Bluecoderhub — Privacy

Privacy Policy

Bluecoderhub Private Limited ("Bluecoderhub", "we", CIN U85109TN2026PTC189056), a DPIIT-recognised startup with its registered office at A46, G1, Ragam Complex, Hindu Colony 6th Cross Street, Nanganallur, Saidapet, Kanchipuram, Tamil Nadu 600061, India, operates bluecoderhub.com. We decide why and how personal data on this site is processed, which makes us its Data Fiduciary under India’s Digital Personal Data Protection Act, 2023 (the "DPDP Act"). This notice sets out, item by item, what we collect, why, who helps us process it, how long we keep it, how we protect it, and how you can use your rights.

01Our commitments

We collect only what a form or feature needs in order to work, and nothing in the background.
We never sell personal data, never share it for advertising, and never use it to train AI models.
This site loads no third-party analytics, advertising, fonts, scripts or embeds. Reading it sets no cookie. The only thing it keeps in your browser is the light or dark theme you pick, if you pick one.
Personal data is deleted or anonymised automatically when its retention period ends.
You can see, correct, export or delete your data, and withdraw consent, at any time and free of charge. We answer within 30 days.
If a breach ever affects your data, we will tell you without delay.

02Which products this covers

This notice covers bluecoderhub.com: its pages, forms, newsletter, and the early-access list for the AI-CAD Engineering Platform, the Mechanical Engineering LLM and the AI-CAD Datasets.

03What we collect and why

Each item below is collected only when you use the feature it belongs to. Nothing is collected from you on this site in any other way.

Newsletter and early-access list

What: Your email address, the form you signed up from, when you consented, the exact wording you agreed to, and a private token that powers your personal manage link.
Why: To send the research notes, product updates or early-access invitations you asked for, and to be able to show that we had your consent.
Basis: Your consent. You can withdraw it at any time from any email we send or from your manage link.
Kept: Until you unsubscribe. Unsubscribing deletes the record immediately.

Contact form

What: Your name, email address, the topic you chose and your message. For early-access requests, also your company and role if you choose to give them. If the link that brought you here carried campaign tags (utm_source and similar), or you came from another website, the message also carries those tags and that website’s name.
Why: To read and answer your message, including security reports and requests about your data. Writing to us does not subscribe you to anything.
Basis: You give it to us voluntarily so that we can reply, a legitimate use under section 7(a) of the DPDP Act.
Kept: Deleted automatically 24 months after you send it, or sooner if you ask.

Job applications

What: Your name, email address, phone number (optional), portfolio link (optional), your CV as a PDF (optional), the role you applied for, your cover letter, and the status of your application. If the link that brought you here carried campaign tags (utm_source and similar), or you came from another website, the application also carries those tags and that website’s name.
Why: To assess your application and contact you about it.
Basis: Your consent, given when you apply. You can withdraw your application at any time.
Kept: Personal fields are anonymised automatically 24 months after you apply. The role and outcome remain in our hiring statistics, with nothing that identifies you.

Team accounts (Bluecoderhub staff only)

What: Email address, a bcrypt hash of the password, an encrypted two-factor secret, hashed recovery codes, and an audit trail of admin actions that records the IP address and browser used.
Why: To keep the admin area secure, and to keep an accountable record of who opened or changed personal data.
Basis: Necessary to keep this site and the personal data in it secure.
Kept: Account data for as long as the account exists. Audit-trail entries for 24 months.

Technical data from every visit

What: IP address, browser user agent, the address requested (with private tokens removed), the response status and how long it took.
Why: To deliver the site, defend it against abuse such as spam and password guessing, find and fix faults, and investigate security incidents.
Basis: Necessary to provide the site securely, and required by Indian law, which obliges us to keep logs (CERT-In Directions, 2022; DPDP Rules, 2025).
Kept: Logs of requests to our API: one year, the minimum Indian law requires, then deleted automatically. Page-delivery logs at our hosting provider: no more than 30 days. Rate-limit counters keyed by IP address: they stop counting when their window of 1 to 15 minutes ends, and are removed from storage within a day.

04Automated tools and AI

No decision about you is made by automated means. Every job application and every message is read by a person.
Reviewers may use a helper that pulls the opening sentences of a cover letter into a short summary. It runs on our own server and never decides anything.
Our journal is drafted with AI model services (Anthropic and Google). They receive article topics only, never personal data from this site. The same is true of LinkedIn, where we share articles.
No AI-drafted article is published automatically. A member of our team reads each one and decides whether to publish it, and the article is labelled as written with an AI assistant.

05What we do not collect

Please do not send us sensitive information, such as government ID numbers, bank or card details, health information, or personal details about other people. No form on this site asks for it.
We do not build profiles, track you across other sites, or combine your data with data from other sources.
We do not use cookies, pixels or browser storage to identify or follow visitors. The only cookies are the sign-in cookies for our own team, described in the Cookie Policy.

06Who processes it for us

Vercel Inc. hosts this site and its API, and keeps the request logs described above.
Neon hosts the database that stores newsletter, contact, application and team-account records.
Upstash holds the short-lived rate-limit counters.
Our email providers (Resend, or the business mailbox we send from) deliver the emails we send you, and copies of form submissions to our team inbox.
Each of them processes personal data only on our instructions and only to provide their service to us, under terms that require them to keep it secure. None of them may use it for their own purposes.
We disclose personal data to a government authority only when Indian law requires it, and we tell you when we lawfully can.
If Bluecoderhub is ever merged or acquired, your data stays protected by this notice, and we will tell you before it is used in any different way.

