What this site collects

Stafflo is a trading name of devsforfun Studio (OPC) Private Limited, registered in India. For anything on this page, write to privacy@stafflo.ai.

Your name, work email and company; your company website and your industry, if you give them; your answer to “which process would you hand over first?”; where you heard about us, if you say; and the time you selected.

If the link that brought you to the form was about a particular demo, service or topic, we keep that with the booking so we know what you came to ask about. If the link carried a campaign tag (the utm_source and utm_campaign values in the address), we keep that too. It tells us which of our messages you followed, and it is the only attribution this site does.

Nothing else. There is no hidden field, no tracking pixel in the form, and no enrichment service filling in the gaps afterwards. We also record the moment you ticked the consent box, because a consent record without a timestamp is not much of a record.

To buy the audit you sign in with devsforfun ID, our own account platform. We receive your account’s identifier, email address, name and picture, keep them as your account here, and keep an order record: the price region (from the country you visited from), the amount, the payment references Razorpay issues, and the business details you give before paying (your name, the email and phone for updates, the company, its website and address, and a tax number if you want one on the invoice). We keep those even if you don’t finish paying, so we can answer a question about an order that stopped halfway. We never see your card or UPI details; Razorpay collects them.

After paying you fill in the intake form: your company, its website and team size, the process to audit first, the systems it touches, the question you want answered, and dates that suit your team. We store it with the order and email it to ourselves so that someone replies to you within one working day.

While the audit runs we email you when it moves to a new stage and once every 24 hours with where it is, and keep a record of each update with the order. The emails stop when the report is delivered.

When you ask for a sample audit, or to hear when the first ones are up, we keep your work email, which sample you asked for, when you asked, where on the site you were, the campaign tag if the link had one, and the moment you ticked the box. We use it to send the sample and, as the box says, at most one follow-up email.

We use it to arrange the call, prepare for it, and follow up on it. That is the whole purpose, and it is the basis on which you gave it to us. We do not add you to a sequence or a marketing list, we do not sell or share it, and we do not use it to train anything.

Booking details are kept for twelve months from the call, so that we can pick up a conversation that resumes months later. Sample requests are kept for twelve months. Order and intake records are kept for the engagement and then for as long as the law requires us to keep accounts. Ask us to delete them sooner and we will, and we will confirm when it is done rather than just saying we will get to it. If you delete your devsforfun ID account, it tells us, and we delete your account here, your intake answers and your sample and booking requests, and remove your name, contact details and address from your orders, keeping only what the accounts need.

This site runs no analytics and loads no third-party tracking scripts. It sets no cookies unless you sign in to buy the audit: then it keeps your devsforfun ID session in cookies your browser can’t read with scripts, renewed while you use the site and kept for up to thirty days, plus one that holds only the time the session next needs renewing, one that makes sure only this site can sign you out, and two that last the ten minutes signing in takes. They are needed for the purchase and nothing else, and signing out deletes them. The payment window is Razorpay’s, and loads only when you press Pay.

Prices are shown for the region of the country you’re visiting from, which our host tells us from your connection. We use it to pick the prices on the page and, when you buy, record the region with the order. Nothing about it is stored in your browser.

Booking submissions are rate-limited by IP address and by email address — 5 and 3 attempts per hour respectively. Sample requests are limited the same way, to 10 and 5. That counter holds a hashed key and an attempt count for an hour, then expires.

The site is hosted on Vercel. Scheduling runs on clndr.pro, which is our own product. Orders, with the business details given at checkout, intake forms, booking requests and sample requests are stored in a Neon database, and the emails about them, to us and to a buyer about their audit, are sent through Amazon SES. Payments for an audit bought online run on devsforfun ID, our own platform, which uses Razorpay. Those are the only third parties that touch a booking, an order or a request, and none of them receives it for any purpose of their own.

This is the part that matters more than the form. On an engagement, our tools run inside your environment: on your machines, or in a cloud account in your name. Your data does not leave it, and the audit log is a table in your own database. After handover we cannot write to it and cannot read it.

Our demos run on synthetic data only. No real personal data is ever loaded into a demo, which is why we can show you one without a data-sharing agreement first.

Under India’s DPDP Act 2023 you can ask for access to what we hold about you, ask for it to be corrected, and ask for it to be erased. If GDPR applies to you, the equivalent rights apply and you may also complain to your supervisory authority. Write to privacy@stafflo.ai and we will respond within thirty days, usually far sooner.