Legal

Privacy policy

Last updated 13 September 2026

This policy explains what personal data SutraForge collects, why, and what you can do about it. SutraForge is a sole proprietorship based in Himachal Pradesh, India ("SutraForge", "I", "me"). Questions go to hello@sutraforge.org.

1. This website

Contact form

When you use the contact form, I receive your name, email address, business name (if you give one), the service you selected and your message. These are used only to reply to you and discuss your project.

The form is processed by a Cloudflare Worker and delivered to my inbox using Cloudflare's email service. Submissions are not stored in a database; they exist as emails in my inbox and are kept for as long as we're in contact and for a reasonable period afterwards for record-keeping. For abuse prevention, the IP address of the sender is held briefly in memory to limit repeated submissions.

Hosting

The site is hosted on Cloudflare. As with any website, Cloudflare processes technical data such as IP addresses and browser information to deliver pages and protect against attacks.

Cookies and analytics

This site sets no cookies and uses no analytics, advertising or tracking scripts. Fonts are served from this site, not a third party.

2. Instagram auto-reply bots

SutraForge builds and operates Instagram auto-reply bots for businesses. If you send a direct message to, or comment on a post by, a business that uses one of these bots, the following applies.

What is processed

  • Your Instagram-scoped user ID, and your username if Instagram provides it
  • The text of your messages or comments to that business, and the bot's replies
  • Timestamps and message IDs, used to avoid replying twice and to limit how often the bot replies

Why

Only to generate and send replies on behalf of that business. The data is not sold, used for advertising, or combined with data from other businesses.

Who processes it

  • Meta Platforms delivers messages to the bot and sends its replies, via the Instagram Graph API.
  • Cloudflare runs the bot (Cloudflare Workers) and stores recent conversation history (Workers KV).
  • Anthropic generates reply text using its Claude models. Message text is sent to Anthropic's API for this purpose.

These providers may process data outside India.

How long it's kept

The bot keeps only the last few exchanges with each person. That record is deleted automatically 30 days after the most recent message.

Roles

The business that uses the bot decides why and how your messages are handled and is responsible for them (the "Data Fiduciary" under India's Digital Personal Data Protection Act, 2023). SutraForge processes the data on that business's behalf.

3. Deleting your data

To have your stored conversation data deleted, email hello@sutraforge.org with the subject "Data deletion request", your Instagram username and the business you messaged. I'll confirm by email once it's done. You can also ask the business directly, and your data is removed automatically after 30 days in any case.

4. Your rights

Under the Digital Personal Data Protection Act, 2023, you can ask to access, correct or erase your personal data, withdraw consent, nominate someone to act for you, and raise a grievance. Write to hello@sutraforge.org. If you're not satisfied with the response, you can complain to the Data Protection Board of India.

5. Security

All traffic to this site and to the bots is encrypted in transit (HTTPS). Access to stored data is limited to what each system needs, and as little data as possible is kept, for as short a time as possible.

6. Children

This website and SutraForge's services are intended for businesses and are not directed at children.

7. Changes

If this policy changes, the new version will be posted here with a new "last updated" date.

8. Contact and grievances

SutraForge · Himachal Pradesh, India · hello@sutraforge.org