Privacy Policy
Effective & Last Updated: September 14, 2026 • Compliant with Google API Services User Data Policy, GDPR, CCPA/CPRA & Indian DPDP Act 2023
1. Overview & Entity Scope
This page explains, in plain English, how amitrana collects, uses, and protects your personal information. We only use data needed to deliver our services, improve your experience, and keep our systems secure.
This Privacy Policy governs the practices of amitrana (operating at https://amitrana.tech, hereinafter referred to as "amitrana", "we", "us", or "our"), founded and directed by Amit Rana.
This policy applies to all visitors, clients, and partners accessing our website, our client portal at https://amitrana.tech/user/login, and any associated APIs, automation tools, consulting deliverables, or single sign-on (SSO) mechanisms provided by amitrana.
If you have any questions or wish to exercise your legal privacy rights, please contact our Data Protection Lead at support@amitrana.tech or our official support desk at hello@amitrana.tech.
Operational privacy guidance
This guidance supplements the page content and the signed proposal, SOW, invoice, or service agreement that governs a specific engagement.
What clients should do
- •Do not submit passwords, payment-card numbers, health data, or confidential third-party data through general forms.
- •Confirm the authorized contact before requesting account deletion or data export.
- •Keep credentials in your own password manager and use least-privilege access for integrations.
amitrana safeguards
- •Client instructions, approvals, and supplied materials remain the client’s responsibility.
- •amitrana may suspend access or processing where activity creates a security, legal, or platform-policy risk.
- •Retention, deletion, and backup timing may depend on legitimate records, active disputes, or third-party systems.
For a binding interpretation, use the applicable signed agreement. Questions, notices, and data requests can be sent to support@amitrana.tech or hello@amitrana.tech. See also Terms & Conditions.
2. Google OAuth 2.0 & Google API User Data Disclosure
Mandatory disclosure in compliance with the Google API Services User Data Policy
The amitrana Client Portal (hosted on https://amitrana.tech) offers an optional "Sign in with Google" feature to provide seamless, secure Single Sign-On (SSO) authentication for registered clients and partners. This section explicitly details how our application accesses, collects, uses, stores, and handles data received from Google accounts.
A. Specific Google User Data Accessed & Collected
When you authenticate using Google Sign-In, we request access strictly to non-sensitive identity scopes: openid, https://www.googleapis.com/auth/userinfo.email, and https://www.googleapis.com/auth/userinfo.profile. We collect and process only the following fields:
- Google Email Address: Used as your unique primary account identifier and for critical workspace correspondence.
- Full Name & Given Name: Used to personalize your client dashboard, project communications, and deliverables reports.
- Profile Picture URL: Used optionally to display your user avatar within the client portal navigation.
- Google Subject Identifier (Unique User ID): A cryptographic identifier used strictly to safely map your Google account to your amitrana client records.
We DO NOT request, access, read, or process Google Drive files, Gmail messages, Contacts, Google Calendar data, or any other sensitive or restricted Google user scopes.
B. How We Use Google User Data
- To verify your identity and authorize your access to password-protected client workspaces at
/user/dashboard. - To display active campaign milestones, technical SEO audits, and custom automation deliverables assigned specifically to your organization.
- To send operational transaction notices (such as deliverable completion alerts or account security notifications).
- No Advertising / No Profiling: We NEVER use Google user data for serving targeted advertisements, training commercial public artificial intelligence models, or creating behavioral surveillance profiles.
C. Storage, Security & Encryption of Google User Data
All personal data obtained through Google APIs is protected under multi-layer enterprise security standards:
- Encryption in Transit: All communications between your browser, Google servers, and amitrana endpoints are strictly encrypted via TLS 1.3.
- Encryption at Rest: Database records are encrypted at rest using AES-256 in hardened PostgreSQL clusters managed through Supabase and AWS infrastructure.
- Session Security: Authenticated sessions utilize cryptographic HMAC-SHA256 signed tokens stored exclusively in
HttpOnly,Secure, andSameSite=Laxbrowser cookies to prevent unauthorized client-side script inspection.
D. Strict Prohibition on Selling or Transferring Google Data
amitrana explicitly guarantees:
- We do NOT sell, lease, or monetize Google user data under any circumstances.
- We do NOT transfer Google user data to data brokers, advertising networks, or third-party marketing resellers.
- We do NOT allow humans to read your personal account data unless you explicitly request technical support or where required by law.
- We only transfer data to trusted hosting subprocessors (e.g. Supabase, Vercel) strictly necessary to run the infrastructure under confidential Data Processing Agreements.
E. Data Retention & How to Delete Your Google Data
Google user data is retained only for as long as your client account remains active with amitrana. You have continuous, absolute control over your information:
- Revoking Google Access: You can revoke amitrana's permission to access your Google Account at any moment directly through Google's security portal: Google Account Third-party apps & services.
