Privacy.

Clearly.

This privacy policy applies to 4AM Tech Private Limited (“4AM Tech”, “we”, “us”), an Indian private limited company, and to every interaction you have with our website 4am.tech, our client dashboard, and the sites or apps we build for you.

We are a small team. Every engineer and designer who touches your data is a named employee on a signed NDA. No offshore contractors, no anonymous data processors.

We collect data in three buckets, at three different moments:

1. Account data — when you sign up

• Name, email, phone. For sign-in, delivery updates, support replies.
• Password hash. We never see your real password. Google SSO is also available and we only receive the email and display name from Google.
• Business name + city. To personalise your dashboard and generate GST-compliant invoices.

2. Project data — when you buy or brief

• Brief form content — copy, photos, logos, brand references you upload.
• GSTIN and billing address for invoicing.
• Messages between you and your build team.

3. Usage data — automatic

• IP address, browser, device type, pages visited, timestamps.
• Cookies (see section 05).
• Error logs (if something crashes, we capture the stack trace — no form-field contents).

We do not collect: precise location, contacts list, microphone or camera, social graph, health or financial identifiers (Aadhaar, PAN), or anything else we don’t need to build and run your site.

We process your data only for these reasons:

• Delivery. Building, hosting, and maintaining your site or app.
• Billing. Generating invoices, processing payments, recording taxes.
• Support. Responding to your messages, tickets, and WhatsApp queries.
• Product improvement. Aggregated, de-identified usage stats only. Never your brief content.
• Legal compliance. Tax filings, DPDPA requests, court orders.

We use a small number of third-party services to operate. Each is listed below with exactly what data crosses the boundary. All are bound by their own privacy policies (linked).

We keep the cookie footprint minimal. No advertising cookies, no cross-site trackers. The table below lists everything we set.

Essential cookies cannot be disabled without breaking sign-in. Functional and analytics cookies can be switched off from your account settings once you sign in.

• Location. All production databases and file storage live in Mumbai, India (ap-south-1 region, Hostinger VPS). Nothing leaves the country except email delivery handoff.
• Encryption. TLS 1.3 in transit. AES-256 at rest. Database backups encrypted with a separate key.
• Backups. Daily snapshots, retained for 30 days, then rotated. Quarterly cold archives for the past year.
• Access. Only named, on-payroll engineers can touch production. Every access is audit-logged and signed.
• Retention. Active project data is kept until you delete your account. After deletion, we retain invoice records for 8 years (Indian tax law requires this) and nothing else.

• Access. See everything we hold about you. Email privacy@4am.tech. We reply within 30 days.
• Correct. Anything wrong? Fix it yourself from your dashboard, or email us.
• Delete. Account settings → “Delete account”. Or email us. Invoice records stay (tax law); the rest goes.
• Export. Machine-readable JSON of your brief, messages, and billing data.
• Withdraw consent. Opt out of analytics or marketing email anytime. Doesn’t affect essential service emails.
• Object. Disagree with how we process something? Write to the grievance officer in section 11.

Our service is meant for adults running or starting a business. We do not knowingly collect data from anyone under 18. If you think a minor has signed up, email us and we will delete the account.

Two sub-processors sit outside India: Resend (US, for email delivery) and Cloudflare (global edge network). Both have signed DPAs with us and standard contractual clauses. Only the minimum data needed crosses the border — an email address for a receipt, an IP hash for DDoS protection.

Everything else — your brief, your photos, your messages, your invoices — stays in Mumbai.

Material changes (new sub-processor, new data category, changed retention) are notified by email at least 30 days before they take effect. A banner on the dashboard will also flag it. Minor edits (typos, clarifications) are posted silently with an updated version number.

Older versions are archived and available on request — ask the grievance officer.

If anything here concerns you, or you want to escalate:

• Name. To be appointed on incorporation — contact founder directly until then.
• Email. grievance@4am.tech
• Response SLA. First reply within 72 hours. Resolution within 30 days.
• Escalation. If unresolved, you may complain to the Data Protection Board of India.

• General. hello@4am.tech
• Privacy. privacy@4am.tech
• Support. support@4am.tech (or WhatsApp link inside your dashboard)
• Post. 4AM Tech Private Limited, registered office — Mumbai, Maharashtra, India. Full address on invoices.