No cookies. No trackers. Nothing to consent to.

One thing: your theme preference(system, light, or dark), kept in your browser’s first-party localStorageso the site remembers your choice between visits. It never leaves your device and is never transmitted to us or anyone else. Clearing your browser’s site data removes it and the site reverts to following your operating system’s preference. This is a functional preference, not tracking — which is why no consent prompt is required.

The following are absent by design, and verifiable in the page source:

• No cookies on the marketing pages (the self-hosted scheduler on /book sets its own functional cookies while you pick a slot — see §04).
• No analytics or measurement scripts (no Google Analytics, no Plausible, no Fathom, none).
• No tracking pixels, beacons, or session-replay tools.
• No browser fingerprinting or device identification.
• No advertising networks, retargeting, or data brokers.
• No third-party fonts or CDNs — typefaces are self-hosted from our own origin.
• No embedded social widgets, comment systems, or chat bubbles.
• No A/B testing, heatmaps, or behavioural profiling.

The only data processing that happens at all is outbound email: when you submit the contact form or book a briefing, your message is sent through smtp2go (our transactional email provider) to our own inbox, and bookings run on our self-hosted scheduler. smtp2go is the single disclosed subprocessor — there are no analytics, advertising, or profiling subprocessors of any kind.

The site runs on infrastructure we operate (a container behind our own reverse proxy). Like any web server, it keeps minimal operational access logs — timestamp, requested path, response status, user agent, and a connecting IP address — for security, abuse prevention, and reliability. These logs stay on our own systems, are retained briefly, are never sold, shared, or combined into a profile, and are not used to track you across sessions or sites. We log to keep the service safe and honest, not to surveil its visitors.

The simplest way to reach us is to email [email protected]. If you do, we receive your message and your email address and use them solely to reply. We will not add you to a mailing list or pass your details to anyone. Standard email infrastructure applies in transit, as it does for any email.

The Book a briefing page is part of this site — not an embedded third-party widget and not an inline frame. When you choose a time and enter your name and email, your browser sends them in a same-origin request to our own server (/api/book), which relays the booking to our self-hosted scheduler (Cal.com on cal.stribog.com) and our self-hosted video service (Jitsi on meet.stribog.com) — both running on our own infrastructure. No third-party booking service is involved, no booking frame loads in your browser, and the scheduler sets no cookies on this site. We use your name and email only to schedule and run the briefing (a calendar invite and a video link); the meeting itself takes place in a room on our own servers. Standard email and calendar infrastructure applies in transit, as it does for any invite.

We honour Do Not Track and Global Privacy Control signals by construction: there is nothing to opt out of, because there is nothing being collected for advertising or profiling in the first place.

Consent banners exist to obtain permission for cookies and tracking. This site uses neither, so a banner would be theatre — a privacy ritual performed over a site that already collects nothing. For a practice built on sovereignty and auditability, the honest move is to state the facts plainly and let you verify them. This page is that disclosure.

The data controller for personal data collected via this site is Stribog (the operating name; the registered legal entity is India-domiciled and is named in full on request via the grievance contact below). Stribog is subject to the Digital Personal Data Protection Act 2023 (DPDPA) as a data fiduciary. Visitors from the European Union or European Economic Area are additionally protected by the General Data Protection Regulation (GDPR).

We collect personal data in two contexts:

• Contact form — name, email address, and message. Purpose: to receive and respond to your enquiry. Legal basis: your consent (DPDPA), expressed by voluntarily submitting the form; and legitimate interests (GDPR Art. 6(1)(f)) — our interest in receiving and responding to business enquiries.
• Booking form — name, email address, and optionally notes and your timezone. Purpose: to schedule an Executive Briefing, create a calendar record, and send you a video-room link. Legal basis: your consent (DPDPA); and legitimate interests or pre-contractual steps at your request (GDPR Art. 6(1)(b)/(f)).

Server logs additionally capture your connecting IP address, the requested path, HTTP status code, and user-agent string. Purpose: security monitoring, abuse prevention, and service reliability. Legal basis: legitimate interests under both DPDPA and GDPR. These logs are never used to track you across sessions or build a profile.

We collect nothing beyond what is necessary for these purposes — no phone number, postal address, payment data, or any other field. The only other thing stored on your device is your theme preference (§01 above), which never reaches our servers.

Every data category has a declared and bounded retention period:

• Contact form emails in our inbox — retained for 24 months from receipt, then deleted.
• Booking records in our self-hosted scheduler — retained for 24 months from the booking date, then deleted.
• Server access logs (IP address, user-agent, path) — retained for 30 days on a rolling basis, then automatically deleted.
• Container application logs — size-bounded (30 MB / 3 files); oldest entries are evicted automatically as new ones are written.

Sub-processor residual:smtp2go (our email relay) retains sent-mail delivery records under its own data retention policy. We cannot unilaterally delete smtp2go’s internal delivery logs. If you need smtp2go’s records deleted, you can contact smtp2go directly at their privacy contact. We will always delete our own copy on request.

You have the following rights over the personal data we hold about you:

• Access — you may request a summary of what personal data we hold about you and how we process it.
• Erasure — you may request deletion of your personal data. We will delete it from our inbox, our scheduler, and server logs (where still within the 30-day window) within one calendar month of your request.
• Correction — you may request correction of inaccurate data in our scheduler records.
• Portability (GDPR, where applicable) — you may request your data in a structured, machine-readable format.
• Objection (GDPR Art. 21) — you may object to processing based on legitimate interests.
• Grievance redressal (DPDPA) — you may raise a grievance with us and escalate to the Data Protection Board of India if it is not resolved.

How to exercise your rights: Email [email protected]. State which right you are exercising and the email address associated with your submission. We will respond within one calendar month (GDPR Art. 12.3 standard; we apply the same window for DPDPA requests unless the applicable Rules prescribe a shorter period, in which case that period applies).

You also have the right to lodge a complaint with the relevant supervisory authority: the Data Protection Board of India (DPDPA), or the data protection authority in your EU/EEA member state if you are located in the European Union.

This statement describes the site exactly as it is built. Any change to what the site collects would change this page, and the history is tracked in the project changelog. You can confirm everything here from the page source and network panel of your own browser — see the colophon for how the site is built, and the accessibility statement for our conformance posture.

Privacy contact / grievance officer: [email protected]. For general questions you may also use [email protected].

Last reviewed: June 2026.