sent us, are deleted within 35 days.

You can also name someone to act for you on these rights if you die or cannot act yourself. Tell us through our contact form.

How to exercise them

Use our Your data page to ask for a copy, a deletion or a correction, or for us to stop contacting you. If we hold data for the email address you give, we email it a link, and we act once you confirm. The page says the same thing either way, so nobody can use it to find out who has written to us.

For anything else, such as objecting to a use or asking us to stop using your data while a dispute is open, send a request through our contact form and choose the privacy option. It arrives as a request rather than as an enquiry and is handled on that track.

Our privacy contact is Tirth Bodawala, CTO & Co-Founder. You can write to him at contact@atyantik.com about anything in this notice. The Your data page is still the quickest route for a copy, a deletion or a correction, because it gives your request an identifier and a deadline the moment it lands.

To leave the newsletter, use the unsubscribe link in any email we have sent you. It works without a reply from us. The contact form works too.

If you are unhappy with how we handled a request or used your data, tell us first through our contact form with the privacy option, or write to our privacy contact at contact@atyantik.com. We answer a grievance within 30 days. If you are still unhappy, you can complain to your data protection authority. In India that is the Data Protection Board, after you have raised it with us; in the European Union and the United Kingdom it is the supervisory authority for where you live.

California residents

We do not sell personal information. With both the Analytics and Marketing switches on, Microsoft receives the Clarity recording of your visit described above, as an independent controller, and may use it for advertising. California law may treat that as sharing for cross-context behavioural advertising. Nothing else is shared that way, and no personal information is exchanged with anyone for money.

To opt out, leave either switch off, or turn one off with the Your privacy choices link at the foot of every page. A browser that sends Global Privacy Control opts out too: we treat it as a refusal.

If you want an objection recorded as well, send it through the contact form and we will record it.

Your rights to know what we hold, to have it deleted and to have it corrected are the same ones listed above and are exercised the same way.

We do not discriminate against anyone for using these rights. Asking us what we hold, or asking us to delete it, changes nothing about the service you get from us, nothing about what it would cost you, and nothing about how we deal with you afterwards.

Children

Every form on this site asks you to confirm that you are 18 or older, and does not send without it. We do not knowingly collect personal data from anyone under 18.

A parent or guardian can ask about a child's data on our Your data page, where the form lets you say you are asking for someone under 18. If you believe a child has sent us something, tell us there or write to our privacy contact, and we will delete it.

Changes to this notice

The date at the top is when this document was last checked against the system it describes.

It describes how the site behaves on that date and nothing further. When the site starts doing something new with personal data, this notice is rewritten before that happens rather than after.