Idea2Code
Privacy Policy
This policy covers the Idea2Code mobile app for Android and iOS, and this website, idea2code.org. Both are operated by Atomos Technologies (OPC) Private Limited.
Effective 23 October 2026.
Idea2Code is a business tool. You use it to describe software you want built, agree terms, follow the work, and pay for it. Everything below follows from that: we hold what an engagement needs, for as long as Indian tax and contract law requires us to, and nothing is sold or used for advertising.
1. Who we are
Atomos Technologies (OPC) Private Limited is a One Person Company incorporated in India, with its principal place of business in 231, G.T. Road, Shibpur, Howrah, West Bengal 711102, India. We are the Data Fiduciary under India's Digital Personal Data Protection Act 2023 for personal data collected through the Idea2Code app and this website, and the data controller for the purposes of the UK and EU GDPR in respect of the same. Where we handle data belonging to a client's own users in the course of building software for them, we act as a Data Processor on that client's documented instructions under the services agreement.
GSTIN 19AAXCA0822C1ZQ · D-U-N-S 738695694.
2. What the app collects
The table below is the complete list, taken from the application's own database schema rather than written from memory.
| Category | What exactly | Why |
|---|---|---|
| Account | Your name, email address, phone number, a hashed password, your language preference, and, if you give one, the referral code of whoever referred you, with when you gave it | To create and secure your account and to contact you about your project |
| Sign-in with Google or Apple | The identifier that provider returns to us, and the email address on it | So you can sign in without a separate password. We never receive your Google or Apple password |
| Business details | Organisation name, contact person, contact number, email, address, state, postcode and GSTIN where you are billing as a business | To raise a legally valid tax invoice |
| Your project | The brief you write, the stage and priority you pick, the categories you choose, your preferred way of meeting, and the appointment slot you book | To quote for and carry out the work |
| Files you upload | The file itself, its original filename, type and size | Because you attached it to a request as part of the brief |
| Referral partner application | If you apply to be a referral partner: your name, whether you apply as an individual, a business, a chartered accountant in practice or another professional, your email address and phone number, and how you would refer people to us. If we approve you: your referral code and the agreement you sign, with the evidence of signing (the verified email code, your drawn signature, the time, IP address and device) | To consider your application, issue your referral code and keep a record of the agreement |
| Signature evidence | When you sign an agreement in the app: your name, title, entity, email, phone, the IP address and device you signed from, the exact time, and a cryptographic hash of the precise document text you were shown | This is what makes an electronic signature evidential under the Information Technology Act 2000. Without it a signed agreement could not be relied on by either of us |
| Payments | Which instalments were raised, what you paid, when, in what currency, and the reference the payment gateway returned. We never see or store your card or bank details — those go directly to the gateway | To take payment and to issue the tax invoice we are required to issue |
| Support | The subject and body of any support ticket you raise | To answer it |
| Device | A push notification token, the platform, a device name, and when it was last seen | To send you notifications about your project. Turn notifications off and this stops |
| Security and audit log | For actions taken in the app and the panel: IP address, user agent, device type, platform and the route used | To detect abuse, and so that a change to your project can be traced to whoever made it |
What we do not collect
- No advertising identifiers, no cross-app tracking, no behavioural profiling.
- No card numbers, CVVs or bank credentials.
- No location beyond what an IP address implies, no contacts, no photos beyond the images you choose to attach, no microphone or camera access.
- No special category data. Please do not put health, biometric or similar information into a project brief or a support ticket.
3. Children
Idea2Code is for businesses and professional clients and is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us data, write to us and we will delete it.
4. Our lawful basis
- Performance of a contract — running your engagement, invoicing, and taking payment.
- Legal obligation — issuing tax invoices and keeping books under the Companies Act 2013, the CGST Act 2017 and the Income-tax Act 1961.
- Legitimate interests — keeping the service secure, preventing abuse, and keeping a record of what was agreed. Under the DPDP Act these sit under legitimate uses and the consent you give when you create an account.
- Consent — for anything optional, such as marketing messages. You can withdraw it at any time in the app under Profile, without affecting anything done before you withdrew it.
We do not use your data for automated decision-making that has a legal or similarly significant effect on you.
