Back to Home
Global Privacy & Data Protection

Privacy Policy

This Policy explains how HikariWorks processes and protects personal information across India, the European Union (EU/EEA), the United Kingdom (UK), the United States (US), and globally.

Last Updated: October 24, 2026

India

DPDP Act, 2023 & IT Act

EU & UK

GDPR & ePrivacy

United States

CCPA / CPRA & State Laws

Global

GPC & Secure Cloud

1. Who We Are & Scope of this Policy

HikariWorks (“we”, “us”, or “our”) is a specialized software engineering and AI automation studio operating out of India, accessible globally via hikariworks.in.

Depending on your location:

  • Under Indian Law (DPDP Act, 2023): HikariWorks acts as the Data Fiduciary determining the purpose and means of personal data processing.
  • Under EU/UK Law (GDPR): HikariWorks acts as the Data Controller for personal data collected through this website and initial client communications.
  • Under US Law (CCPA/CPRA & State Laws): HikariWorks is a Business responsible for the collection and handling of consumer information.

2. Categories of Information We Collect

We practice strict data minimization. We only collect data necessary to communicate with you and operate our business:

A. Information Provided Voluntarily

When you submit our contact form, send an email, or initiate a project: your full name, business or personal email address, company name, project brief, budget range, and any communication history.

B. Telemetry & Device Information (Only With Prior Consent)

With your affirmative consent: anonymized IP address, approximate geographical region (country/city level), browser type, operating system, pages viewed, and referral URLs collected via Google Analytics (GA4) and Vercel Analytics.

C. Information We Never Collect

We do not collect sensitive personal data, biometric identifiers, health information, political opinions, religious beliefs, or credit card numbers through this website.

3. Legal Grounds for Processing (GDPR & DPDP)

We process your personal information only when backed by lawful grounds:

  • Prior Affirmative Consent (GDPR Art. 6(1)(a) & DPDP Sec. 6): For non-essential analytics cookies and telemetry. You can withdraw this consent at any time.
  • Contractual Necessity (GDPR Art. 6(1)(b)): To prepare software proposals, respond to project requests, establish contracts, and deliver commissioned engineering work.
  • Legitimate Interests (GDPR Art. 6(1)(f)): To maintain website security, prevent spam attacks, protect intellectual property, and detect fraud.
  • Legal Compliance (GDPR Art. 6(1)(c) & Indian Law): To fulfill statutory accounting, taxation, and law enforcement requirements where mandated by law.

4. AI Confidentiality & No Model Training Guarantee

HikariWorks specializes in artificial intelligence workflows and custom software development. We provide an explicit guarantee to all clients and visitors:

  • No Public Model Training: Your confidential project briefs, proprietary source code, internal documents, and client data are never submitted to train public foundational AI models (such as public models operated by OpenAI, Anthropic, or Google).
  • Enterprise Data Isolation: All third-party AI APIs deployed for our clients use enterprise privacy agreements with zero-data-retention for training.

5. United States Residents (CCPA / CPRA & State Privacy Rights)

This section supplements our policy for residents of California (under the California Consumer Privacy Act as amended by the California Privacy Rights Act “CPRA”), Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Texas (TDPSA), and other applicable US states.

No Sale or Sharing of Personal Information: HikariWorks does not sell personal information, nor do we share personal information for cross-context behavioral advertising (monetary or other consideration). We have not sold or shared consumer data in the preceding 12 months.

Notice at Collection: We collect contact identifiers (name, email) and optional internet usage data solely for business operations and client communications as described in Section 2.

Non-Discrimination: We will never discriminate against you, alter service prices, or reduce service quality because you exercised any of your privacy rights.

California “Shine the Light” Law: Under Cal. Civ. Code § 1798.83, California residents may request confirmation that we do not disclose personal information to third parties for their direct marketing purposes.

6. Global Privacy Control (GPC) & Do Not Track

We affirmatively respect and support the Global Privacy Control (GPC) browser signal.

If your web browser or browser extension transmits the `Sec-GPC` or `navigator.globalPrivacyControl` signal, our website automatically interprets this as an explicit opt-out request for non-essential cookies and analytics, without requiring manual interaction with our consent card.

7. International Data Transfers (EU/EEA & UK Transfers)

HikariWorks is based in India and utilizes global cloud hosting infrastructure (such as Vercel and AWS nodes in the United States and global edge locations).

If you access our site or commission services from the European Economic Area (EEA) or the UK, your information may be transferred outside the EEA/UK to India and the United States. Where such cross-border transfers occur, we safeguard your data through:

  • Implementation of the European Commission's Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum.
  • Strict technical measures including end-to-end TLS 1.3 cryptographic protocols in transit and AES-256 encryption at rest.
  • Limiting access exclusively to authorized personnel under legally binding non-disclosure agreements.

8. Children's Privacy (COPPA & DPDP Section 9)

Our website and technology services are exclusively directed to businesses, founders, and adult professionals aged 18 and older.

We do not knowingly solicit or collect personal information from children under the age of 13 (under the US Children's Online Privacy Protection Act - COPPA) or minors under the age of 18 (under Section 9 of the Indian DPDP Act). If we become aware that a minor has provided us with personal data, we will immediately delete that information from our records.

9. Your Global Data Rights

Regardless of your citizenship or geographic location, you enjoy robust data privacy rights over your information:

Right to Know & Access

Request confirmation and a portable copy of personal information we process about you.

Right to Rectification & Correction

Request that incorrect, incomplete, or outdated personal details be amended promptly.

Right to Erasure (“To Be Forgotten”)

Request complete deletion of your personal data from our active databases.

Right to Withdraw Consent & Object

Withdraw previously granted tracking consent at any time without adverse consequences.

To exercise any of these rights, contact our privacy team directly at contact@hikariworks.in. We respond to verified requests within statutory deadlines (30 days under GDPR/DPDP, 45 days under CCPA).

10. Grievance Redressal & Regulatory Contacts

If you have any questions, concerns, or unresolved privacy grievances, please reach out to our designated officer:

Designation: Data Protection & Grievance Redressal Officer

Entity: HikariWorks

Location: India

Email: contact@hikariworks.in

Supervisory Authorities:

  • India: You have the right to lodge a complaint with the Data Protection Board of India (DPBI).
  • European Union / UK: You have the legal right to lodge a complaint with your local EU Data Protection Authority (DPA) or the UK Information Commissioner's Office (ICO).
  • United States: You may contact the Office of your State Attorney General.

11. Policy Modifications

We reserve the right to revise this Privacy Policy periodically to reflect technological advancements, infrastructure modifications, or evolving international regulatory requirements. Any updates will be posted here with an updated revision date.