Legal

Privacy notice.

What we collect, why, who else touches it, and how to make us delete it. Written from what the code actually does.

Version v1 · Last updated 16 August 2026

The short version

We do not sell your data, we do not run advertising, and we set no cookies unless you tell us we may. If you fill in the estimate form we keep what you typed so we can reply to you. If you only read the site, we count the visit without storing your IP address and without identifying you.

Who is responsible for your data

Mt7 Private Limited (“Mt7”, “we”) is the data fiduciary — the controller — for everything described here.

  • Registered office: Hotel Grand Plaza, Adnan Complex, Nazirpura, Basheerganj, Bahraich, Uttar Pradesh 271801, India
  • CIN: U68200UP2025PTC233604
  • Contact for anything on this page: founder@mt7.io
  • WhatsApp: +91 78000 07500

What we collect when you ask for an estimate

The estimate form asks for five things, and the form is the only place on this site where you type anything about yourself. We collect exactly the fields you fill in:

  • Your name.
  • Your email address.
  • Your phone number — optional, and only if you would rather we called. Leaving it blank changes nothing.
  • What you are building, and the budget range you selected or wrote.
  • The page you were on when you opened the form, and a record that you accepted this notice, together with which version of it you saw.

We use it for one purpose: to write back to you with a scope and a price. Your consent is the lawful basis, you give it with the checkbox, and you can withdraw it at any time by emailing us — withdrawing is exactly as easy as giving it, which is a requirement of the DPDP Act and not a courtesy.

We do not add you to a mailing list. There is no newsletter to unsubscribe from because we do not send one.

What we collect when you just read the site

We measure our own traffic, first-party, without cookies. For each page view we record the page, how long you stayed, where you arrived from if it was an external link, your position in the visit, your device type (mobile, tablet or desktop), and an approximate location — country, region, city and timezone — that our network edge derives from the connection.

We do not store your IP address. To count returning visitors we compute a one-way hash of your IP address, your browser string, a secret, and today's date, and keep only the first sixteen characters of it. Because the date is part of the input, that value changes at midnight: you are one visitor today and an unrelated one tomorrow. It cannot be reversed into an IP address, and it cannot be used to follow you across days.

No cookie is involved in any of this. A random identifier for the current visit is held in your browser's sessionStorage, which the browser itself discards when you close the tab, and which is never sent anywhere except back to us with the page view.

Google Analytics — only if you allow it

Google Analytics is loaded only after you press Allow on the banner. Until then it runs under Google Consent Mode with storage denied, meaning no analytics or advertising cookie is written and no identifier is sent. If you press No thanks, or simply ignore the banner, it stays that way and our own cookieless measurement above is all that happens.

If you do allow it, Google receives your IP address and sets cookies in your browser, subject to Google's own privacy policy. You can change your mind by clearing this site's data in your browser, which removes the stored choice and brings the banner back.

Security and abuse prevention

When you submit the estimate form we pass your IP address to our rate-limiting service to enforce a cap of five submissions per connection per ten minutes. It is held for that window and then expires. Without it, an anonymous form that sends email and writes to a database is an open invitation.

Our hosting provider also keeps short-lived server logs, which include IP addresses, for operating and securing the service.

Who else processes your data

We use a small number of specialist providers. They act on our instructions only, and none of them are permitted to use your data for their own purposes.

  • Neon — the database that stores estimate submissions and page-view records. United States.
  • Resend — sends us the email alert when you submit the form, and sends you any paperwork you ask for. United States.
  • Upstash — the rate limiter described above. Holds your IP address for ten minutes.
  • Vercel — hosting, content delivery and server logs.
  • Google — Analytics, and only with your consent.

Where your data goes

Mt7 is registered in India and the providers above operate outside it, principally in the United States. Submitting the form therefore involves a transfer of your data out of India, which the Digital Personal Data Protection Act 2023 permits except to countries the Central Government has restricted.

If you are in the United Kingdom, the European Economic Area or another region with its own transfer rules, contact us before submitting anything you would rather keep local and we will tell you exactly where it would sit.

How long we keep it

  • Estimate submissions: 24 months, then deleted. If we go on to work together, the project records that follow are kept for eight years from the end of the financial year they fall in, because Indian company and tax law requires it.
  • Page-view records: 14 months, then deleted.

These are enforced by a scheduled job, not by intention. Ask us to delete your record sooner and we will.

Your rights

Under the DPDP Act 2023 you may ask us for a copy of what we hold about you, ask us to correct or complete it, ask us to erase it, withdraw a consent you previously gave, and nominate someone to exercise these rights on your behalf if you are unable to.

Email founder@mt7.io and we will answer within thirty days. That address is also our grievance route: if you are not satisfied with the answer, you may complain to the Data Protection Board of India. If you are outside India, tell us which regime you are relying on and we will handle the request under it.

Children

This site is aimed at businesses and is not intended for anyone under eighteen. We do not knowingly collect data from children, and we do not run behavioural advertising or tracking of the kind the DPDP Act prohibits in respect of children. If you believe a child has sent us their details, email us and we will delete them.

Changes to this notice

The version number and date at the top of this page change whenever the substance does. Every consent we hold is stored against the version that was live when it was given, so a later edit never rewrites what you agreed to.

Questions about any of this go to founder@mt7.io.