Privacy Policy

This website, https://www.hemasai.com (the "Site"), is operated by Hema Sai Mallampati, an individual based in Dallas, Texas, United States ("we", "us"). For the personal data described here we decide why and how it is processed, so we are its controller (a "data fiduciary" under India's law and a "controller" or "business" under the other laws listed below).

Privacy questions, requests and grievances go to our privacy and grievance contact, Hema Sai Mallampati, at hemasaimallampati@outlook.com.

This policy covers personal data processed through the Site and its programming interface. The Site is offered only in India, the United Arab Emirates, Qatar, Canada, the United States, Australia; requests from other countries are refused at the network edge. Browser storage is described in the Cookie Policy, our technical safeguards in the Security Policy, and the rules for using the Site in the Terms of Use. Sites we link to have their own policies; for example, booking a meeting takes you to Cal.com, which handles the details you enter there under its own privacy policy.

We collect only what each purpose needs. You do not need an account to use the Site, and you can read every public page without giving us any personal data.

Please do not include sensitive personal data, such as health, financial account, government identity, biometric, religious or political information, in a message. We do not ask for it and will delete it if received.

• We do not sell personal data, share it for cross-context behavioural advertising, or use it for targeted advertising.
• We do not use third-party advertising, analytics, social-tracking or font services.
• We make no decisions based solely on automated processing that produce legal or similarly significant effects, and we do not profile visitors.
• We do not add anyone to marketing lists or send unsolicited commercial messages.
• The chat assistant runs in your browser: your questions are never sent to us. Its optional session copy is described in the Cookie Policy.

Personal data is stored with Amazon Web Services in the United States (N. Virginia), with a replica in India (Mumbai) and recovery copies in the United States (N. California) and, if enabled, India (Hyderabad). It is disclosed only to the following, each limited to its stated role:

• Amazon Web Services, Inc.: Our hosting provider and processor: computing, database, file storage, content delivery and web application firewall.
• Amazon Simple Email Service (part of Amazon Web Services): Sends download verification codes and download links to the address you give.
• Amazon Cognito (part of Amazon Web Services): Signs in administrators and editors. Visitors never have accounts.
• Microsoft Corporation: Provides our email account. If we reply to your enquiry, the reply and your address pass through that account.
• Google LLC: Only if you choose another language and accept the notice: Google Translate then receives the page text and may set its own cookies under Google's privacy policy.

We may also disclose personal data where the law requires it, for example in response to a valid court order, or where necessary to establish, exercise or defend legal claims or to protect the security of the Site. Visitors from Canada, Australia, the United Arab Emirates and Qatar should note that their data is transferred outside their country; the safeguards and laws for each country are set out in section 8.

Personal data and the records of its processing are kept for 400 days (at least one year) and then deleted. India's Digital Personal Data Protection Rules, 2025 require these records to be kept for at least one year, and we apply the same period to every visitor.

• Contact enquiries and download requests: 400 days (at least one year), then deleted automatically.
• Download verification codes: 10 minutes.
• Download links: 5 minutes.
• Opt-in analytics interaction records and same-day identifiers: 400 days (at least one year).
• Opt-in analytics daily totals (counts only): 400 days.
• Abuse-prevention identifiers: 400 days (at least one year).
• Security and access logs (including IP addresses): 400 days (at least one year).
• Application logs: 400 days (at least one year).
• Chat assistant questions: Not collected. They stay in your browser.
• Database recovery backups: Up to 35 days after the record is deleted, for recovery only.

Expiry uses the database's time-to-live feature, which removes records asynchronously, usually within a few days of the expiry time. A deleted record can remain in encrypted recovery backups for up to 35 days and is used only to restore the service after a failure.

• Optional analytics and preference storage are off until you turn them on. You can change or withdraw your consent at any time from cookie settings; withdrawal stops future collection and does not affect processing that took place before it.
• Global Privacy Control: when your browser sends this signal, optional analytics stays off whatever you chose before, and we treat the signal as a request to opt out of any sale or sharing (which we do not do in any case).
• Do Not Track: we do not track you across other websites, so the Site behaves the same whether or not your browser sends a Do Not Track signal.

Wherever you are, you may ask us to confirm whether we process your personal data, to give you access to it or a copy of it, to correct, complete or delete it, and to withdraw any consent, free of charge. The laws of your country may give you further rights, listed below with the authority you may complain to.

• Email hemasaimallampati@outlook.com with the right you want to use and the email address you gave us.
• To protect your data, we verify a request by confirming it with the email address the data is held under. We ask only for what verification needs.
• Someone you authorise, such as a nominee under India's law or an authorised agent under California's law, may make a request for you with your signed permission; we may still confirm the request with you.
• We acknowledge a request within 7 business days and complete it within 30 calendar days. If the law allows more time and we need it, we will tell you why and when to expect an answer, within the legal limit.
• If we decline a request, we will explain why. You may appeal by replying with the word "Appeal"; we decide appeals within 45 days and tell you how to complain to your regulator if you remain unsatisfied.
• When you ask us to delete your data, we stop using it at once. Where the law requires us to keep it, as India's one-year minimum does, it stays securely stored, is used for nothing else, and is erased as soon as that period ends; we tell you when.
• Using your rights is free and will never affect how the Site treats you.

Data is encrypted in transit (HTTPS with TLS 1.2 or newer) and at rest, and contact and download details are additionally encrypted at the application level. Administrative access requires multi-factor authentication and is limited by role and by network address. No method of transmission or storage is completely secure; the Security Policy describes our safeguards, and the Vulnerability Disclosure Policy how to report a weakness.

If a breach affects your personal data, we will notify you and the relevant authority as and when the applicable law requires: for example, affected people and the Data Protection Board of India without delay, with a detailed report to the Board within 72 hours, the Office of the Australian Information Commissioner and affected people under the Notifiable Data Breaches scheme, the Office of the Privacy Commissioner of Canada for breaches posing a real risk of significant harm, and the people and authorities required by the laws of the relevant US state.

Anyone may read the Site's articles, but its forms are for adults. India's Digital Personal Data Protection Act, 2023 (section 9) and the Digital Personal Data Protection Rules, 2025 (rule 10) require verifiable consent from a parent before the personal data of anyone under 18 is processed. Rather than collect children's details, every form asks you to confirm that you are 18 or older, and the form cannot be sent without that confirmation; we record only that it was given. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, contact us and we will delete it.

• In the last 12 months we collected these categories of personal information: identifiers (name, email address, telephone number, network address); internet or other electronic network activity (opt-in analytics and security logs); and approximate location limited to country. We collect no sensitive personal information as defined in the CCPA.
• Sources, purposes, recipients and retention for each category are in sections 3, 5 and 6. We disclosed these categories for business purposes only to the service providers in section 5, and we have not sold or shared personal information.
• We do not disclose personal information to third parties for their own direct marketing (California Civil Code section 1798.83).

We update this policy when our processing or the law changes; the date at the top shows the latest version. We will not use personal data already collected for a materially different purpose without telling you and, where the law requires, asking for your consent again.

Hema Sai Mallampati, Dallas, Texas, United States · hemasaimallampati@outlook.com

Please contact us first so we can try to resolve your concern. You may also complain to the authority listed for your country in section 8.