Privacy Policy
About this policy
This policy explains what personal data COOKIT collects, why, and what you can do about it. COOKIT is an agency management platform operated by Vincreda Software Solutions (“we”, “us”), and this policy covers the website at cookit.vincreda.com together with the COOKIT application.
Two roles are worth separating. On our website and in our own marketing, we decide how data is used, so we are the data fiduciary (or controller). Inside a client’s COOKIT instance, the agency decides what goes in and how it is used, and we act only on their instructions as a data processor. Section 4 covers that arrangement.
We follow India’s Digital Personal Data Protection Act, 2023, and the GDPR where it applies to clients or visitors in the EU and UK.
What we collect
|
Source |
What we collect |
Why |
|---|---|---|
|
Demo request form |
Name, email, phone, preferred date and time, your message |
To contact you and run the demo |
|
Newsletter form |
Email address |
To send product updates you asked for |
|
Email and calls |
Anything you choose to share with us |
To answer you and keep a record of the conversation |
|
Website visits |
IP address, browser and device type, pages viewed, referring site |
Security, troubleshooting and measuring what works |
|
Cookies and analytics |
Session and preference cookies, aggregated usage statistics |
To keep the site working and understand traffic |
|
COOKIT instance |
Data your agency puts in: user accounts, clients, projects, time, invoices, files |
To provide the service to that agency |
We do not buy personal data from third parties, and we do not collect sensitive categories such as health or biometric data through this website.
How we use it
We use the information above to respond to demo requests and enquiries, to set up and support client instances, to send product updates to people who subscribed, to keep the website secure and working, and to meet our legal and tax obligations.
Our grounds for processing are consent, which you give when you submit a form and can withdraw at any time; contractual necessity, where we need the data to deliver a service you or your agency has signed up for; and legitimate interest, for security, fraud prevention and basic analytics.
We do not sell personal data, and we do not share it with advertisers. We do not use client data in a COOKIT instance to train AI models.
Data inside a COOKIT instance
Each client runs on a separate instance rather than a shared multi-tenant database. Your agency’s data is never mixed with another client’s, and we do not use it to benchmark, profile or build features for anyone else.
The instance can be hosted on infrastructure your agency provides, or procured and managed by the COOKIT team on your behalf. Where you provide it, you control where the data sits and who else can reach it. Where we procure it, the hosting location and provider are named in your service agreement.
For data your agency puts into its instance, your agency is the data fiduciary and we are the processor. We access that data only to provide support, fix faults or carry out instructions you give us, and our staff access is limited to the people who need it. The specifics, including the deletion and export process when an engagement ends, are set out in the agreement between us.
Who else sees your data
We share personal data only with service providers who help us run COOKIT, and only to the extent they need it. These currently include our hosting and infrastructure provider, our email delivery provider, our website analytics provider, and our payment processor for billing. Each is bound by contract to protect the data and use it only for the service they provide to us.
We may also disclose data where the law requires it, such as a valid order from a court or regulator, and in connection with a merger or acquisition, in which case we would notify affected clients.
How long we keep it
|
Data |
Retention |
|---|---|
|
Demo and enquiry details |
24 months after our last contact, unless you become a client |
|
Newsletter subscription |
Until you unsubscribe, then we keep the unsubscribe record |
|
Client account and billing records |
For the engagement, then 8 years as required by Indian tax law |
|
Data in a COOKIT instance |
For the engagement, then deleted or exported per your agreement |
|
Website logs and analytics |
12 months |
Where we no longer need data, we delete it or anonymise it so it can no longer identify you.
How we protect it
Data is encrypted in transit using TLS and encrypted at rest on our servers. Access to production systems is restricted to authorised staff, protected by multi-factor authentication, and logged. Instances are backed up regularly, and backups are encrypted.
We review access rights periodically and remove them when someone leaves or changes role. If a personal data breach occurs that is likely to affect you, we will notify you and the Data Protection Board of India as required by law.
No system is completely secure, so we cannot guarantee absolute security, but we take these measures seriously and keep them under review.
How we protect it
You can ask us to:
- give you a copy of the personal data we hold about you
- correct anything inaccurate or incomplete
- delete data we no longer have a reason to keep
- withdraw consent you previously gave, including unsubscribing from emails
- nominate someone to exercise these rights for you if you are unable to
If the GDPR applies to you, you also have the right to restrict or object to processing, to receive your data in a portable format, and to complain to your local supervisory authority.
Write to the address in the last section and we will respond within 30 days. We may ask you to confirm your identity first. If your request concerns data held inside an agency’s COOKIT instance, contact that agency directly, since they control it; we will help them respond.
Cookies, children and transfers
Cookies. We use essential cookies to keep the site working and analytics cookies to understand how it is used. You can block or delete cookies in your browser settings, though essential cookies are needed for forms to work.
Children. COOKIT is a business tool and is not directed at children. We do not knowingly collect data from anyone under 18. If you believe a child has given us data, write to us and we will delete it.
Transfers outside India. Our servers are located in India by default. Where a client instance or a service provider is hosted elsewhere, we transfer data only to countries permitted under the DPDP Act and under contractual safeguards such as standard contractual clauses.
Changes. We may update this policy as the product or the law changes. The date at the top shows when it was last revised, and we will notify clients by email of material changes.
Contact us
For any question about this policy, or to exercise the rights above, contact our team:
Vincreda Software Solutions, contact@vincreda.com, +91 6361592022
We acknowledge requests within 72 hours and respond within 30 days. If you are not satisfied with our response, you may complain to the Data Protection Board of India.
Get product updates
in your inbox
COOKIT is an Operating system for Agencies and Botique firms developed by Vincreda Software Solutions
Vincreda helps startups, SaaS companies and growing businesses turn ideas into working products, modernize legacy applications, solve complex technology problems, and evaluate AI systems with expert human judgment.
© 2026 Vincreda. All rights reserved. Privacy Policy