Privacy policy

Effective date: 2026-10-07

This policy explains what personal data Subhdesk collects through subhdesk.in, why, who it is shared with, how long we keep it, and what you can ask us to do with it. Subhdesk is a brand of PRAVISA PHARMA, based in Navi Mumbai, India ("we", "us"). We are the Data Fiduciary for the data described here.

If you have a question about this policy or your data, email reachout@subhdesk.in.

What we collect

What you type into the contact form

• Your name
• Your business name (optional)
• Your phone number
• The offer you picked
• The details you write about what you need

We do not ask for your email address, payment details or any government ID on the website. Please don't put sensitive information (health, financial or ID details) in the form.

The intake message and the assistant's summary

When you press "Send my details", the form is passed to an automated intake assistant. It writes the short reply you see on screen and a summary for us: what you need, which offer looks like a fit, and anything we should note. We keep your message, the reply and that summary together with your details.

Technical data

• IP address, for spam and rate limiting. We use your IP address to stop the form being flooded. It is not stored as-is. We keep only a one-way hashed version for about 10 minutes, then it expires automatically.
• Cloudflare Turnstile signals. To check that the form is being sent by a person and not a bot, Cloudflare Turnstile runs a short check in your browser. Cloudflare processes signals such as your IP address, browser and device characteristics for this. We receive only a pass/fail result.
• Cloudflare Web Analytics. We use Cloudflare Web Analytics to count visits and see which pages are read. It does not use cookies, does not track you across sites, and gives us only aggregate figures (for example, page views per day). We cannot identify you from it.
• Server logs. Our hosting keeps short-lived technical logs (errors, timings) for a few days to keep the service working.

Why we use it

• To read and reply to your enquiry, and to call you back on the number you gave
• To understand what you need and prepare a quote
• To keep a record of enquiries so none get lost, and to follow up with you about your enquiry
• To prevent spam, abuse and misuse of the form

We do not use your details for advertising, we do not sell them, and we do not add you to a marketing mailing list.

Our legal basis

• Your consent. By filling in and sending the form, you agree to us using your details to respond to your enquiry as described here. You can withdraw that consent at any time (see "Your rights").
• Legitimate uses allowed by law. For example, keeping the form safe from spam and abuse, and keeping records we are required to keep by law.

Who sees and processes your data

Only the people and services needed to answer your enquiry:

• An authorised person of the company reads every enquiry and replies.
• xAI (Grok API). Our intake assistant runs on xAI's Grok API. Your form message is sent to and processed by xAI to produce the reply and summary.
• Google Workspace (Google Sheets and Gmail). Each enquiry is saved as a row in our private Google Sheet and emailed to our own inbox.
• Cloudflare. Hosts the website, runs Turnstile, and briefly stores data needed for rate limiting and for enquiries that could not be delivered on the first try (Cloudflare Workers KV). Cloudflare also provides Cloudflare Web Analytics: a small script from static.cloudflareinsights.com that reports to cloudflareinsights.com. It is cookieless, aggregate page-view measurement. It does no cross-site tracking and builds no personal profiles.

To be clear: the intake message (and the assistant's reply and summary) is stored and processed by xAI, by Google Workspace / Google Sheets, and by Cloudflare. Each of these providers handles data under its own terms and security practices. We use them only to run this service.

Data outside India. These providers may store or process data on servers outside India. Where that happens, it is done as permitted under the DPDP Act.

We may also disclose data if the law requires it, for example to comply with a lawful request from a government authority.

How long we keep it

• Unqualified enquiries (form details, intake message, the assistant's summary, and the email copy): 90 days after our last contact with you, then deleted. Exceptions: you become a client (see below), or you ask us to delete them sooner.
• If you become a client: only for as long as Indian tax and accounting law requires us to keep records such as invoices (and while we work together, as needed to deliver the work).
• Hashed IP entries for rate limiting: about 10 minutes.
• Enquiries waiting to be re-delivered after a technical failure (failed-delivery queue): deleted as soon as they are delivered, and automatically after at most 14 days.
• Hosting / Worker logs: a few days (typically up to 7).
• xAI (Grok API): By default, xAI stores API requests and responses encrypted at rest for 30 days for abuse auditing, does not use them for training without your explicit permission, then deletes them. Zero Data Retention (ZDR) is an optional team-wide setting that prevents that storage. (Checked 2026-10-07 from docs.x.ai FAQ — Security.)

Your rights

Under the DPDP Act you can ask us to:

• Access: tell you what personal data we hold about you and how we have used it
• Correct or update it
• Delete it (unless the law requires us to keep it)
• Withdraw consent. We will stop using your data for your enquiry and delete it, unless the law requires us to keep it. Withdrawing doesn't affect what we did before.
• Nominate someone to exercise these rights for you if you die or become unable to do so

To do any of these, email reachout@subhdesk.in from a phone number or details that let us find your enquiry (for example, the name and phone number you used). We may ask you to confirm it's you. We will reply within 30 days.

Grievances

If you're unhappy with how we've handled your data, contact our grievance contact:

Grievance contact, PRAVISA PHARMA (Subhdesk, a brand of PRAVISA PHARMA), Navi Mumbai, India. Email: reachout@subhdesk.in

We will acknowledge your complaint and try to resolve it within 30 days. If you are not satisfied with our response, you can complain to the Data Protection Board of India.

Cookies and tracking

• We do not set any cookies on subhdesk.in.
• We use no advertising trackers, no session recording or heatmaps, and no third-party analytics other than the cookieless Cloudflare Web Analytics described above.
• Cloudflare, as our hosting and security provider, may set strictly necessary security cookies in some situations (for example, if it needs to check for bot traffic). These are used only for security and are not used to track you for advertising.
• The Turnstile check runs inside a frame served from Cloudflare's own domain (challenges.cloudflare.com), not ours.

Children

Our services are meant for businesses and are not directed at anyone under 18. We don't knowingly collect personal data from children. If you believe a child has sent us their details, email us and we will delete them.

Security

We limit access to your data to the people and services listed above, use providers with strong security practices, protect the form against spam and automated abuse, and store only what we need. No system is perfectly secure. If a breach affects your personal data, we will tell you and the Data Protection Board as the law requires.

Changes to this policy

We may update this policy when our services or the law change. The effective date at the top will show when it last changed. If a change significantly affects how we use your data, we will say so clearly on this page.

Contact

PRAVISA PHARMA (Subhdesk, a brand of PRAVISA PHARMA), Navi Mumbai, India. Email: reachout@subhdesk.in