Privacy notice

NorthStackHub is a software development agency that builds and maintains web applications for clients worldwide. We operate remotely and take work directly and through freelance marketplaces.

For anything you send us through this website, NorthStackHub is the data controller. You can reach us at info@northstackhub.com.

When you submit the contact form we receive:

• Your name, so we know who we are writing to.
• Your email address, which is the only way we can reply.
• Your company name, if you choose to give it — this field is optional.
• The project type, budget range and timeline you select.
• The message you write, including anything you choose to put in it.
• The date and time of the submission.

Our server also sees the IP address attached to the request. We use it only to apply a short-lived rate limit that stops automated spam; it is held in memory for a matter of minutes and is never written to our database or included in the notification email.

Please do not send us passwords, API keys, card numbers or other secrets through this form. If we need credentials during a project we will set up a proper secret sharing channel with you.

We use what you send for exactly one purpose: to reply to your enquiry and, if it goes further, to scope and quote the work. We do not add you to a mailing list, we do not build a marketing profile from your message, and we never sell or rent your details to anyone.

The lawful basis is your consent, given by ticking the box on the form, and our legitimate interest in responding to people who ask us about our services. Where a project starts, the basis becomes the performance of our contract with you.

• Enquiries that do not become projects: kept for 12 months, then deleted, so we have context if you come back to us.
• Enquiries that become projects: kept for the life of the engagement and for 6 years afterwards, because tax and contract records require it.
• Rate-limiting records: held in server memory only and discarded within 10 minutes.

You can ask us to delete your enquiry sooner than any of these, and unless we are legally required to keep a record we will do it.

We keep the list of third parties short and we choose providers that publish their own data protection terms. Currently:

• Hosting and content delivery — our host runs this website and its serverless functions, and keeps standard access logs containing IP addresses for a limited period.
• Transactional email — our email provider delivers contact form notifications to our inbox and stores the message content as part of that delivery.
• Business email — our mail provider holds the resulting conversation in our inbox, the same way any email exchange works.
• Scheduling — if you book a discovery call, our calendar provider processes the name, email and any notes you enter on their booking page under their own privacy policy.
• Analytics — if enabled, we use privacy-respecting, aggregate analytics that count page views without cookies and without attempting to identify individual visitors.
• Marketplaces — if you contact us through a freelance platform such as Upwork, that conversation happens on their platform and is governed by their privacy policies, not this one.

Some of these providers operate servers outside your country, so your data may be transferred internationally. Where that happens we rely on the provider’s standard contractual clauses or an equivalent safeguard.

This website sets no marketing cookies, no advertising pixels and no cross-site trackers. There is no cookie banner because there is nothing to consent to.

Your light or dark theme preference is saved in your browser’s local storage so the site does not flash the wrong theme on your next visit. That value never leaves your device and is never sent to our servers. Clearing your browser storage removes it.

During an engagement we often work with systems that hold your customers’ personal data. In that context you are the controller and we act as your processor, under the terms of our contract or a separate data processing agreement.

Our working rules are simple: we prefer your cloud accounts and your repositories over ours, we use anonymised or synthetic data in development wherever it is practical, we access production data only when a task genuinely requires it, and we hand back or delete every credential at the end of the engagement.

Enquiries reach us over HTTPS and stay inside password-protected accounts with two-factor authentication enabled. Access is limited to the people who need it to answer you. No system is perfect, but if a breach ever affected your data we would tell you and the relevant regulator without unnecessary delay.

Depending on where you live, you can ask us to:

• Tell you what personal data we hold about you and give you a copy.
• Correct anything that is wrong or incomplete.
• Delete your data where we have no ongoing legal or contractual reason to keep it.
• Restrict or object to how we use it.
• Withdraw consent at any time, which does not affect anything we did before you withdrew it.
• Receive your data in a portable, machine-readable format.

Email info@northstackhub.com with the subject line “Data request” and we will respond within 30 days. We do not charge for this. If you are unhappy with our response you can complain to your local data protection authority.

Our services are sold to businesses and professionals. This website is not directed at children and we do not knowingly collect data from anyone under 16. If you believe a child has sent us information, tell us and we will delete it.

When we change how we handle data we update this page and move the date at the top. Material changes affecting people who have already contacted us are communicated by email.

Questions about this notice, about anything we hold on you, or about project and contract matters all go to info@northstackhub.com. Hyderabad, India · Working remotely with clients worldwide.