Privacy Policy

About this Privacy Policy

Last Hit Labs Private Limited, referred to as “Last Hit Labs”, “we”, “us”, or “our”, operates the website available at www.lasthitlabs.com. This Privacy Policy applies when you visit the website, submit an inquiry, ask us to contact you, communicate with us about a potential project, or exercise a privacy right.

For applicable Indian data protection law, Last Hit Labs is the Data Fiduciary responsible for personal data collected directly through this website. Client project data may also be governed by a proposal, statement of work, master services agreement, data processing agreement, or another written agreement.

Personal data we collect

Information you provide

When you submit the inquiry form, we collect:

• Your full name.
• Your email address.
• Your phone or WhatsApp number.
• Your business or company name, if provided.
• The service you are interested in.
• Your indicative project budget and preferred timeline, if provided.
• Information about your business, workflow, requirements, challenges, or desired outcome.

We do not ask for passwords, bank account information, payment card information, government identification numbers, biometric information, medical information, or files through the inquiry form. Do not include unnecessary sensitive personal data, credentials, trade secrets, or personal data concerning another individual in the message field.

Information generated during submission

Our systems also generate or record:

• A unique inquiry reference using a UUID.
• Standardised copies of your email address and phone number for matching and abuse prevention.
• The website contact form as the inquiry source.
• Creation, consent, activity, update, and retention timestamps.
• An internal inquiry status and schema version.
• The version of the legal notice you accepted.

The form contains a hidden anti spam field. A legitimate visitor is not expected to complete it. A submission that completes that field may be rejected and is not stored as a valid inquiry.

Technical and network information

Cloudflare, Vercel, and Convex may process technical information needed to deliver and secure the website, including Internet Protocol address, approximate location derived from that address, browser, device, operating system, requested resource, referrer, date and time, response status, performance, diagnostic, and security event information.

The inquiry record stored by Last Hit Labs does not include your Internet Protocol address. Infrastructure providers may nevertheless process request information under their own operational and security practices.

How we use personal data

We use personal data to:

• Receive, validate, store, and review your inquiry.
• Respond by email, phone, or WhatsApp.
• Arrange discovery and understand whether we can assist.
• Prepare a proposed scope, estimate, or recommended next step.
• Maintain an accurate inquiry and communication history.
• Prevent duplicate submissions, spam, abuse, and malicious input.
• Operate, secure, troubleshoot, and maintain the website.
• Comply with law and establish, exercise, or defend legal claims.

Submitting an inquiry does not join a marketing list. We will not use inquiry details for unrelated promotional messages unless we first obtain separate and specific consent.

Consent and lawful processing

By selecting the inquiry consent control and submitting the form, you request that Last Hit Labs use the supplied information to evaluate and respond to your inquiry. Depending on the circumstances and applicable law, processing may be based on your consent, your voluntary request, steps requested before a contract, performance of a later contract, compliance with law, website security, or legal claims.

You may withdraw consent by contacting us. Withdrawal does not affect processing that was lawful before withdrawal and may prevent us from continuing to evaluate or respond to the inquiry.

Validation and sanitisation

Inquiry submissions are protected by controls that currently include:

• Maximum field and request sizes.
• Server side allowlists for service, budget, and timeline selections.
• Email, phone, UUID, consent, and legal version validation.
• Unicode, control character, whitespace, and line ending normalisation.
• Duplicate and identifier conflict detection.
• Honeypot spam detection and rate limiting.

These controls support integrity and abuse prevention. They do not remove the need for appropriate encoding when information is later displayed or exported.

How we disclose personal data

We do not sell or rent personal data. We may disclose it only where reasonably necessary to:

• Authorised Last Hit Labs personnel evaluating or responding to the inquiry.
• Hosting, security, database, and communication providers acting for the service.
• Legal, accounting, security, insurance, or other professional advisers.
• Government agencies, courts, regulators, or law enforcement under valid legal process.
• A lawful buyer or successor during a proposed business transaction, subject to safeguards.

Our principal website infrastructure providers currently include:

• Cloudflare, for proxying, network delivery, Domain Name System services, transport security, and website security.
• Vercel, for website hosting, application delivery, deployment, and operational logging.
• Convex, for inquiry validation, backend functions, and database storage.

International processing

Our providers may process or store information in countries outside India. Where personal data is processed internationally, we use providers and arrangements intended to provide appropriate contractual, organisational, and technical safeguards, subject to applicable Indian restrictions concerning cross border transfers. We do not represent that all website data is stored exclusively in India.

Data retention

An inquiry that does not progress into a client engagement is retained for up to 24 monthsafter its most recent recorded activity. The retention deadline is refreshed when a material inquiry activity is recorded.

If an inquiry becomes an engagement, relevant information may be transferred to client, contractual, project, accounting, or legal records and retained under the applicable agreement or law. Limited information may be retained longer or placed on legal hold for legal obligations, dispute resolution, legal claims, fraud prevention, security, or a record of consent withdrawal. A verified deletion request remains blocked while a valid legal hold applies.

When retention is no longer necessary, information is deleted, anonymised, or securely isolated, subject to technically necessary provider backup cycles. Infrastructure logs and backups follow the retention schedules maintained by the relevant provider.

Information security

We use reasonable technical and organisational measures intended to protect personal data. Current measures include HTTPS transport protection, Cloudflare network controls, input validation, normalisation, request limits, rate limiting, spam detection, schema enforcement, indexed duplicate detection, restricted production access, and provider encryption at rest.

No internet transmission, database, or security control is completely secure. Avoid submitting information that is not necessary for the inquiry. If we become aware of a personal data breach, we will investigate and provide notifications where required by law.

Cookies and similar technologies

The website does not currently use advertising cookies, behavioural tracking pixels, or a third party analytics platform. Cloudflare may set strictly necessary security cookies when required to distinguish legitimate traffic, complete a security challenge, mitigate automated traffic, or protect the website. Last Hit Labs does not use those cookies for advertising.

If we introduce analytics, advertising, personalisation, or other nonessential cookies, we will update this Policy and implement any consent mechanism required by law before activation.

Your rights and choices

Subject to applicable law, you may ask us to:

• Confirm whether we hold personal data concerning you.
• Explain how that data is processed.
• Correct, complete, or update inaccurate information.
• Delete personal data that is no longer necessary.
• Withdraw consent for consent based processing.
• Restrict or object to processing where that right is available.
• Raise a grievance concerning our handling of personal data.
• Nominate another individual to exercise available rights after death or incapacity, where applicable.

We may request information reasonably necessary to verify your identity. A request may be limited where processing is required by law, needed for legal claims, necessary to protect another person, or otherwise permitted. You may complain to the Data Protection Board of India or another competent authority when the relevant mechanism is legally available.

Children

The website and inquiry form are intended for adults. Individuals under 18 must not submit personal data through the inquiry form. If we learn that a child submitted personal data without valid parental or guardian consent where required, we will take reasonable steps to delete it.

Automated decisions

We do not use inquiry information to make decisions solely through automated processing that produce legal or similarly significant effects. The website does not automatically approve projects, determine contractual eligibility, issue binding prices, or enter into agreements.

Third party links

The website may link to third party websites or services. We do not control their privacy, availability, security, or content. Review their notices before providing information.

Changes to this Policy

We may update this Policy when services, technologies, providers, processing activities, or legal obligations change. The updated version will appear on this page with a revised date. Where a change materially affects previously collected data, we will give additional notice or request fresh consent where required.

Privacy and grievance contact

For privacy requests, consent withdrawal, complaints, or questions, contact:

We will acknowledge and address grievances within the period required by applicable law.