Version v4 · Last updated 3 October 2026
The short version
We do not sell your data, we do not run advertising, and we set no cookies unless you tell us we may. If you fill in the contact form we keep what you typed so we can reply to you. If you only read the site, we count the visit without storing your IP address and without identifying you.
Who is responsible for your data
Mt7 Private Limited (“Mt7”, “we”) is the data fiduciary — the controller — for everything described here.
- Registered office: Adnan Complex, Nazirpura, Basheerganj, Bahraich, Uttar Pradesh 271801, India
- CIN: U68200UP2025PTC233604
- Contact for anything on this page: founder@mt7.io
- WhatsApp: +91 78000 07500
What we collect when you ask us to contact you
The contact form is the only place on this site where you type anything about yourself, and it asks for nothing but a way to reach you. We collect exactly the fields you fill in:
- Your phone number or your email address — whichever you prefer, and one is enough. We need a single route to reply on; giving both changes nothing.
- The page you were on when you opened the form, and a record that you accepted this notice, together with which version of it you saw.
We do not ask for your name, what you want built, or your budget. Those are conversations, and they happen in the reply.
If you choose WhatsApp instead, you open that chat yourself and nothing passes through this site; the conversation is between you and us on WhatsApp, under WhatsApp's own terms.
We use it for one purpose: to call or write back to you about your enquiry. Your consent is the lawful basis, you give it with the checkbox, and you can withdraw it at any time by emailing us — withdrawing is exactly as easy as giving it, which is a requirement of the DPDP Act and not a courtesy.
We do not add you to a mailing list. There is no newsletter to unsubscribe from because we do not send one.
What we collect when you just read the site
We measure our own traffic, first-party, without cookies. For each page view we record the page, how long you stayed, where you arrived from if it was an external link, your position in the visit, your device type (mobile, tablet or desktop), and an approximate location — country, region, city and timezone — that our network edge derives from the connection.
We do not store your IP address. To count returning visitors we compute a one-way hash of your IP address, your browser string, a secret, and today's date, and keep only the first sixteen characters of it. Because the date is part of the input, that value changes at midnight: you are one visitor today and an unrelated one tomorrow. It cannot be reversed into an IP address, and it cannot be used to follow you across days.
No cookie is involved in any of this. A random identifier for the current visit is held in your browser's sessionStorage, which the browser itself discards when you close the tab, and which is never sent anywhere except back to us with the page view.
Google Analytics — only if you allow it
Google Analytics is loaded only after you press Allow on the banner. Until then it runs under Google Consent Mode with storage denied, meaning no analytics or advertising cookie is written and no identifier is sent. If you press No thanks, or simply ignore the banner, it stays that way and our own cookieless measurement above is all that happens.
If you do allow it, Google receives your IP address and sets cookies in your browser, subject to Google's own privacy policy. You can change your mind by clearing this site's data in your browser, which removes the stored choice and brings the banner back.
Security and abuse prevention
When you submit the contact form we pass your IP address to our rate-limiting service to enforce a cap of five submissions per connection per ten minutes. It is held for that window and then expires. Without it, an anonymous form that sends email and writes to a database is an open invitation.
Our hosting provider also keeps short-lived server logs, which include IP addresses, for operating and securing the service.
How we keep it safe
What we actually do, rather than a list of words that sound reassuring:
- Every page and form on this site is served over HTTPS, and the connections between our application and the database, the email service and the rate limiter are encrypted in transit.
- Data at rest sits in managed services that encrypt their storage — we do not run our own servers or keep copies of the database on a laptop.
- Access to the database and the provider dashboards is limited to the people at Mt7 who need it, through individual accounts. There is no shared login.
- Card details never reach us at all. Stripe collects and holds them; we receive a reference, never a card number.
- We collect the minimum the job needs — the contact form asks for a phone number or an email, not both, and no name — and delete it on a schedule rather than keeping it indefinitely. Data we do not hold cannot be lost.
No system is perfect and we are not going to claim otherwise. If a breach ever affected your data we would tell you and the Data Protection Board, as the DPDP Act requires, rather than hoping you did not notice.
What we collect when you pay us
If you subscribe to something here, the payment is taken by Stripe. Your card number is entered on Stripe's systems and goes to Stripe, not to us — we never see it, and there is nowhere in our database it could be stored.
What comes back to us is what we need to run the account and account for the tax: the email address on the subscription, the plan, the amount, the currency, whether a payment succeeded or failed, the country your card was issued in, and the last four digits and brand so you can tell one card from another. Where GST applies we also hold the billing name, address and any GSTIN you give us, because an Indian tax invoice is required to carry them.
We keep billing records for as long as Indian tax and company law requires us to, which is longer than the retention periods below — those govern enquiries and analytics, and an invoice is neither.
Who else processes your data
We use a small number of specialist providers. They act on our instructions only, and none of them are permitted to use your data for their own purposes.
- Neon — the database that stores contact form submissions and page-view records. United States.
- Resend — sends us the email alert when you submit the form, and sends you any paperwork you ask for. United States.
- Upstash — the rate limiter described above. Holds your IP address for ten minutes.
- Stripe — takes subscription payments and holds the card details we never receive. Ireland and the United States.
- Vercel — hosting, content delivery and server logs.
- Google — Analytics, and only with your consent.
How the disclosure actually happens: data reaches these providers over encrypted connections to their APIs, at the moment it is needed — your submission is written to the database as you send it, the alert goes to the email service as it is sent, the payment goes to Stripe as you pay. There is no bulk export, no feed and no batch upload to anyone.
We do not sell your data, we do not share it for advertising, and we do not disclose it to anyone outside the list above — except where the law requires it of us, such as a binding order from a court or a tax authority, or where we have to share it to establish or defend a legal claim. If we ever sell or merge the business, whoever takes it on inherits this notice with the data.
Where your data goes
Mt7 is registered in India and the providers above operate outside it, principally in the United States. Submitting the form therefore involves a transfer of your data out of India, which the Digital Personal Data Protection Act 2023 permits except to countries the Central Government has restricted.
If you are in the United Kingdom, the European Economic Area or another region with its own transfer rules, contact us before submitting anything you would rather keep local and we will tell you exactly where it would sit.
How long we keep it
- Contact form submissions: 24 months, then deleted. If we go on to work together, the project records that follow are kept for eight years from the end of the financial year they fall in, because Indian company and tax law requires it.
- Page-view records: 14 months, then deleted.
These are enforced by a scheduled job, not by intention. Ask us to delete your record sooner and we will.
Your rights
Under the DPDP Act 2023 you may ask us for a copy of what we hold about you, ask us to correct or complete it, ask us to erase it, withdraw a consent you previously gave, and nominate someone to exercise these rights on your behalf if you are unable to.
Email founder@mt7.io and we will answer within thirty days. That address is also our grievance route: if you are not satisfied with the answer, you may complain to the Data Protection Board of India. If you are outside India, tell us which regime you are relying on and we will handle the request under it.
Children
This site is aimed at businesses and is not intended for anyone under eighteen. We do not knowingly collect data from children, and we do not run behavioural advertising or tracking of the kind the DPDP Act prohibits in respect of children. If you believe a child has sent us their details, email us and we will delete them.
Changes to this notice
The version number and date at the top of this page change whenever the substance does. Every consent we hold is stored against the version that was live when it was given, so a later edit never rewrites what you agreed to.
Questions about any of this go to founder@mt7.io.