Legal

Privacy policy

Last updated 24 September 2026

This policy explains what personal data SutraForge collects, why, and what you can do about it. SutraForge is a sole proprietorship based in Himachal Pradesh, India ("SutraForge", "I", "me"). Questions go to hello@sutraforge.org.

1. This website

Contact form

When you use the contact form, I receive your name, email address, business name (if you give one), the service you selected and your message. These are used only to reply to you and discuss your project.

The form is processed by a Cloudflare Worker and delivered to my inbox using Cloudflare's email service. Submissions are not stored in a database; they exist as emails in my inbox and are kept for as long as we're in contact and for a reasonable period afterwards for record-keeping. For abuse prevention, the IP address of the sender is held briefly in memory to limit repeated submissions.

Hosting

The site is hosted on Cloudflare. As with any website, Cloudflare processes technical data such as IP addresses and browser information to deliver pages and protect against attacks.

Cookies and analytics

This site uses no analytics, advertising or tracking scripts, and sets no cookies when you simply browse it. Fonts are served from this site, not a third party. The one exception is the client portal, below.

Client portal sign-in

Clients can sign in at /signin/ with Google. If you do, Google tells me your email address, your name and whether the address is verified; I do not receive your password, and I ask Google for nothing else. Your email address is checked against my list of current clients — if it isn't on the list, you are not let in.

Signing in sets one strictly necessary cookie holding a random session identifier, so the portal knows it is still you. It is not used for tracking or advertising. The session (your email address, name and sign-in time) is stored by Cloudflare and expires after 30 days, or immediately when you sign out. Successful and refused sign-in attempts are logged, including the email address used, so I can help when someone cannot get in; Cloudflare keeps those logs briefly.

Chat widget

The chat bubble on this site sends what you type, and the earlier messages in that conversation, to Google's Gemini API to generate a reply. No account or session is required to use it. The conversation is kept only in your browser's session storage (cleared when you close the tab) — I don't store it myself. If you use the contact form or email instead, that becomes a normal email, kept as described in section 1.

2. Instagram auto-reply bots

SutraForge builds and operates Instagram auto-reply bots for businesses. If you send a direct message to, or comment on a post by, a business that uses one of these bots, the following applies.

What is processed

  • Your Instagram-scoped user ID, and your username if Instagram provides it
  • The text of your messages or comments to that business, and the bot's replies
  • Timestamps and message IDs, used to avoid replying twice and to limit how often the bot replies

Why

Only to generate and send replies on behalf of that business. The data is not sold, used for advertising, or combined with data from other businesses.

Who processes it

  • Meta Platforms delivers messages to the bot and sends its replies, via the Instagram Graph API.
  • Cloudflare runs the bot (Cloudflare Workers) and stores recent conversation history (Workers KV).
  • Anthropic generates reply text using its Claude models. Message text is sent to Anthropic's API for this purpose.

These providers may process data outside India.

How long it's kept

The bot keeps only the last few exchanges with each person. That record is deleted automatically 30 days after the most recent message.

Roles

The business that uses the bot decides why and how your messages are handled and is responsible for them (the "Data Fiduciary" under India's Digital Personal Data Protection Act, 2023). SutraForge processes the data on that business's behalf.

3. Deleting your data

To have your stored conversation data deleted, email hello@sutraforge.org with the subject "Data deletion request", your Instagram username and the business you messaged. I'll confirm by email once it's done. You can also ask the business directly, and your data is removed automatically after 30 days in any case.

4. Your rights

Under the Digital Personal Data Protection Act, 2023, you can ask to access, correct or erase your personal data, withdraw consent, nominate someone to act for you, and raise a grievance. Write to hello@sutraforge.org. If you're not satisfied with the response, you can complain to the Data Protection Board of India.

5. Security

All traffic to this site and to the bots is encrypted in transit (HTTPS). Access to stored data is limited to what each system needs, and as little data as possible is kept, for as short a time as possible.

6. Children

This website and SutraForge's services are intended for businesses and are not directed at children.

7. Changes

If this policy changes, the new version will be posted here with a new "last updated" date.

8. Contact and grievances

SutraForge · Himachal Pradesh, India · hello@sutraforge.org