Privacy Policy
Effective Date: September 2026 • Last Updated: September 2026
Brownstone Consulting ("Brownstone", "we", "us", or "our") respects the privacy of individuals who interact with our Website, services, personnel, and business operations.
1. Scope
This Privacy Policy applies to personal information collected through Brownstone's website (brownstoneconsulting.in), online inquiry forms, direct email communications, advisory engagements, and recruitment interactions.
2. Information We May Collect
Depending on your interaction with Brownstone, we may collect:
- Contact & Identity Details: Full name, professional email address, phone number, organization name, job title, and country.
- Communication Data: Inquiries, consultation scoping details, and email correspondence.
- Recruitment Data: Resumes, employment history, code repositories, and references submitted for career opportunities.
- Technical Usage Metadata: IP addresses, browser types, device IDs, and essential session logs.
3. How We Collect Information
Information is collected directly when you submit form requests, send emails to our personnel, or engage in advisory consultations. Technical log data is collected automatically via standard Web server protocols.
4. How We Use Information
We process personal data strictly to evaluate consultation inquiries, deliver process architecture and engineering services, perform administrative operations, manage recruitment, and maintain corporate compliance.
5. Legal Basis for Processing
We process personal data in accordance with the Digital Personal Data Protection (DPDP) Act of India, GDPR, and international data protection standards. Processing is grounded in user consent, legitimate business interests, contractual necessity, or regulatory compliance.
6. AI and Personal Information
Critical Operational Distinction:
Website & Inquiries: Public website submissions and email inquiries are never fed into public LLM training datasets.
Client System Deployments: Production AI pipelines built for enterprise clients operate inside isolated customer Virtual Private Clouds (VPC) with zero-data-retention model gateways and KMS encryption.
7. Client Data & Data Processing Agreements
All client data ingested during diagnostic scoping or implementation engagements is governed by dedicated Master Services Agreements (MSA), Data Processing Agreements (DPA), and strict Non-Disclosure Agreements (NDA).
8. Data Sharing & Zero Sale Guarantee
9. Third-Party Technology Providers & Inquiries
We work with trusted enterprise cloud providers (AWS, GCP, Azure) under strict security requirements. For privacy inquiries, DPDP data access requests, or compliance reviews, please contact our Data Protection Office:
10. Data Retention & Governance Schedule
Brownstone retains personal data only for the duration necessary to satisfy operational objectives or statutory obligations under Indian DPDP Act & international standards.
| Category | Data Types | Retention Period | Governance Standard |
|---|---|---|---|
| Inquiries & Audits | Name, Email, Phone, Company, Operational Notes | 24 Months from Last Touchpoint | DPDP Act Consent Baseline |
| Client Advisory | Diagnostic Audits, Process Architecture, Workflows | 7 Years (Statutory Accounting & Legal) | Client MSA / DPA / Strict NDA |
| Candidate Network | Resumes, GitHub, Code Submissions, Interviews | 12 Months (Active Talent Pool) | Right to Erasure Upon Request |
| Server Metadata | IP Address, User Agent, Session Tokens | 90 Days Rolling Buffer | Zero-Knowledge Log Scrubbing |