1. Identity of the Data Controller
Firestack Technologies operates as the Data Controller under the General Data Protection Regulation (EU GDPR) and the UK Data Protection Act 2018 for website visitors and inquiry leads. For contracted engineering sprints where client customer data is processed within private deployments, Firestack operates as a Data Processor under a mutually executed Data Processing Addendum (DPA).
Registered Operating Studio: Chembumukku / Kakkanad Technology Corridor, Kochi, Kerala 682030, India.
Data Protection & Privacy Contact: privacy@firestack.dev
2. Categories of Information We Collect
We adhere to the principle of data minimization and only collect personal data necessary to evaluate, propose, and deliver software development and AI engineering services.
A. Information You Provide Voluntarily
Inquiry & Lead Data: When you submit our project discovery form or contact us via email/WhatsApp, we collect your full name, work email address, company name, project specifications, and estimated budget.
Client Communications: Records of correspondence, discovery calls, sprint planning notes, and technical requirements shared via Slack, Linear, or video conferences.
B. Automatically Collected Technical Data
Edge Network Data: IP address, browser type and version, operating system, edge point-of-presence (PoP) region, referring URLs, and request timestamps automatically captured by our edge hosting infrastructure (Vercel Edge Network) for security, DDoS mitigation, and rate limiting.
Telemetry & Preferences: Local client theme preference (dark/light mode stored locally) and cookie consent state.
3. Legal Basis for Processing (EU & UK GDPR)
We process personal data under the following lawful bases set out in Article 6 of the GDPR and UK GDPR:
• Contractual Necessity (Art. 6(1)(b)): Processing required to prepare sprint proposals, execute master services agreements (MSAs), and deliver contracted software engineering milestones.
• Legitimate Interests (Art. 6(1)(f)): Processing necessary to safeguard our web infrastructure against cyber attacks, improve studio performance, and communicate with prospective B2B clients.
• Explicit Consent (Art. 6(1)(a)): Where you explicitly opt in to non-essential cookies, technical newsletters, or direct marketing communications.
4. International Data Transfers (Cross-Border)
Because our engineering headquarters is based in Kochi, India, while our clients and edge infrastructure span the United States, United Kingdom, European Union, and Australia, personal data may be transferred across international borders.
For transfers of personal data from the EEA or UK to India, Firestack complies with Chapter V of the GDPR by implementing the European Commission’s Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum (IDTA), backed by technical and organizational security measures including end-to-end TLS encryption and strict access isolation.
5. Authorized Third-Party Subprocessors
We engage trusted cloud infrastructure and tooling providers that satisfy stringent SOC 2, ISO 27001, and GDPR compliance standards:
• Vercel Inc. (USA) — Edge hosting, serverless compute, and Content Delivery Network (CDN).
• Resend Inc. (USA) — Transactional lead email dispatch and notifications.
• GitHub Inc. / Microsoft (USA) — Secure private source code repository management.
• WhatsApp / Meta Platforms Inc. — Direct real-time messaging initiated by the client.
6. Your Data Subject Rights (GDPR, UK GDPR, CCPA/CPRA, APPs)
Regardless of your geographic location, Firestack provides full data subject transparency. Depending on your jurisdiction, you have the right to:
• Right to Access: Request confirmation of whether we process your personal data and obtain a copy.
• Right to Rectification: Correct inaccurate or incomplete personal information.
• Right to Erasure ("Right to be Forgotten"): Request permanent deletion of your personal data where retention is no longer necessary for legal or contractual fulfillment.
• Right to Restrict & Object: Object to processing based on legitimate interest or restrict processing under certain conditions.
• California (CCPA/CPRA) Disclosures: We do NOT sell or share your personal data with third parties for cross-context behavioral advertising. You have the right to opt-out and to not receive discriminatory treatment.
To exercise any of these rights, email privacy@firestack.dev with your request. We respond within 30 days without fee.
7. Data Retention & Security Architecture
Inquiry leads are retained for 12 months following last contact, after which they are securely purged. Contractual and financial records are retained for 7 years to satisfy statutory tax obligations.
Technical safeguards include HTTPS enforcement with HSTS, automated continuous vulnerability scans (Snyk SAST), principle of least privilege (PoLP) cloud IAM policies, and encrypted credentials storage.