This policy explains what reactdevstudio collects when you visit this website or contact us about work, why we collect it, how long we keep it, and what you can ask us to do with it. It covers the website and our sales correspondence. It does not cover data inside a client system we are engaged to work on, which is governed by the contract and data processing agreement for that engagement.
Who we are
reactdevstudio is a software development studio based in Pune, Maharashtra, India. For the purposes of the UK GDPR and the EU GDPR we are the data controller for the information described here. We contract and invoice under the name reactdevstudio. Data protection questions go to connect@reactdevstudio.com, which reaches a person rather than a ticket queue, and our postal address is available on request. We are not required to appoint a data protection officer and have not appointed one; that address reaches the person who would do the job.
What we collect
Three categories, and nothing beyond them.
We do not collect special category data, we do not ask for a CV or personal identifiers through this site, and we have no account system, so there is nothing to register for and no password to store. Nothing is used for automated decision making or profiling: no score is calculated about you and no outcome is decided by software. Telling us anything at all is voluntary, and the only consequence of not filling the form in is that we have no way to reply. This site sells to companies and is not directed at children.
Cookies and analytics
This site sets no advertising cookies, runs no third party trackers, and currently runs no analytics at all. It sets no cookies of any kind and stores nothing in your browser, which is why you were not asked to dismiss a consent banner on the way in. If that ever changes it will be a privacy focused, cookieless product configured to collect aggregate figures only, with IP addresses truncated before storage, and we will update this section and the date at the top of the page before the change goes live.
Third parties that see your data
Formspree, which processes the contact form. When you press Send it, your name, work email, what you need and your message pass through Formspree's servers in the United States on the way to our inbox.
Vercel, which hosts this site. Like any host it terminates your request and keeps standard server logs, including your IP address, under its own retention policy.
Our email provider, which receives and stores the correspondence you send us in the account described under Security.
Our accounting and payment providers, for clients only, which receive billing details.
Fonts and icons are served from this domain, not a third party. Nothing on a page you load reaches an external font or icon provider, so none of them sees your IP address.
We do not sell data, we do not share it with advertisers, and we do not use it to train anything.
Why we are allowed to hold it
Legitimate interest for answering an enquiry you sent us. If you write to a studio asking about work, replying is the expected outcome.
Contract for anything we hold about an active client, because we cannot deliver or invoice without it.
Legal obligation for invoices and tax records, which we are required to retain.
Consent for anything optional, which today means nothing. There is no mailing list. If we start one it will be opt in and separately worded.
International transfers
We are in India and most of our clients are in the United States and the United Kingdom, so data moves across borders by design. Where we handle personal data originating in the UK or EEA we rely on the standard contractual clauses in our client agreements, and we will sign a data processing agreement on request rather than treating it as an exception. Details of the SCC mechanism are published by the European Commission. The two processors named above are both United States companies, so an enquiry sent through this site crosses a border before it reaches Pune. If you would rather it did not, email us directly instead of using the form. We have not appointed a representative in the UK or the EU: Article 27 of both regimes requires one only where the processing is more than occasional or carries risk to the people involved, and ours is a small volume of business enquiries with no special category data and no monitoring of behaviour. If that stops being true we will appoint one and name them here.
Your rights
If you are in the UK or the EEA you can ask us for a copy of what we hold, ask us to correct it, ask us to delete it, object to us holding it, or ask for it in a portable format. Write to connect@reactdevstudio.com and we will respond within thirty days. There is no charge and we will not ask why.
If you are unhappy with how we handled a request you can complain to your local supervisory authority. In the UK that is the Information Commissioner's Office. We would rather you told us first, but you are not obliged to.
Indian residents have equivalent rights under the Digital Personal Data Protection Act, and the same email address is the route for those requests.
Security
The practical answer rather than the reassuring one. Correspondence lives in a managed email account with two factor authentication on every device. Client credentials are held in a password manager, never in a document or a message. We work as members of your accounts, never as owners, so revoking our access is something you can do yourself in a minute without asking us.
We have never had a breach. If we did, we would tell affected people directly and notify the relevant authority within seventy two hours, which is the standard the GDPR sets. If you think something has gone wrong with data we hold, write to connect@reactdevstudio.com and it will be read by a person, not triaged.
Changes to this policy
When this changes we update the version number and effective date at the top of this page. Material changes affecting anyone who has contacted us will also be sent by email rather than published quietly.
Last reviewed August 2026. Related: terms and conditions and the contact page.