- Requesting Complete Account & Data Deletion: You can request the total erasure of your profile, projects, and all stored Google account information from our databases by emailing support@amitrana.tech or hello@amitrana.tech. All requested records are permanently purged within 7 business days.
Google API Services User Data Policy: Limited Use Affirmation
"amitrana's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements."
3. General Information Collected Across amitrana.tech
Beyond Google authentication, we collect information when you voluntarily submit inquiries or browse our platform:
Direct Inquiries & Bookings
Name, work email, phone number, company name, and project briefs submitted via our contact forms or Calendly consultation integrations.
Client Account Registration
When creating a direct email/password client account, passwords are cryptographically hashed using bcryptjs (cost factor 12). Plaintext passwords are never stored or accessible.
Automated Server Logs
IP addresses, browser client fingerprints, referring pages, and HTTP response codes processed automatically by edge proxies for bot protection and rate limiting.
Client Deliverables & Files
Files and audit documents shared within your private portal workspace (/user/dashboard) are restricted exclusively to your authorized account.
4. Cookies & Tracking Technologies
We use first-party cookies and privacy-respecting telemetry to maintain system integrity:
- Strictly Necessary Cookies:
amitrana_user_sessionand CSRF protection tokens necessary for keeping you securely logged in to your workspace. - Preference Cookies: Theme selections (
amitrana-theme) and motion preference settings (amitrana-motion) saved locally in your browser. - Analytical Telemetry: Google Analytics 4 (GA4) with IP anonymization enabled to analyze aggregate website performance, Core Web Vitals, and referral traffic.
You can modify your cookie choices at any time via our interactive on-site cookie banner or through your browser's privacy settings.
5. Legal Bases for Processing (GDPR & DPDP Act)
We process personal data under transparent, lawful bases recognized globally:
- Performance of a Contract: Providing web development, SEO management, AI automation workflows, and deliverables tracking requested by you.
- Legitimate Interests: Protecting our web services against denial-of-service (DDoS) attacks, brute-force intrusions, spam, and fraudulent account creations.
- Consent: Explicit affirmative consent provided when initiating Google OAuth sign-in, subscribing to newsletters, or submitting lead inquiries.
- Legal Compliance: Fulfilling statutory corporate, tax, and cyber-incident regulatory requirements.
6. Global Privacy Rights & Regional Compliance
European Union & United Kingdom (GDPR / UK GDPR)
Under Articles 15–22 of the GDPR, European and UK residents maintain the right to access, rectify, or erase personal data, restrict or object to processing, request data portability in structured format, and withdraw consent at any time without punitive measures.
California Consumer Privacy Act (CCPA / CPRA)
Pursuant to the CCPA/CPRA, California residents have the right to know what personal data categories we collect, request deletion of personal information, and receive equal service without discrimination. amitrana does NOT sell or share your personal data for monetary or other valuable consideration.
India Digital Personal Data Protection Act, 2023 (DPDP Act)
In strict accordance with the DPDP Act of India, we process digital personal data lawfully for specified purposes. Indian data principals hold the right to obtain summary information, seek correction or completion of inaccurate data, request erasure, and nominate an authorized representative in the event of death or incapacity.
7. Data Retention Schedule
| Data Category | Retention Period | Disposal Method |
|---|---|---|
| Active Client Workspace & Google Profile | Duration of active client engagement + 180 days grace period | Complete database purge upon request |
| Session Cookies & Auth Tokens | 7 days sliding expiration window | Automatic client-side & server-side expiration |
| One-Time Password (OTP) Verification Codes | 10 minutes from generation | Automated memory deletion |
| Inquiry Form Submissions & Lead Data | Up to 24 months for commercial records | Permanent electronic deletion |
| Web Server Security Logs | 90 days rolling buffer | Automated log rotation purge |
8. Subprocessors & Infrastructure Providers
We engage trusted, enterprise-grade cloud service providers to maintain the stability and security of our application:
- Vercel Inc. (USA): Global Edge hosting, application runtime, and SSL/TLS certificate management.
- Supabase Inc. / Amazon Web Services (AWS): Secure PostgreSQL database storage, identity authentication layer, and encrypted database backups.
- Google LLC (USA): Google OAuth 2.0 Single Sign-On infrastructure and anonymous Google Analytics 4 performance metrics.
- Resend Inc. (USA): Transactional email dispatch for client verification codes and operational updates.
9. Contact Us & Exercise Data Subject Rights
If you have questions regarding this Privacy Policy, wish to verify your data, or want to submit an account or Google data deletion request, our dedicated team is available to assist you:
Amit Rana
Principal Software Architect & Founder
amitrana Digital Agency
Primary Privacy Email: support@amitrana.tech
Official Support Desk: hello@amitrana.tech
Security Team: support@amitrana.tech
Physical Jurisdiction: New Delhi, India • Response SLA: Within 30 days (7 days for data deletion)