Privacy Policy

Last updated 9 September 2026

This policy covers brandos.turtlelabs.co.in, the Turtle Labs brand audit and studio site. It is written to describe what this site actually does, rather than to cover every eventuality. If something here does not match your experience of the site, that is a fault worth reporting to us.

1. Who we are

Turtle Labs Creative Agency is a brand and design practice with its head office in Kochi and studios in Nagpur, Bengaluru and New Delhi, India.

For the purposes of India's Digital Personal Data Protection Act, 2023, and of the UK and EU General Data Protection Regulation where it applies to visitors in those territories, Turtle Labs is the data fiduciary / controller for information collected through this site.

Turtle Labs also operates turtlelabs.co.in as a parent group site. That site is governed by its own policy. This policy applies only to brandos.turtlelabs.co.in and the forms on it.

2. What we collect

We collect nothing at all unless you choose to fill in a form. There is no background collection, no profiling, and no attempt to identify you as you browse.

When you submit one of our forms, we record the fields you filled in:

Alongside each submission we also store the IP address the request came from and your browser's user-agent string. These are kept for security and abuse prevention (to recognise automated submissions) and for nothing else. We do not use them to build a profile of you.

If you reach us through the chat assistant on the site, we record which route you took, so we can tell a chat enquiry from a form enquiry. The chat itself is a fixed set of buttons, not a conversation: nothing you type is captured except in the form you ultimately submit.

3. Cookies and tracking

Two small exceptions, both technical, neither used to identify you:

• A single browser storage entry named tl-welcome-shown. It remembers that you have already dismissed the welcome message so we do not show it twice in one visit. It holds no personal information and is erased when you close the tab.
• A session cookie on the Studio at /studio. This is the private area our own staff sign in to. It is only ever set after a successful staff login, and it holds a random token, no personal data. If you are not a Turtle Labs editor, you will never receive it.

Web fonts are served from our own servers rather than from Google Fonts, so loading a page on this site does not reveal your IP address to any other company.

Because we set no cookies that require consent, this site has no cookie banner. That is a deliberate choice: we would rather not collect the data than ask you to approve collecting it.

4. Why we hold it

• To reply to you. If you ask for a proposal, a call or an answer, we need a way to reach you.
• To send you what you asked for. The workbook, the playbook and the brand score report are delivered by email.
• To keep track of an enquiry internally so it does not get lost between the person who receives it and the person who answers it.
• To keep the site working and to block automated abuse.

The lawful basis is your consent, given when you submit a form, together with our legitimate interest in responding to business enquiries and keeping the service secure. We do not sell your data, rent it, or use it for advertising.

We will only send you marketing email if you have asked for it. Every such message carries an unsubscribe link, and asking us to stop by replying works just as well.

5. Where it is kept

Enquiries are stored in a MongoDB Atlas database, access to which is restricted to our application server and named administrators. Email is delivered through our own mail servers at Hostinger. The site itself is hosted by Hostinger.

These providers act as processors on our behalf: they hold the data so that the service can run, and are not permitted to use it for their own purposes.

Our database runs on MongoDB Atlas in the AWS Mumbai region (ap-south-1), and our web and mail servers are in India. Personal data collected through this site is stored in India and is not transferred outside it.

If that ever changes, we will update this policy and set out the safeguards before any transfer takes place.

6. Who else sees it

Your enquiry is read by the Turtle Labs team who handle new business. Beyond that, we share personal data with nobody: no partners, no affiliates, no data brokers, no advertising networks.

We would disclose information only where the law required it of us, and we would tell you unless we were legally prevented from doing so.

7. How long we keep it

• Enquiries and leads are kept while they are commercially live, and for up to 24 months after our last contact with you, after which they are deleted.
• Staff sign-in sessions expire automatically after 12 hours.
• If we have entered a contract with you, records connected to it are kept for as long as tax and company law require.

You can ask us to delete your details sooner, and we will unless we are legally required to keep them.

8. Your rights

Wherever you are, you may ask us to:

• Show you what we hold about you
• Correct anything inaccurate or incomplete
• Delete it
• Stop using it for a particular purpose, including marketing
• Send you a copy in a portable format
• Withdraw consent you previously gave, which does not affect anything done beforehand

Email info@turtlelabs.co.in and we will respond within 30 days. We will not charge you, and we will not ask why.

Under India's DPDP Act you may also nominate another person to exercise these rights on your behalf if you are unable to. If you are in the UK or EU, you additionally have the right to complain to your national supervisory authority.

9. Security

• The whole site is served over HTTPS.
• Staff passwords are stored as bcrypt hashes, never in readable form. Nobody at Turtle Labs can read your password, or ours.
• Database access is restricted by credentials and network rules; the database is not reachable from the public web.
• Studio sessions are held in httpOnly cookies, which page scripts cannot read.
• Submitted values are sanitised before they are stored or emailed.

No system is perfectly secure. If we ever discover a breach affecting your personal data, we will notify you and the Data Protection Board of India as the DPDP Act requires.

10. Children

This site is meant for businesses and the people who run them. We do not knowingly collect personal data from anyone under 18. If you believe a child has sent us their details, tell us and we will delete them.

11. Changes

If this policy changes we will update the date at the top. Where a change materially affects how we handle data you have already given us, we will tell the people affected directly rather than quietly amend the page.

12. Contact and complaints

Questions, requests and complaints about privacy all go to the same place:

• Email info@turtlelabs.co.in
• Phone +91 74005 31107
• Post Turtle Labs Creative Agency, Kochi, Kerala, India

If you are not satisfied with how we have handled a request, you may complain to the Data Protection Board of India, or to your local supervisory authority if you are in the UK or EU.