5. Who else sees it
We do not sell personal data and we do not share it for advertising. It reaches only these processors, each for one purpose:
| Who | What they get | What for |
|---|---|---|
| Google Firebase (Authentication, Cloud Messaging, App Check) | Account identifier, device push token, an app integrity signal | Sign-in, push notifications, and blocking forged clients |
| Google Sign-In · Apple Sign-In | Whatever you authorise at the provider's own prompt | Signing in without a separate password |
| Razorpay, Stripe | Amount, currency, and the details you enter on their own checkout | Taking payment. Each is its own controller for what you give them |
| Hostinger | Everything, at rest, as our hosting provider | Running the service |
| Our own email sending | Your email address and the message | Verification codes, receipts and notices |
Beyond that we disclose personal data only to professional advisers under a duty of confidentiality, where the law or a valid order requires it, or to a successor entity in a merger or acquisition — in which case you will be told, and the acquirer is bound by this policy or one materially equivalent.
6. Where it is held
Idea2Code is hosted by Hostinger on servers in the United States (Phoenix, Arizona), and its public pages are delivered through Hostinger's content delivery network, which may serve them from a location near you. Your personal data is therefore transferred out of India. Section 16 of the Digital Personal Data Protection Act 2023 permits a transfer to any country or territory the Central Government has not restricted by notification, and it has notified no such restriction. If you are in the EEA or the UK, your data is processed under Hostinger's data processing terms, which apply the European Commission's Standard Contractual Clauses (Decision 2021/914) and the UK International Data Transfer Addendum.
7. How long we keep it
| What | How long |
|---|---|
| Account and project records for an engagement that went ahead | The engagement, plus 8 years, to meet Indian tax, statutory and limitation requirements |
| Invoices, payments and signed agreements, including a referral partner agreement | 8 years. These we are required to keep and cannot delete on request |
| A referral partner application we did not approve, or that was never signed | Until you ask us to delete it or delete your account |
| A request that never became an engagement | 24 months from your last contact |
| Files attached to a request that was abandoned | Pruned automatically |
| Push notification tokens | Until the app is uninstalled or the token stops working |
| Security and audit logs | 18 months |
8. How it is protected
- TLS on everything in transit; passwords stored only as a salted hash, never recoverable.
- Payment gateway keys and webhook secrets held encrypted at rest.
- Role-based access on a least-privilege basis for our own staff, with every action written to an audit log.
- Two-factor sign-in codes, device checks, and rate limiting on anything that sends a code.
- Production data is never copied into development environments.
No system is perfectly secure. If a breach occurs that is likely to affect your rights, we will notify the Data Protection Board of India and, where the risk is high, you directly, within the periods the law requires.
9. Your rights, and how to use them
You have the right to access your data, to have it corrected, to have it erased, to withdraw consent, to nominate someone to exercise your rights if you die or become incapacitated (DPDP Act 2023), and to have a grievance addressed. In the EEA and UK you also have rights to restriction, portability and objection.
Most of this you can do yourself, in the app.
- Correct your name, email, phone or country under Profile.
- Turn marketing consent on or off under Profile.
- Delete your account under You → Delete account (DPDP / GDPR), or, if you cannot sign in, from the web. We erase what we are free to erase and retain only invoices, payments and signed agreements, which Indian law requires us to keep. If you are a referral partner, we keep your signed agreement with your name, email address and referral code, and erase your phone number and what you told us about how you would refer. We also keep the commission and payout records linked to your partner agreement, for as long as tax and accounting rules require. You will be told exactly what was kept and why.
Otherwise write to care@idea2code.org with the subject DATA REQUEST. We reply within 30 days, and we may need to verify who you are first.
10. Grievance officer
Under the Information Technology Act 2000, the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021 and the Digital Personal Data Protection Act 2023, complaints about how your personal data is handled may be addressed to:
We acknowledge a grievance within 24 hours and resolve it within 15 days, as those rules require. These are the same details shown inside the app under compliance, because both are read from one record.
You may also complain to the Data Protection Board of India, or to your own supervisory authority in the EEA or the UK. We would rather you gave us the chance to put it right first.
11. Other documents
Our Terms of Service and Refund, Cancellation and Delivery Policy govern the commercial relationship and are published by Atomos Technologies (OPC) Private Limited. Where a signed services agreement exists, that agreement takes precedence.
12. Changes
The current version always lives at this address with its effective date. Where a change materially affects your rights we will tell you in the app before it takes effect.
13. Contact
Atomos Technologies (OPC) Private Limited
231, G.T. Road, Shibpur, Howrah, West Bengal 711102, India
Email: care@idea2code.org