Privacy policy

Todkett is an automation lab based in Bangalore, India. The site and this policy are run by Nitin Sarkar, a sole proprietor. Under India’s Digital Personal Data Protection Act 2023 that makes Nitin Sarkar the data fiduciary, and under the EU and UK General Data Protection Regulation the controller, for everything this policy describes.

Grievance officer

Nitin Sarkar. The same person answers every privacy question and complaint, from any country.

Privacy address

privacy@todkett.com

Everything else

hello@todkett.com

Postal address

Given on request, by email, to anyone who needs it for a legal notice.

How fast we answer

We acknowledge within 2 working days and answer within 30 days. If a request takes longer, we say why and when.

The ROI calculator, the ATS resume checker and the PDF toolkit run in your browser. Your files, your resume, the job description and your numbers never leave your device: no upload, no account, no email.

• Files are read in your browser's memory and forgotten when you close the page. Nothing is saved in the browser for later.
• The ROI calculator can put your numbers in the link, after the # sign, so you can come back to them. Browsers do not send that part of a link to any server.
• Your numbers reach us only if you press Send this estimate, which opens the idea form with them filled in. Nothing is sent until you send that form.
• Each tool page shows what your browser requested during a run, so you can check this yourself.

Booking happens on Cal.com, under Cal.com’s own privacy terms as well as ours. Cal.com receives your name, email and answers; we receive the booking to prepare for the call, and the calendar invite goes to the address you gave.

Our n8n reads new bookings and emails us a short brief from a fixed template. Your website, if you give one, is shown as text and never opened. No model reads your answers. The call itself is not recorded unless you and we agree to it on the call.

We use Cloudflare Web Analytics to count page views. It runs without cookies and without storing your IP address with the count. It records the page address, the site you came from, your browser and device type, your country and how fast the page loaded, and gives us totals. It does not follow you across other sites and does not build a profile.

Google Search Console tells us which searches showed our pages on Google and how often they were clicked. Nothing on this site sends it anything about you: it is Google’s own report, confirmed by a record on our domain, and it shows queries and counts, never who searched.

We ask before setting any other cookie. If you click Accept in the cookie banner, we also load Google Analytics 4 (Google, United States: which pages are visited and how, with IP addresses anonymised), Microsoft Clarity (Microsoft, United States: heatmaps and session replays, so we can fix confusing pages) and PostHog (United States: how people move through the tools and pages). None of these load, and nothing is sent to them, until you click Accept. If you click “Only essential”, they stay off.

• Session replays mask form fields, and the free tools' file and text areas are masked completely: your files, resume and job text are never recorded.
• No advertising pixels and no fingerprinting.
• You can change your choice at any time with Cookie settings in the footer.
• Your cookie choice and your light or dark theme are saved in your own browser and never sent to us.

Questions, builds and workflow submissions happen in GitHub Discussions and GitHub issues under the Todkett organisation. To post you use your own GitHub account, and GitHub handles your account data as a separate controller under its own privacy statement. We moderate; we do not run GitHub.

• Anything you post there is public the moment you post it, and GitHub keeps history even if you delete it later. Remove every key, password, address, email and name first.
• If you submit a workflow, we read the file you link and publish the summary and your chosen name on this site under the licence in the terms. Ask us and we remove your name or the item from our pages; what GitHub keeps is GitHub's.
• You can take part without a GitHub account by writing to us through the idea form. Then only this policy applies.

Ideas and estimates

Up to 6 months after our last contact, then deleted.

Bookings and call briefs

Up to 6 months after our last contact, then deleted from our inbox and sheet.

Server logs

1 day. They hold the address of the page and the result, never what you typed.

IP address hashes

Cleared after 30 days.

Visit counts

Totals only, with nothing about you as a person.

Tool files and text

Never kept. They stay on your device.

Anything you ask us to delete

Deleted within 30 days, unless a law requires us to keep it, and then we tell you which law.

When the purpose ends, so does the data. We do not keep it in case it is useful later.

We work from Bangalore, so your data is handled in India, and by the services above where they run, which may be the United States or Europe. India has no adequacy decision from the EU or the UK, so here is the basis we rely on.

• You send us the form or the booking yourself, asking us to reply or to hold a call. The transfer to India is necessary for the steps you request, which the European regulation allows (Article 49(1)(b)), and we tell you here, before you send, that it happens.
• The services that process your data for us hold it under their own standard contractual clauses and data processing terms, which we accept when we set them up.
• If you would rather not send anything to India, do not use the form or the booking page. Every other part of the site works without them.
• Under India's law, a person outside India who sends us data is covered by this policy in the same way as anyone in India.

Write to the privacy address from the email address you used with us, so we know it is you. We ask for nothing more unless we cannot tell who is asking. We acknowledge within 2 working days and answer within 30 days, free of charge. Nobody is treated worse for asking.

In India

Under the Digital Personal Data Protection Act 2023: a summary of what we hold and what we did with it; correction, completion and updating; erasure once the purpose is served; withdrawal of consent; a person you nominate to act for you if you cannot; and a complaint to the grievance officer first, then to the Data Protection Board of India.

In the EU and the UK

Under the General Data Protection Regulation: access to a copy; rectification; erasure; restriction; portability in a common format; objection, which always stops marketing, and there is none; withdrawal of consent; and a complaint to your supervisory authority, which in the UK is the Information Commissioner's Office. We make no decision about you by automated means alone.

In California

Under the California Consumer Privacy Act: to know what we collect and why; to delete it; to correct it; and to be told that we do not sell or share personal information for advertising, which we do not. We honour these requests whatever our size.

Anywhere else

The same choices, by the same email. We do not keep two standards of care.

Sending an idea or booking a call is always your choice: the free tools and every page work without it.

This site is for adults. India’s law treats everyone under 18 as a child and requires a parent’s verifiable consent before their data is processed, and we have no way to take that consent. So if you are under 18, read and use the free tools as much as you like, but do not send the form, book a call or post on GitHub.

We do not knowingly collect data from anyone under 18. If we learn that we have, we delete it and tell the parent or guardian who writes to us. Nothing on the site tracks, profiles or advertises to a child.

• Every page and form travels over an encrypted connection.
• Raw IP addresses are never stored. The form's server refuses to run without the secret that salts the hash.
• Secrets live in the hosting settings, never in the code or on the page. The browser never talks to the lead store or to n8n directly.
• Only Nitin Sarkar can read leads and bookings. There is no team account and no shared login.
• If a breach affects your data, we tell you and the Data Protection Board of India as the law requires, and the EU or UK authority where that applies, without undue delay.
• This is the reasonable security practice India's information technology law asks of us, kept in proportion to a one-person site that stores little.

• Sell, rent or share your data for advertising.
• Profile you, score you or make a decision about you by automated means.
• Send marketing email, newsletters or follow-ups you did not ask for.
• Run a model on your form, your booking or your files.
• Add a service to the list above without changing this page first.

This policy was written by the owner, without a lawyer’s review, to the standard of India’s Digital Personal Data Protection Act 2023 and the EU and UK General Data Protection Regulation. A lawyer will review it, and this line will change when that has happened. Until then, if a line here is unclear, the stricter reading applies.

When this policy changes, its “Last updated” date in the contents list changes with it, and the new version applies from that date. For a change that affects what we do with data you have already given us, we tell you by email first. Earlier versions are available on request.

The rules for using the site are in our terms of use. How the community works is on the community page. To send us a task, use the idea form.