1. Information we collect
- Account information, such as your name, email address and login identifiers.
- Content you choose to store, including projects, tasks, documents, boards, comments and attachments.
- Calendar events, invitations, share links, visitor access logs and session activity for content shared by you.
- AI prompts and generated outputs where you use AI writing or autofill (Pro only).
- Support messages and feedback you send.
- Usage, device, browser, diagnostic, security and IP-address information.
- Cookie or local-storage data required to maintain sessions, preferences and security.
2. Why we use it and lawful basis
Where consent is required under India’s DPDP Act 2023, Saswata processes your data on the basis of consent given through a clear notice at collection; you may withdraw consent at any time via Settings or saswatasg@gmail.com, without affecting prior lawful processing.
- Provide, synchronise and support Meldstead — performance of contract.
- Process payments, tax and invoicing via Paddle — performance of contract and legal obligation.
- Prevent fraud, protect accounts and ensure security — legitimate interests.
- Improve reliability and fix defects (aggregated diagnostics) — legitimate interests.
- Meet tax, accounting and legal duties — legal obligation.
- Understand which pages help people, with Google Analytics — consent, only after you accept in the cookie banner, withdraw any time.
- Send optional updates or marketing — consent, opt-out any time.
3. Sharing and subprocessors
Saswata shares only what is necessary with:
- Supabase — hosting, database, authentication and file storage.
- Paddle (paddle.com) — Merchant of Record for product sales, subscription management, payments, tax compliance and invoicing.
- Lovable gateway and the AI provider — AI writing and autofill processing (Pro only; prompts sent to generate output).
- notify.saswatasg.com — transactional email delivery.
- Lovable — website and application hosting.
- Cloudflare — content delivery, and Web Analytics for cookieless, aggregate page-view counts (no cookies, no personal profile; pages with private links are excluded).
- Google — Analytics and Tag Manager (only if you accept analytics), and Google Fonts for the typefaces (your browser requests them, which shares your IP address).
- Apple, Google and Mozilla push services — delivering notifications to devices where you turn them on.
- Professional legal or accounting advisers, and authorities where law requires it.
As an individual operator Saswata relies on these providers and operates no data centers of Saswata's own.
4. Retention
Saswata retains data only as long as needed for the purposes above:
- Projects and workspace content — purged immediately when you delete your account.
- Backups and server logs — deleted within 30 days of account deletion.
- Deleted projects, folders, documents and tasks — kept in Trash for 30 days so you can restore them, then removed.
- File versions — kept for 7 days (one year, one version a day, when the owner is on Pro), then deleted.
- Share sessions and cookies (wbs_*) — expire after 90 days.
Saswata then deletes or anonymises information when it is no longer needed, except where law requires longer retention.
5. International transfers
Your data is primarily processed in India and in the regions where the subprocessors above operate, including the US and EU (for example Supabase hosting, Paddle global billing, AI processing and email delivery). Where UK or EEA law applies, recognised safeguards such as adequacy decisions or standard contractual clauses are used. Where India’s DPDP Act applies, transfers are limited to what is necessary to provide Meldstead, subject to government-notified restrictions.
6. Your rights
Under India's DPDP Act you may request access, correction, erasure, nomination of another individual in case of death or incapacity, withdraw consent, and seek grievance redressal from Saswata at saswatasg@gmail.com with a 30-day response SLA. If unresolved, you may appeal to the Data Protection Board of India. Depending on where you live, you may also request restriction or portability, object to processing, or complain to your supervisory authority. UK and EEA requests are ordinarily answered within one month. Saswata may need to verify your identity before acting.
7. Security and breach notice
Saswata uses appropriate technical and organisational controls, including encrypted transport, access controls and account-scoped data rules. No online system can guarantee absolute security. Where law requires it, Saswata will notify affected users and the relevant authority of a personal data breach within 72 hours of becoming aware of it.
9. Contact
Privacy questions, consent withdrawal and rights requests can be sent through the Meldstead contact page or directly to Saswata at saswatasg@gmail.com (30-day SLA). Correspondence address (not a registered office): Uttarayan, Debanandapur, Hooghly, West Bengal, 712123.