This policy describes, specifically, what this website actually does with your data — not a generic template. It covers the two forms on this site (the contact form and the careers form), the third parties that process data on our behalf, and the choices you have.
Information you provide directly
Contact form: your name, email address, company name (optional), the services and budget/timeline you select, and your message.
Careers form: your name, email address, a portfolio/LinkedIn/GitHub link (optional), your written pitch, and — if you choose to attach one — your résumé file (PDF or Word, up to 5MB).
How your résumé is actually handled
If you attach a résumé, it is read by your browser, sent to our server, and forwarded once as an email attachment to our hiring inbox. We do not store résumés in a database or file storage of our own — the email is the only place it lives on our side, for as long as our mailbox provider retains it.
We keep candidate details only as long as we're actively considering you for a role, and for a reasonable period afterward (typically up to 12 months) in case a suitable opening comes up, unless you ask us to delete it sooner.
Information collected automatically
Our host, Cloudflare, sees the IP address of every request as a normal part of serving the site, and we read it server-side to rate-limit form submissions (capping how many times one IP can submit in a short window) so the forms can't be abused to spam our inbox.
The pricing shown on our services page uses Cloudflare's edge network to detect the country your request is coming from (nothing more precise than that) purely to decide whether to show prices in INR or USD. We don't store this anywhere.
Both forms use Google reCAPTCHA v3 to distinguish real visitors from bots. reCAPTCHA runs in the background — no puzzle to solve — but to do this it collects signals about your browser and device and may set its own cookies; see the Cookie Policy and Google's Privacy Policy for what that involves.
How we use your information
To reply to enquiries and evaluate job pitches — the entire reason either form exists.
To detect and block spam or abusive submissions (the honeypot field, timing check, and reCAPTCHA score described above).
To show the right currency on pricing.
We do not run a newsletter or marketing list, so we won't email you anything beyond a direct reply to what you sent us. We do not sell personal data to anyone, in any form.
Legal basis for processing
We process personal data on the basis of your consent (submitting a form is an affirmative act), our legitimate interest in running a working contact channel and hiring pipeline free of spam, and — once we're in a live engagement or hiring process with you — to take steps toward or perform a contract.
Who we share data with
Resend (resend.com) — delivers both forms' emails, including any résumé attachment, to our inbox. Resend does not see the content beyond what's needed to relay the message.
Google reCAPTCHA — receives browser/device signals from anyone using either form, as described above. Google's own privacy policy (policies.google.com/privacy) governs what Google does with that.
Cloudflare — hosts the site, serves every request, and provides the DDoS/bot protection and rate-limiting described above.
We disclose data beyond these processors only if required by law, or with your explicit permission.
Data retention
Contact-form enquiries are kept for as long as needed to handle the conversation and a reasonable period after, for our own records, then deleted or anonymised. Careers submissions follow the retention window described above. Technical logs at Cloudflare follow Cloudflare's own retention schedule, not ours.
Your rights
Depending on your location, you may have the right to access, correct, delete, or restrict processing of your personal data, to receive a copy of it, and to withdraw consent at any time — including asking us to delete a résumé or careers pitch immediately rather than wait out the retention window above. Email [email protected] to exercise any of these. If you're in the EU/UK, you also have the right to lodge a complaint with your local data protection authority.
International transfers
Resend, Google, and Cloudflare all operate global infrastructure, which means data can be processed outside the country you're in — including outside India and the EU/UK. Each of these providers publishes its own data-processing and transfer safeguards; we rely on those rather than running our own data centres.
Children's data
This site is intended for businesses and professional visitors. We don't knowingly collect data from children, and neither of our forms is designed for that purpose.
Changes to this policy
If what we collect or who we share it with changes — for example, if we add analytics or a new form — we'll update this page first rather than change our practices quietly.
Where we operate
Zenlor is based in India, with Surandai, Tenkasi, Tamil Nadu as our registered office, and team members working remotely.