Privacy Policy

1. Data Controller Identification

This website and the Qenlo open-source project are maintained by Akshat Singh Kushwaha (operating under the organization moniker a3ro-dev). For any inquiries, concerns, or requests regarding this Privacy Policy or our data practices, contact us at:

• Maintainer Direct Email: akshatsingh14372@outlook.com
• Security & Vulnerability Reporting: See SECURITY.md
• Repository & Issues: https://github.com/a3ro-dev/qenlo

2. Scope of this Policy

This Privacy Policy applies to the public website hosted at a3ro-dev.github.io/qenlo (including documentation pages and landing assets) and direct communications with the project maintainers. It explains how we collect, process, and safeguard information in compliance with:

• EU & UK General Data Protection Regulation (GDPR)
• EU ePrivacy Directive (Directive 2002/58/EC as amended)
• California Consumer Privacy Act (CCPA) / California Privacy Rights Act (CPRA)
• India Digital Personal Data Protection Act, 2023 (DPDP Act)
• California Online Privacy Protection Act (CalOPPA)

3. Information We Collect and Process

A. Core Software & SDKs (Local-First Guarantee)

When you download, compile, or embed Qenlo (e.g., via Cargo, npm, PyPI, or local builds), Qenlo operates strictly locally. It does not install background telemetry daemons, does not report installation events, does not track feature usage, and transmits zero user data. Any telemetry capability (such as OpenTelemetry OTLP tracing for benchmarks) is strictly opt-in and controlled by the host application.

B. Website Infrastructure & Technical Server Logs

When accessing this website, our hosting infrastructure provider (GitHub Pages operated by GitHub Inc. / Microsoft Corporation) and our content delivery network (Amazon Web Services CloudFront) automatically log standard HTTP protocol requests. These logs may contain:

• Internet Protocol (IP) address;
• Date, time, and timezone of the request;
• Uniform Resource Identifier (URI) requested;
• HTTP status response code and bytes transferred;
• User-Agent string (browser type, version, and operating system);
• Referring webpage URL.

Legal Basis: Processing this server data is justified under GDPR Article 6(1)(f) (Legitimate Interests) to maintain network security, mitigate Distributed Denial of Service (DDoS) attacks, ensure server stability, and deliver requested content.

C. Direct Inquiries and Form Submissions

If you submit an inquiry through our contact form or email us directly, we collect only the information strictly necessary to process your request:

• Your name or alias;
• Your business or personal email address;
• The subject and content of your message.

Legal Basis: Processing is based on your explicit, affirmative consent pursuant to GDPR Article 6(1)(a) and Section 6 of the Indian DPDP Act 2023. We do not use your contact information for unsolicited commercial marketing or newsletters without separate, prior opt-in consent.

4. What We Do NOT Collect

• No Advertising or Tracking Cookies: We do not deploy third-party advertising networks, behavioral tracking cookies, cross-site trackers, or browser fingerprinting scripts.
• No Analytics Pixels: We do not load Google Analytics, Meta Pixel, Hotjar, or similar invasive behavioral tracking scripts.
• No Sale or Sharing of Personal Data: We have not sold, rented, or shared personal information for monetary or other valuable consideration in the preceding 12 months, and we will never do so (CCPA/CPRA § 1798.120).
• No Sensitive Personal Data: We do not collect racial/ethnic origin, religious beliefs, biometric data, genetic data, health data, or financial account details.

5. Third-Party Subprocessors and Embeds

6. Cookies and Local Storage

This website employs only strictly necessary technical storage (via browser localStorage) required to operate the user interface:

• qenlo_consent_preference: Records whether you have dismissed or set preferences on the cookie notice so the banner does not re-appear on every page navigation.
• qenlo_reduced_motion: Stores your preference for video animation playback.

Because these storage items are strictly necessary to deliver services explicitly requested by you, they are exempt from consent requirements under Article 5(3) of the EU ePrivacy Directive. For further information, see our dedicated Cookie Policy.

7. Data Subject Rights

Depending on your geographic jurisdiction, you have statutory rights concerning your personal data:

A. Rights under the GDPR (European Economic Area & UK)

• Right of Access (Art. 15): Request confirmation and a copy of any personal data we hold about you.
• Right to Rectification (Art. 16): Request correction of inaccurate or incomplete personal data.
• Right to Erasure (Art. 17): Request deletion of your personal data ("Right to be Forgotten").
• Right to Restriction of Processing (Art. 18): Request temporary or permanent limitation of data processing.
• Right to Data Portability (Art. 20): Request transmission of your data in a structured, machine-readable format.
• Right to Object (Art. 21): Object to processing based on legitimate interests.
• Right to Withdraw Consent: Withdraw previously granted consent at any time with future effect.
• Right to Lodge a Complaint: Lodge a complaint with your national Data Protection Supervisory Authority (e.g., CNIL in France, BfDI in Germany, ICO in the UK).

B. Rights under California Law (CCPA / CPRA)

• Right to Know / Access: Request disclosure of personal information categories collected, sources, and business purposes.
• Right to Delete: Request deletion of personal information collected from you.
• Right to Correct: Request correction of inaccurate personal information.
• Right to Opt-Out of Sale / Sharing: We do not sell or share personal information.
• Right to Non-Discrimination: You will never receive discriminatory treatment, altered service quality, or penalties for exercising CCPA rights.

C. Rights under the Indian DPDP Act, 2023

Data Principals have the right to obtain a summary of personal data processed, request correction or erasure, nominate another individual in the event of death or incapacity, and access grievance redressal mechanisms.

8. How to Exercise Your Rights

To exercise any statutory privacy rights, email your request directly to the maintainer at akshatsingh14372@outlook.com. We will acknowledge your request within 48 hours and provide a full substantive response free of charge within thirty (30) calendar days (or within statutory timelines applicable to your jurisdiction).

9. Data Retention and Security

We retain submitted communication data only as long as necessary to fulfill the specific purpose of the inquiry or to satisfy statutory record-keeping obligations. Server logs maintained by hosting providers are automatically purged or rotated on standard rolling schedules (typically 30 to 90 days). We implement reasonable organizational and technical safeguards, including HTTPS TLS 1.3 encryption in transit, strict repository access controls, and minimization of retained data.

10. Children's Privacy

This website and the Qenlo software are intended for software engineers, researchers, and professional developers. We do not knowingly solicit or collect personal information from children under 16 years of age (or the applicable age of digital consent in your jurisdiction). If you believe a minor has provided us with personal information, please contact us immediately for prompt deletion.

11. International Transfers

Website hosting servers and CDN edge nodes are located globally, including in the United States. If you access this website from outside the United States, your connection data may be transferred internationally under applicable Standard Contractual Clauses (SCCs) and adequacy decisions.

12. Changes to this Privacy Policy

We may periodically update this Privacy Policy to reflect software evolution or legal requirements. Material changes will be marked with a revised "Last Updated" date at the top of this document. We encourage users to review this page periodically.