Privacy Policy

Who this policy is from

Blockphrase is a trading name of Blockphrase XLabs Private Limited (CIN U62099MH2025PTC454397), registered with RoC Mumbai at Shivai Nagar Pok Rd, Jekegram, Thane, Maharashtra 400606. In this policy “we” and “us” mean that company, and “this site” means www.blockphrase.com.

Questions about this policy, or about data we hold on you, go to info@blockphrase.com.

What we collect

Apart from the request logs every web host keeps (see “Who else handles it” below), we collect nothing from you until you send us something. There is no account to create and no newsletter to subscribe to.

When you submit the scoping form on the contact page, we receive:

• Your name and the email address you ask us to reply to.
• Your company, if you give one. The field is optional.
• What you need help with, the stage your project is at, and the jurisdictions you have selected, with any note you add about them.
• Your message, if you write one.
• The page you were on when you opened the form, so we know what prompted the enquiry.
• The date and time you sent it.

If you ask for a case study's PDF, we check that the email address you enter is a valid one before sending you to the file. We do not store that address.

What we do not collect

This site loads no analytics, advertising or tracking scripts. We do not profile visitors, and we do not sell or share data for advertising. Reading the site sets no cookie on you: the only cookies this site sets are the ones its admin sign-in needs (a session, a security token and a return address), and only on the admin pages.

The form has no field for, and no upload of, financial details, identity documents, or any special category of personal data. Please do not send them in the message field.

Why we hold it, and on what basis

We use what you send to answer your enquiry, to scope the work you are asking about, and to keep a record of the conversation. That is the whole purpose.

Where the UK or EU GDPR applies to you, our basis is your request to take steps before entering a contract, and our legitimate interest in answering enquiries addressed to us. Where India's Digital Personal Data Protection Act, 2023 applies, we process the enquiry on the consent you give by sending it. You can withdraw that consent at any time by writing to us.

Who else handles it

We keep the firm's tooling deliberately small. These are the services that handle any part of an enquiry:

• Vercel, which hosts this site and runs the form. Like any web host, its servers log requests, which includes IP addresses.
• Prisma, whose Accelerate service connects the site to its database, so every enquiry passes through it.
• MongoDB, the database where the enquiry itself is stored.
• Brevo, which delivers the notification email carrying your enquiry to us.
• Upstash, which we use to rate-limit the form. It uses the IP address an enquiry came from as a key, so that one sender cannot flood the form, and keeps a count of allowed and refused attempts against that address.

Separately from enquiries, the images and client logos on these pages load from Cloudinary, which therefore sees the IP address of anyone viewing them. Cloudinary does not see enquiries.

Where it goes

We work from Dubai and Mumbai, and the services above operate internationally, so what you send us may be stored or processed outside the country you sent it from, including in the United States, where this site's hosting runs.

How long we keep it

We keep an enquiry while we are answering it, and afterwards as a record of who approached us and about what.

If you want yours deleted, write to us and we will delete it, unless we are required to keep it to meet a legal or accounting obligation.

What you can ask us for

Write to info@blockphrase.com and you can ask for a copy of what we hold on you, a correction, or its deletion. You can also ask us to stop using it, and withdraw any consent you gave. We answer such requests within the time the law that applies to you allows.

If you are in the EU or UK and you are not satisfied with our answer, you may complain to your national data protection authority. If you are in India, you may raise the matter with the Data Protection Board of India.

How it is kept

This site is served over HTTPS, so what you send through the form is encrypted on its way to us, and the site's admin pages require a sign-in. No system is perfect, and we do not claim otherwise; if a breach ever affects your data, we will tell you and the relevant authority as the law requires.

Changes to this policy

We update this page when what we do changes. The date at the top is when it was last revised, and this version replaces anything said before it. It was last reviewed on 13 October 2026.