07Where it is processed

Our service providers may process personal data outside India, for example in the United States.
We transfer personal data only to countries the Government of India has not restricted under section 16 of the DPDP Act, and only to providers bound to protect it to the standard this notice describes.

08How we protect it

Every connection to this site is encrypted with TLS, and browsers are told to refuse unencrypted connections (HSTS).
Records are stored in a managed database that encrypts data at rest.
Passwords are hashed with bcrypt. Two-factor secrets are encrypted with AES-256-GCM. Recovery codes are stored only as hashes.
Only authorised team members can open personal data, after signing in with a password and a second factor, and every access is written to the audit trail.
Every form is validated strictly and rate-limited. Security headers stop the site being framed, block injected scripts, and stop the browser guessing content types.
Dependencies are checked for known vulnerabilities on every change we make.
Our database provider keeps a restorable history of the database, so it can be recovered to an earlier point after a failure or an attack.
We keep a log of every request to our API for a year, so unauthorised access can be detected and investigated.

09If something goes wrong

If a personal data breach affects you, we will tell you without delay: what happened, which data was involved, the likely consequences, what we are doing about it, and what you can do to protect yourself.
We will also report the breach to the Data Protection Board of India, as the DPDP Act and its rules require.

10Your rights

Access: a summary of the personal data we hold about you, what we do with it, and who we have shared it with.
Correction and completion: have anything inaccurate, incomplete or out of date put right.
Erasure: have your data deleted once it is no longer needed for the purpose you gave it, or when you withdraw consent, unless the law requires us to keep it, as it does for request logs.
Withdraw consent: as easily as you gave it. Withdrawing does not undo processing we had already done lawfully.
Nominate: name someone to exercise these rights for you if you die or become unable to, under section 14 of the DPDP Act.
Grievance redressal: complain to us first. If you are not satisfied with our answer, you can complain to the Data Protection Board of India.
If you live in the EU, the UK or another place with its own data protection law, you also have the rights it gives you. The section “If you are in the EU or the UK” below sets out what that means here.

11How to use your rights

Newsletter: unsubscribe, and see exactly what we hold about you, using the personal manage link in the confirmation email we send when you sign up. No account is needed, and you do not have to wait for us. Every update we send also carries an unsubscribe link, and mail apps that support one-click unsubscribe can use it directly.
Everything else: write to us through the contact form and choose “My data” as the topic, or use the “Request deletion of my data” button at the end of this page, which opens the form with that topic already selected.
We will check that the request comes from you before acting on it, so that no one else can obtain or delete your data. We then respond within 30 days, free of charge.
Job applications: withdraw yours at any time. We anonymise rather than delete, so the role and outcome stay in our hiring statistics but nothing identifies you.
We record when you consented and the exact wording you agreed to, so you can check it and so we can show that we had permission.

12This notice in your language

You can ask for this notice in English or in any of the 22 languages listed in the Eighth Schedule to the Constitution of India.
Use the contact form, choose “My data” as the topic, and tell us the language you want. We will send you the notice in that language within 30 days.

13If you are in the EU or the UK

Where the EU or UK General Data Protection Regulation (GDPR) applies to your data, these are our legal bases: your consent for the newsletter and early-access list (Article 6(1)(a)); steps you ask us to take before a possible contract for job applications (Article 6(1)(b)); and our legitimate interests in answering your messages, keeping the site and team accounts secure, and meeting the legal duties that apply to us in India (Article 6(1)(f)).
Our hosting, database, rate-limiting and email providers may process your data in the United States. For those transfers we rely on the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission’s Standard Contractual Clauses in the provider’s data processing terms.
You are not required by law or by any contract to give us your data. Without it we cannot reply to you, consider your application or send you updates.
You have the rights the GDPR gives you, including access, rectification, erasure, restriction, objection and data portability, and you can complain to your local supervisory authority. Contact us as described under “How to use your rights” to use them.

14Children

This site is not directed at children. You must be 18 or over to subscribe, to write to us, or to apply for a role, and we do not knowingly collect personal data from anyone younger.
If you believe a child has given us personal data, tell us through the contact form and we will delete it.

15How long we keep it

Newsletter subscribers: until you unsubscribe, which deletes the record immediately.
Contact messages: deleted 24 months after you send them, by an automated job.
Applications: personal fields anonymised 24 months after submission, by the same job.
Copies of form submissions in our team inbox: deleted on the same schedule as the records they copy.
Admin audit trail: 24 months.
Logs of requests to our API: one year, as Indian law requires, then deleted automatically.
Page-delivery logs at our hosting provider: no more than 30 days.
Rate-limit counters: a window of 1 to 15 minutes, then removed within a day.
Admin sign-in cookies: 2 hours per session, and revoked on the server when you log out.

16Changes to this notice

When we change this notice, we update the date at the end of this page. We announce material changes here before they take effect.
If a change would use data you have already given us in a new way, we will ask for your consent first wherever the law requires it.

17Grievance Officer and contact

Questions, requests and complaints about personal data are handled by our Grievance Officer.
Online: use the contact form and choose “My data” as the topic.
By post: Grievance Officer, Bluecoderhub Private Limited, A46, G1, Ragam Complex, Hindu Colony 6th Cross Street, Nanganallur, Saidapet, Kanchipuram, Tamil Nadu 600061, India.
We respond within 30 days. If you are not satisfied with our response, you can take your complaint to the Data Protection Board of India.

This notice is written in plain English to describe how Bluecoderhub currently handles data on this site. It is not a substitute for the reviewed legal document that will replace it before commercial launch.

Last updated: 2026-10-30

Request deletion of my data Contact us