Privacy Policy

1. Who we are

HashKrypt Technologies ("we", "us") provides Web3 security audits, business logic reviews, compliance assessments and due diligence services. We decide why and how your personal data is handled: a Data Fiduciary under India's Digital Personal Data Protection Act 2023, and a controller under the UK and EU GDPR. For anything in this policy, write to legal@hashkrypt.com.

That address also reaches the person responsible for grievances under the DPDP Act. If you are not satisfied with our answer, you may complain to the Data Protection Board of India, or to your own supervisory authority if the GDPR applies to you.

Registered office: New No 6, Old No 15, South Canal Bank Road, Mandaveli Street, Raja Annamalaipuram, Chennai, Tamil Nadu 600028, India

2. Which law applies to you

We are established in India, so the DPDP Act governs how we operate. The GDPR applies on top of it where we handle the data of people in the United Kingdom or the European Economic Area, which we do, because our clients and the projects we assess are spread across both.

Where the two differ we apply whichever gives you more protection, rather than the minimum either one allows. The sections below say which regime a particular right or duty comes from when it matters.

3. What this website collects

Almost nothing. This site sets no cookies, runs no analytics, embeds no trackers and has no database. Sample reports are static files. The only thing you can send us is the contact form, covered below.

The contact form sends your message to us as an email. It is not written to a database, and we keep it only in the mailbox that receives it, under the retention rule in section 10. Your address is used to reply to you and nothing else.

Your IP address is used, in memory and briefly, to limit how many messages one sender can submit per hour. It is not logged with your message and not kept.

Our hosting provider keeps standard server logs (IP address, user agent, requested page, timestamp) for delivery and abuse prevention. We do not use those logs to build profiles.

4. What we collect when you contact us

• Your name, email address and, if you give it, your project or company.
• The content of your message and any later correspondence.
• Scoping notes: what you want reviewed, target chains and markets, timelines.

We use this to answer you, prepare a quote and keep a record of what was agreed. If we do not end up working together, we keep the thread only as long as it is useful and then delete it.

5. What we receive during an engagement

An audit only works if you hand us sensitive material. Depending on the service, that can include:

• Source code, repositories, commit history, test suites and deployment scripts.
• Architecture documents, threat models, internal specifications and unreleased product plans.
• Contract and wallet addresses, transaction history and admin key structures.
• For access control due diligence: the names, roles and work email addresses of the people who hold privileged keys or admin accounts.
• For compliance work and due diligence: corporate documents, licence applications, ownership structures and, where the scope requires it, identity documents of founders or beneficial owners.

6. What we never ask for

We do not ask for private keys, seed phrases, mnemonic backups or production credentials, and we will not accept them if offered. Anything we need to reproduce an issue can be reproduced on a fork or a testnet. If someone claiming to be us asks you for a key, it is not us.

7. Why we are allowed to process it

The two regimes reach the same result by different routes, so we state both rather than borrowing one regime's vocabulary for the other.

• Under the DPDP Act, most of what we hold is processed for the certain legitimate uses the Act allows: you have voluntarily given us the data for a purpose you asked us to carry out, and we are meeting obligations the law puts on us. Where that does not cover something, we ask for your consent and tell you what it is for, in a notice you can read before you agree.
• Under the GDPR, the equivalent bases are performance of a contract (doing the audit you engaged us to do), legitimate interests (running the firm, keeping engagement records, defending our work if it is later challenged, preventing fraud), and legal obligation (tax, accounting and anti-money-laundering duties where they apply to us).
• Consent under either regime is asked for separately and never bundled into an engagement letter: naming you as a client, publishing a case study, or anything else that is not needed to do the work. You can withdraw it at any time, as easily as you gave it, and we stop the processing it covered.
• Withdrawing consent does not reach back: it does not undo processing we had already carried out lawfully, and it does not erase a signed report we are required to keep.

