Legal
Privacy policy
What Northwind Cipher Pvt. Ltd. collects, why, how long it is kept, and who it is shared with. Last updated 11 August 2026.
The short version
We collect the minimum needed to answer your enquiry and to run the investor room. We do not sell data, we do not run advertising or advertising trackers, and nothing you type into the demo or the verifier on this site is transmitted anywhere — it is computed in your browser and stays there.
What runs in your browser and never leaves it
The live demo, the verifier, the pipeline page and the studio execute real cryptography locally. Keys are generated in the page, receipts are produced in the page, and verification is performed in the page. There is no server involved and no upload step. During a verification run the page replaces fetch, XMLHttpRequest, WebSocket, EventSource and sendBeacon with counting wrappers and prints the count — the zero you see is a measurement, not a claim.
What we collect, and why
| What | Why | Kept for |
|---|---|---|
| Name, email and message you submit to the contact form | To reply to you. Nothing else. | Until the conversation ends, then 24 months |
| Invitation code, and the email you redeem it with | To grant and audit access to the investor room, and to revoke a code that has been shared onward | Life of the raise, then deleted |
| Investor-room access log (which section, when) | So we can tell an investor who else has their link, and detect a code circulating beyond its holder | Life of the raise, then deleted |
| A session cookie, on the private routes only | To keep you signed in to the investor room or admin | Until it expires or you sign out |
| Aggregate page analytics, if enabled | To see which pages get read. IP addresses are anonymised and no advertising or cross-site profile is built | 14 months |
Cookies
The public site sets no cookies. The investor room and admin console set one signed, HttpOnly, same-site session cookie, which is strictly necessary to keep you signed in and carries no tracking identifier. If analytics is enabled it is configured without advertising features and with IP anonymisation.
Who else touches your data
- Vercel — hosting and edge delivery. Sees request metadata such as IP and user agent, as any host must.
- Supabase — the database behind the investor room. Holds invite codes, redemptions and the access log.
- Google Analytics — only if a measurement ID is configured for this deployment, and only in the anonymised configuration described above.
That is the complete list. We do not sell or rent personal data, and we do not share it with advertisers or data brokers.
Your rights
You can ask us what we hold about you, ask for it to be corrected, or ask for it to be deleted, and we will do it. Email info.quantumbay@gmail.com and we will respond within one working day. You do not need to give a reason, and deleting your data will not affect anything else you can access here.
Security
The private routes are behind authentication and row-level security in the database, the site sends a strict Content-Security-Policy and HSTS, and the session cookie is signed and HttpOnly. See the security model for the threat model and, more usefully, for what we explicitly cannot protect against.
What this document is not
This is an accurate engineering description of what the software does, written by the people who wrote the software. It has not been reviewed by a lawyer. If you need a formal DPDP or GDPR instrument — a named grievance officer, a per-purpose lawful basis, a processor agreement — ask and we will produce one rather than pretend this page already is one. Saying so is more useful to you than a confident page that quietly is not.
Contact
Northwind Cipher Pvt. Ltd.. Written enquiries and data requests to info.quantumbay@gmail.com, or through the contact form.