Privacy Policy

This website, kordalsystems.com, and the Kordal Labs tools we link to from it: the free browser tools we publish on their own domains. Other products we operate, such as Rateslip, are separate services with privacy notices of their own, which govern their use. Client projects are covered by the written agreement for that project, which takes precedence where the two differ.

Contact form. Your name, email address, your message, and — if you provide them — your company name and a budget range. We use this to reply to you and, if you become a client, to set up the project. When you send the form, one receipt is emailed to the address you gave, through Resend, to say your message reached us; nothing else is sent to that address but our reply. Legal basis: our legitimate interest in responding to enquiries, and, where you go on to engage us, performance of a contract.

Anti-spam check. When you start filling in a form on this site, a verification service processes technical signals from your browser, including your IP address and browser characteristics, to confirm the submission is not automated. It may set a strictly necessary token in your browser for that purpose only. Legal basis: our legitimate interest in preventing abuse. This token is essential to the service and does not require consent.

Booking a call. If you book through our scheduling link, your name, email address, chosen time and anything you type into the booking form are processed by our scheduling provider under its own privacy policy, which is linked on the booking page. Legal basis: performance of the pre-contractual steps you have asked for.

Server logs. Our hosting provider records standard technical data when you load a page, including IP address, browser type, and the time of the request. This is used for security, abuse prevention and diagnosing faults, and is retained by the provider for a short period. Legal basis: legitimate interest in operating the site securely.

Analytics. We count page views in aggregate. No cookies are set for this purpose, no identifier follows you between sites, and individual visitors are not identified. This is why the site has no cookie banner.

Kordal Labs tools. The Labs tools do their work in your browser. Files you open in them are never transmitted to us or to anyone else: we do not receive them, cannot see them, and cannot recover them. A tool may keep what you entered in your own browser’s storage so you can return to it; that data does not leave your device. Beyond that, the only data the tool pages generate is the aggregate page count described above.

Kordal Insights, by email. If you subscribe to our notes on the Insights pages, we collect your email address, which joins the list only when you tick the box asking for the emails, and we send you one welcome email when you subscribe and an email when a note is published. Nothing else is sent to that list, and using the contact form never adds you to it. Legal basis: your consent, which you can withdraw at any time by using the unsubscribe link in any of the emails or by writing to privacy@kordalsystems.com.

We do not sell personal data. We do not share it with advertisers or data brokers. We do not add you to a mailing list you did not ask to join, and we do not send follow-up sequences. We do not use your data to train any model. We do not make automated decisions about you.

• Hosting, edge network and anti-spam verification: Cloudflare, Inc.
• Transactional email, and the Kordal Insights list and its emails: Resend, Inc.
• Scheduling: the provider named on the booking page.
• Mailbox: our email provider, for the addresses on this site.

Each processes personal data only to deliver its service to us, under a written agreement.

Our providers operate in the United States and elsewhere, so your data may be processed outside your country, including outside the EU, the UK and India. Where data leaves the EU or UK, transfers rely on the provider's certification under the EU–US Data Privacy Framework, on standard contractual clauses, or on another safeguard recognised under the GDPR or UK GDPR.

• Enquiries and related correspondence: two years from your last message, then deleted, unless you become a client, in which case retention follows the project agreement.
• Booking data: per the scheduling provider's retention, and removed from our calendar within two years.
• Kordal Insights subscriptions: your email address stays on the list until you unsubscribe or ask us to remove it. When you unsubscribe, the email provider marks the address as unsubscribed so that we do not email it again.
• Server logs: retained by the hosting provider for a short rolling period, then deleted.
• Analytics: aggregate counts only; there is no personal data to retain.

Data in transit is encrypted. Access to our mailboxes and the systems above is limited to authorised personnel and protected by multi-factor authentication. If we become aware of a breach affecting your personal data, we will notify you and any relevant authority where the law requires it.

To report a security issue, please see the Terms page.

You can ask us to:

• tell you what personal data we hold about you and give you a copy;
• correct it;
• delete it;
• restrict or object to how we process it;
• provide it in a portable format;
• withdraw any consent you have given, without affecting processing that has already taken place.

Email privacy@kordalsystems.com. We will act within 30 days and will not charge for a reasonable request.

If you are in the EU or UK, you also have the right to complain to your national supervisory authority — in the UK, the Information Commissioner's Office.

If you are in India, this page serves as the notice required under the Digital Personal Data Protection Act 2023. Our grievance contact is privacy@kordalsystems.com. If you are not satisfied with our response, you may approach the Data Protection Board of India.

If you are in California, we do not sell or share personal information as those terms are defined in the CCPA/CPRA, and we do not meet the thresholds that bring a business within that law. We will nonetheless honour access, deletion and correction requests from any California resident on the same terms as above.

Depending on where you live, you may have further rights under local law. Those rights apply regardless of what this page says.

This site and our services are for businesses and are not directed at anyone under 18. We do not knowingly collect personal data from children. If you believe a child has sent us data, email privacy@kordalsystems.com and we will delete it.

If this policy changes materially, the date at the top changes and we will note what changed. Previous versions are available on request.

3 October 2026: we added the Kordal Insights email list, with what we collect for it, consent as the legal basis, Resend as the processor, and how long the address is kept. 4 October 2026: we named the welcome email sent when you subscribe. 27 October 2026: we added the one receipt the contact form emails to the address you give. 7 November 2026: we replaced the operator’s street address with our correspondence address, under that label, and published our GSTIN.