Privacy Policy

1. Scope

Mahati Step Private Limited ("Mahati Step", "we", "us" or "our") is a software development company. This Privacy Policy applies to personal information we process when you:

• visit mahatistep.com or interact with our content;
• contact us by email, form or phone, or request a proposal;
• engage us to design, build or maintain a digital product; or
• use an application we host or operate on behalf of a client, where we act as a processor for that client.

Where we build or host an application for a client, that client is the controller of the data in the application and their own privacy notice governs how that data is used. We process it only on their instructions and under a written agreement.

2. Information we collect

Information you provide

• Contact and enquiry details — name, email address, phone number, company name, and the content of your message or project brief.
• Client and project information — billing details, points of contact, project requirements, credentials and access you share with us to deliver a project, and correspondence.

Information collected automatically

• Usage and device data — IP address, browser type, device type, pages viewed, referring pages, and timestamps, collected through server logs and analytics.
• Cookies and similar technologies — see Cookies & analytics below.

We do not intentionally collect special categories of personal data through this website. Please do not send us sensitive information unless we have specifically asked for it as part of a project.

3. How we use information

• respond to enquiries, prepare proposals and communicate with you;
• provide, deliver and support our services and hosted applications;
• manage contracts, invoicing and payments;
• operate, secure, debug and improve our website and services;
• send service updates and, where permitted, occasional information about our work — you can opt out at any time;
• comply with legal, tax and regulatory obligations and enforce our agreements.

4. Legal bases

Where data protection law requires a legal basis, we rely on: performance of a contract with you; our legitimate interests in running and promoting our business (balanced against your rights); your consent (for example, for non-essential cookies or marketing email); and compliance with a legal obligation.

5. Cookies & analytics

Our website uses a small number of cookies and similar technologies. Strictly necessary cookies keep the site working and remember lightweight preferences. If we use analytics or third-party embeds, they may set cookies that help us understand how the site is used.

You can control cookies through your browser settings; blocking some cookies may affect how the site works. Where required, we will ask for your consent before setting non-essential cookies.

6. How we share information

We do not sell your personal information. We share it only with:

• Service providers who work on our behalf — for example cloud hosting, email, analytics, payment processing and error monitoring — under contracts that require them to protect it;
• Clients, where you contacted us about a project on their behalf or where we operate an application for them;
• Professional advisers such as accountants and lawyers, where necessary;
• Authorities, where required by law or to protect our rights, users or the public;
• A successor entity in connection with a merger, acquisition or reorganisation, subject to this policy.

7. Data retention

We keep personal information only as long as needed for the purposes above: enquiry data for a reasonable period to follow up and for our records; client and project data for the duration of the engagement and afterwards as required for legal, tax, warranty and audit purposes; and website logs for a limited period. When no longer needed, information is deleted or anonymised.

8. Security

We use technical and organisational measures appropriate to the risk, including access controls, encryption in transit, least-privilege practices, secured infrastructure and staff confidentiality obligations. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. International transfers

We and our service providers may process information in countries other than yours. Where we transfer personal data across borders, we take steps to ensure a comparable level of protection, including using recognised safeguards such as standard contractual clauses where applicable.

10. Your rights

Subject to applicable law, you may have the right to access, correct, update or delete your personal information, to object to or restrict certain processing, to withdraw consent, to data portability, and to nominate another person to exercise your rights in the event of death or incapacity. To make a request, contact us using the details below. We may need to verify your identity, and we will respond within the time required by law.

If you have a concern, you may also contact the relevant data protection authority, including the Data Protection Board of India under the Digital Personal Data Protection Act, 2023.

11. Children's privacy

Our website and services are intended for businesses and adults. We do not knowingly collect personal information from children. Where we build an application that is used by children on behalf of a client (such as a school portal), the client is responsible for obtaining any required consents, and we process that data only under their instructions.

12. Third-party links

Our website may link to third-party sites and services that we do not control. This policy does not apply to them; please review their own privacy notices.

13. Changes to this policy

We may update this policy from time to time. The "Last updated" date shows when it last changed. Significant changes will be highlighted on this page or communicated directly where appropriate.

14. Contact us

For privacy requests, please use the subject line "Privacy Request" so we can route it quickly.

Read our Terms & Conditions →