Privacy Policy

This Privacy Policy explains how myCTO Live, which operates the Boldfish brand (“Boldfish”, “we”, “us”), collects, uses, shares and protects personal data when you visit www.boldfish.co (the “Website”), contact us, or subscribe to our journal. It is written to meet the requirements of India’s Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 (together, the “DPDP Law”), and to respect the rights of visitors from other countries.

For the purposes of the DPDP Law, myCTO Live is the Data Fiduciary for the personal data described here. This policy covers the Website only. Personal data we handle while delivering work for a client is governed by our engagement agreement with that client.

1. What we collect

We collect only what we need to respond to you and to run the Website.

• When you contact us: your name, email address, company, and anything you choose to tell us in the contact form — such as who you need to convince, what is at stake, and your timeline.
• When you subscribe to the journal: your email address.
• When you email or call us directly: the details you share and our correspondence with you.
• When you browse the Website: technical data such as IP address, browser and device type, pages visited, referring page and time of visit, collected through server logs and Google Analytics.

We do not ask for, and ask you not to send us, sensitive information such as financial account details, health information or government identity numbers through the Website.

2. Why we use it

We use personal data only for these purposes:

• to reply to your enquiry and discuss a potential engagement;
• to send you journal articles and studio news, if you have subscribed;
• to understand how the Website is used, so we can improve it;
• to keep the Website secure and prevent misuse; and
• to comply with our legal obligations.

We do not sell your personal data, and we do not use it for automated decision-making that affects you.

3. Our legal basis

We process your personal data on the basis of your consent, which you give when you submit the contact form, subscribe to the journal or accept non-essential cookies, and for legitimate uses permitted by the DPDP Law, such as responding to information you have voluntarily provided to us, and meeting legal requirements.

You can withdraw your consent at any time by writing to hello@boldfish.co or by using the unsubscribe link in any email. Withdrawal does not affect processing that took place before it, and we will stop processing your data for that purpose within a reasonable time.

If you are in the European Union or the United Kingdom, we rely on your consent, on steps taken at your request before entering into a contract, and on our legitimate interests in running and securing the Website.

4. Cookies and analytics

The Website uses a small number of cookies and similar technologies:

• Essential cookies that make the Website work and keep it secure. These cannot be switched off.
• Analytics cookies from Google Analytics that tell us, in aggregate, which pages are read and how visitors find us. These are set only with your consent.

You can change your cookie choices at any time through your browser settings. Blocking essential cookies may stop parts of the Website from working.

5. Who we share it with

We share personal data only with service providers who help us run the Website and our studio, and only to the extent they need it. They process data on our instructions and under contracts that require them to protect it. They include:

• website hosting and infrastructure — Vercel;
• email and form handling — Resend;
• newsletter delivery — Resend; and
• website analytics — Google Analytics (Google LLC).

We may also disclose personal data where the law requires it, to protect our rights or the safety of others, or as part of a merger, acquisition or restructuring of our business, in which case this policy will continue to apply to your data.

6. Transfers outside India

Some of our service providers store or process data outside India. Where this happens, we transfer data only to countries not restricted by the Government of India under the DPDP Law, and we take reasonable steps to ensure it is protected to the standard described in this policy.

7. How long we keep it

• Enquiries: for up to 24 months after our last contact with you, unless we go on to work together, in which case our engagement agreement applies.
• Journal subscriptions: until you unsubscribe.
• Analytics and server logs: for up to 14 months.

After these periods, we delete or anonymise the data, unless the law requires us to keep it longer.

8. How we protect it

We use reasonable security safeguards, including encrypted connections (HTTPS), access controls limited to the people who need the data, and reputable service providers with their own security programmes. No system is completely secure, but if a personal data breach affects you, we will inform you and the Data Protection Board of India as the DPDP Law requires.

9. Your rights

Under the DPDP Law you have the right to:

• request a summary of the personal data we hold about you and how we use it;
• ask us to correct, complete or update your personal data;
• ask us to erase your personal data, where we no longer need it for the purpose it was collected for or the law does not require us to keep it;
• withdraw your consent at any time;
• nominate another person to exercise these rights on your behalf in the event of your death or incapacity; and
• raise a grievance with us, and, if you are not satisfied with our response, with the Data Protection Board of India.

If you are in the European Union or the United Kingdom, you also have the rights to restrict or object to processing, to data portability, and to complain to your local data protection authority.

To exercise any of these rights, write to hello@boldfish.co. We may need to verify your identity before acting on a request. We will respond as soon as possible and in any case within the time required by law, which under the DPDP Rules is no more than 90 days.

10. Children

The Website is intended for business audiences and is not directed at anyone under 18. We do not knowingly collect personal data from children. If you believe a child has sent us personal data, please contact us and we will delete it.

11. Links to other websites

The Website links to other websites, such as LinkedIn and Instagram, and to the websites of our clients. Their privacy practices are their own, and we encourage you to read their policies.

12. Changes to this policy

We may update this policy from time to time. The “Last updated” date at the top shows when it was last changed. If a change materially affects how we use personal data you have already given us, we will tell you before it takes effect.

13. Contact and grievance officer

For any question, request or complaint about your personal data, contact our grievance officer:

• Name: Aashik Joel
• Email: hello@boldfish.co
• Address: 23, Madha Koil Street, Nellithope, Puducherry – 605 005, India