Privacy and cookies,in plain words.

We are a design and engineering studio, not an advertising business. We collect what you type into our forms so we can answer you, we count page reads with a first party tally, and the portals store the records that client and partner work needs. Nothing here is sold, rented or shared for marketing, and no third party gets to watch you browse this site.

The contact and brief forms. Your name, your email address and whatever you write to us. It goes into our own database so we can reply, and it becomes part of the conversation if we end up working together.

Job and partner applications. What you submit: your details, your links, your answers. Read by the people doing the hiring or the admitting, kept while the process runs, and linked to the status page we email you.

The portals. If you are a client or a partner, your account holds the working record: proposals, projects, invoices, messages and files. That data is the work itself, and it stays as long as the relationship does.

Email. Mail between us and clients is sent through a transactional provider and kept as a permanent record alongside the project, which is part of how we run engagements honestly.

Us. Ultrabasic Labs LLP, Bengaluru, India. We decide what is collected here and why, which makes us the controller of it. Write to hello@ultrabasiclabs.com about anything on this page and a person answers, usually inside a working day.

Where it lives. Our database, authentication and file storage are Supabase, hosted in Mumbai (ap-south-1). The site itself is served by Vercel from its edge network. Transactional email — invites, receipts, password resets, the mail attached to a project — goes through Resend. Those three are the only companies that touch your data, they process it on our instructions and for nobody else, and none of them is an advertising business.

Coming from outside India. If you write to us from the UK, the EU or anywhere else, what you send is stored in India. We rely on your consent and on the contract between us to move it there, and it is held to the same terms wherever you happen to be sitting.

The marketing site sets no tracking cookies. None. What it keeps is one first party tally of which pages get read, so we know what is worth writing more of. It does not follow you to other sites, it is not joined to your name, and it only starts counting if you press Accept on the notice — ignoring the notice is a no, and so is closing it.

What does get stored in your browser: your answer to the cookie notice, so we stop asking, and, if you sign in to a portal, the session that keeps you signed in. Both are ours, both are functional, neither is tracking.

What we do not use at all: advertising pixels, third party analytics, fingerprinting, or anything that identifies you across the web.

Because you asked us something. A contact form, a brief, an application: you wrote to us and a reply is the point. We keep an enquiry that goes nowhere for two years, in case you come back, and then it is deleted.

Because we have a contract. Everything in the portals is the engagement itself. It stays for as long as we work together and seven years after it ends, because invoices and the records behind them have to survive that long under Indian tax law. Nothing else does.

Because you said yes. The page tally, and only that. Say no, or say nothing, and it does not run. You can change your mind either way, whenever you like, from the notice.

Applications. Kept for the length of the process and twelve months after, so we can come back to you when something closer opens. Ask us to delete it sooner and we will.

Write to hello@ultrabasiclabs.com and a person will answer. You can ask what we hold about you, ask for a copy of it in a form you can take elsewhere, ask us to correct it, ask us to delete it, ask us to stop doing something with it, or withdraw a consent you gave. Deleting works everywhere except where a record has to stay for legal or accounting reasons, such as issued invoices, and we will tell you plainly if that is the case.

No charge, and an answer inside thirty days. We will not ask you for ID unless we genuinely cannot tell it is you.

If we get it wrong. Tell us first — the same address, and it reaches a person, not a queue. If we have not sorted it out to your satisfaction you are entitled to take it further: in India, to the Data Protection Board; in the UK, to the Information Commissioner’s Office; in the EU, to your own country’s supervisory authority. We would rather you did not have to, and we will tell you who to contact if you ask.

When this page changes, it changes here, with the date at the top. There is no popup campaign about it.