1. Who we are
LegacyData by Kamyab is a digital-legacy preservation service run by Kamyab Infotech, with offices in New Delhi and Mumbai, India. In this policy, "we", "us" and "LegacyData" mean Kamyab Infotech acting through this service. "You" means the person who contacts us, uses this website, or hands us devices and data.
For the purposes of India's Digital Personal Data Protection Act, 2023 (the DPDP Act), we are the "Data Fiduciary": the party that decides why and how your personal data is handled for this service. You are the "Data Principal", the person the data is about.
2. Two kinds of information
It helps to separate two very different things:
- Information about you and your project: your name, phone number, email, city, device details and payment status. This lives on our website systems and is what most of this policy covers.
- Your files: photos, documents, videos and everything else on your devices. These never go into our website database. We handle them only to copy them to the destination you choose, under the rules in our Data Handling Policy.
3. What our website stores
The website stores only operational information needed to run your enquiry or project:
- Contact details you give us: name, mobile number, email address, city or locality, and your preferred way to be contacted.
- Your answers in the Digital Legacy Risk Assessment and the enquiry form.
- Device metadata: type, brand, model, serial number, capacity, condition, whether it is encrypted, and intake notes or photos of the device itself.
- Aggregate project figures: total number of files, total size, and migration and verification status.
- Quotes, payment status and payment references, and records of emails we send you.
- Basic technical and security logs, such as sign-in events.
- Simple first-party usage events (for example, a page viewed or a form completed) and, if you arrived through a campaign link, the campaign source. We do not store your IP address in our analytics. See the Cookie Policy.
The website does not store the names or contents of your files.
4. Why we use your information (purpose limitation)
We use your information only to:
- Respond to your enquiry and book assessments or projects.
- Carry out the work you have asked for, and keep you informed about progress.
- Issue quotes, invoices and receipts, and process payments.
- Keep a custody record of your devices while they are with us.
- Protect the service from abuse and meet legal obligations.
We do not sell your information. We do not use it for advertising profiles. We do not use your private files to train AI models, and content-level AI inspection of your files is not enabled by default. Anything beyond that would need your separate, specific permission.
5. Consent and notice
When you submit a form, we ask for your consent to use your information for the purposes above. This policy is the notice that explains what we collect and why. You can withdraw consent at any time by writing to aj@kamyab.co.in. Withdrawing consent may mean we can no longer continue a project, but it will not affect work already lawfully done.
If a device or data belongs to someone else, such as a parent or a deceased relative, please read our Customer Authorization & Migration Terms.
6. Data minimisation and accuracy
We ask only for what we need. If a field is optional, we say so. We try to keep your details accurate and will correct them when you tell us they are wrong.
7. Who we share information with
We share information only with service providers who help us run the service, and only as much as they need:
- Razorpay processes online payments. Your card, UPI or bank details are entered on Razorpay's pages. We never see or store card data.
- Cloudflare hosts our website and databases and provides the Turnstile bot check on forms.
- ZeptoMail delivers our emails to you.
- Professional advisers, auditors or authorities, where the law requires it.
Where you choose a cloud destination such as Google Drive, OneDrive or iCloud for your files, that provider's own terms apply to the destination account, which you own.
Some of these providers run servers outside India. We choose providers that protect data in transit and at rest, and we do not send your files to any provider you have not chosen as your destination.
8. Security safeguards
We use reasonable safeguards: encrypted connections, role-based staff access, private storage for intake photos and documents, signed and expiring links, audit logs, and chain-of-custody records for devices. No system is perfectly secure, but we take care to limit who can see what. If we ever suffer a personal data breach affecting you, we will tell you and the authorities as the law requires.
9. How long we keep information
We keep contact and project records for as long as needed to provide the service, support you afterwards, handle disputes, and meet accounting and tax obligations. Temporary working copies of your files follow a separate, shorter schedule described in our Data Retention & Deletion Policy.
10. Your rights
Under the DPDP Act you have the right to:
- Access: ask for a summary of the personal data we hold about you, who we have shared it with, and how we use it.
- Correction: ask us to correct or complete inaccurate data.
- Erasure: ask us to erase data we no longer need, unless we must keep it by law.
- Withdraw consent: at any time, as described above.
- Grievance redressal: have your complaint heard and resolved.
- Nominate: name another person to exercise these rights on your behalf if you die or become unable to do so.
To use any of these rights, write to aj@kamyab.co.in. We may need to confirm who you are first. We aim to acknowledge requests within 7 days and to respond fully within 30 days.
11. Grievance redressal
If you are unhappy about how your data has been handled, write to our grievance contact at aj@kamyab.co.in with the subject "Grievance". Please include your name, any KDC reference number, and what went wrong. If you are not satisfied with our response, you may approach the Data Protection Board of India once it is operational, as provided under the DPDP Act.
12. Children
This service is for adults. If a device contains a child's data, the parent or guardian must be the one to authorise the work.
13. Cookies
We use only strictly necessary cookies. See the Cookie Policy.
14. Changes to this policy
If we change this policy in a meaningful way, we will update the date at the top and, for customers with active projects, tell you by email.