8. Confidentiality and who sees your material

• We sign a non-disclosure agreement before code changes hands, on your paper or ours.
• Access is limited to the auditors assigned to your engagement, on a need-to-know basis.
• We publish nothing about your product without your written approval. A public attestation states only what you have approved us to state.
• We do not use your code to train models, and we do not feed it to third-party AI services.
• Findings are never shared with other clients. Generic lessons may inform our methodology; your specifics never leave the engagement.

9. How we protect it

• Encrypted in transit and at rest, on company-controlled systems.
• Multi-factor authentication and hardware keys on every account that can reach client material.
• Per-engagement access that is revoked when the engagement closes.
• Company devices with full-disk encryption. No client code on personal machines.

10. How long we keep it

• Source code and repository copies: deleted within 90 days of final report delivery, unless you ask us in writing to retain them for a re-audit.
• Reports and engagement records: retained for six years, so we can stand behind work that is later questioned and meet our own accounting duties.
• Identity and ownership documents collected for due diligence: retained only as long as the applicable regulation requires, then deleted.
• Contact enquiries that do not become engagements: deleted within 12 months.

11. Who we share it with

We do not sell personal data and we do not share it for advertising. There is no third-party form or mailing service between you and us: the contact form hands your message to our own mailbox, and it travels no further than our email provider.

The providers we do use, bound by contract and confidentiality: Vercel Inc. for website hosting, and Zoho Corporation for email, whose Indian data centres keep that correspondence in India. We name them here rather than on request, because the DPDP Act and the GDPR both expect the list.

We disclose material to a regulator, court or law enforcement only where we are legally compelled, and where we are permitted to tell you, we will.

12. International transfers

We work across India, the European Union, the Middle East, Singapore and elsewhere, so material may be processed outside the country you are in.

Under the DPDP Act we may transfer data outside India except to a country the Central Government has restricted by notification. We check that list before moving anything, and we do not transfer to a restricted country.

Under the GDPR, where we move data out of the UK or the EEA we rely on an adequacy decision, or on standard contractual clauses with the recipient together with a transfer risk assessment. India has no EU adequacy decision, so transfers to us are made on standard contractual clauses.

13. People we assess who are not our client

Due diligence and access control work necessarily covers people who did not hire us: key holders, founders, signers on an address. The data comes from our client or from public on-chain and registry data, is limited to what the assessment needs, and is used for that assessment only.

Under the GDPR we rely on legitimate interests for this, balanced against the rights of the person assessed. The DPDP Act has no general equivalent, so where it applies we work from data that is already publicly available, which the Act leaves outside its scope, or from data our client is entitled to share with us and has told that person about. We do not build profiles beyond the engagement, and we do not keep this material once the assessment is delivered, under the retention rule in section 10.

14. Your rights

Write to legal@hashkrypt.com for any of these. We answer within 30 days, and sooner where the law requires it.

• Under the DPDP Act: a summary of the data we hold about you and what we have done with it, correction or completion of data that is wrong or incomplete, erasure where we no longer need it, and the right to nominate someone to exercise these rights for you if you die or become incapacitated.
• Under the GDPR, additionally: a full copy of the data rather than a summary, restriction of processing, objection to processing based on legitimate interests, and portability of data you gave us in a machine-readable form.
• Under either regime: the right to withdraw a consent you gave, and the right to complain. We would rather you came to us first, but you do not have to.

Two limits worth stating plainly. Where deleting a record would destroy evidence of an audit we have signed, we may keep that record and tell you why. And where a request would expose someone else's confidential material, we answer the part that concerns you and say what we have withheld.

15. Complaints

Write to legal@hashkrypt.com first. We acknowledge within 7 days and answer within 30. Tell us it is a grievance under the DPDP Act and it goes to the person responsible for them.

If our answer does not satisfy you, you can escalate: to the Data Protection Board of India under the DPDP Act, or, where the GDPR applies to you, to the supervisory authority where you live or work. Neither route requires our permission or our involvement.

16. Children

Our services are for businesses and professional individuals. We do not knowingly collect data from anyone under 18.

17. Changes

We update this policy when our practices change. The date at the top is the version you are reading. Material changes affecting an active engagement will be sent to you directly. Questions: legal@hashkrypt.com.