Last changed 2026-10-13
Privacy
This covers BrandOS at brandos.turtlelabs.co.in, including the website audit at /web and Watch. It is written to describe what the software actually does, so where it is specific, that specificity is deliberate. Turtle Labs runs other sites, and each has its own notice.
Who is responsible
Turtle Labs is the trading name of a sole proprietorship of Aditya Bisen. Its registered office is #3, L2, Maxx Pride, Manish Nagar, Nagpur, Maharashtra 440037, India, and it has a regional office at Kochi, Kerala, India.
In the language of the Digital Personal Data Protection Act, Aditya Bisen, trading as Turtle Labs, is the Data Fiduciary and you are the Data Principal. A proprietorship has no legal personality of its own, so the person named here is the one accountable for your information, rather than a company standing between you and them.
You can reach us about anything here at info@turtlelabs.co.in.
What we hold, and why
Grouped by what it is, because the categories behave differently and deserve different treatment.
We do not buy information about you, we do not sell anything about you, and we do not use anything you write to train a model.
| Your account | Your email address, and your name if you gave one. There is no password: signing in works by a link sent to that address. | So your results and your answers can be found again. |
|---|---|---|
| An audit you asked us to email | The address you gave, the site or business it was about, the score, and which areas came out strongest and weakest. An audit you did not ask us to email is not stored at all. | To send it to you, and to understand what the audits are finding. |
| Answers you write in a book or a strategy | Whatever you type into the Brand Systems workbooks, and into the strategy questions at the end of a brand audit. Your own words about your own business, filed against your address. | So you can read them back later, and so the document can be rebuilt from them. They are never used to train anything. |
| The ninety-day tracker | Which of the tasks you have ticked, and when. | So the tracker shows where you are when you come back to it. |
| Enquiries | What you type into a contact form, and the address it came from. | To answer you. |
| Payments | What you bought, when, how much, and the reference the payment provider gives us. Not your card number, which we never receive. | To prove you paid for what you have, and to keep the books. |
| Technical | Your IP address at the moment of a request, for rate limiting. | So the forms cannot be used to send mail at scale. |
Websites you ask us to audit
The audit is the one place where this site processes something that is not about you, and it deserves saying plainly.
You give us an address and this server fetches that site, the way a browser would. We read up to twelve pages, stop at five megabytes and give up after twelve seconds. Only ordinary web ports are used, and a redirect is followed one hop at a time and re-checked at each hop.
We read what is publicly reachable. We do not sign in, submit forms, accept cookies on your behalf, or go around anything that restricts access.
- The report is built while you wait and written into the page you get back. It is not saved, it has no address of its own, and there is nothing stored for anyone to find later.
- Report pages ask search engines not to index them, because a report is about somebody’s business and is often unflattering.
- Your network address is held briefly, in memory only, to stop the same visitor running more than three audits a minute. It is not written to the database and it is not linked to the address you audited.
- Run an audit and close the tab and it leaves no history. Nothing is stored, and asking us to delete it is not something we can do, because there is nothing to delete.
- Ask us to email you the report, and then we keep the result: the address you gave, the site or business it was about, the score, and which areas came out strongest and weakest. We keep it to understand what the audits are finding across everybody who runs one, and we will delete it on request like anything else here. If you never give us an address, none of that happens.
Audit only a site you own or have been asked to look at. Reading a page is what any browser does, so this is not an attack, but permission is still yours to have rather than ours to assume.
Watching a site over time
Watch is the one thing here that keeps a record of an audit, because a change cannot be spotted without one.
If you start a Watch, this server looks at the site you named every few days, on its own, without you being here. Each look is the same audit described above and obeys the same limits.
We keep the result of each look so the next one can be compared with it. The result is a score out of a hundred, the number of findings at each severity, and the date. That is the whole record.
- We do not keep your pages, your markup, a screenshot, or a copy of anything we read. The audit itself is discarded the moment the score is taken from it.
- Twelve readings are kept per watched site. Older ones are dropped as new ones arrive, so the record does not grow without limit.
- The address you gave us is used to write to you when the score moves or a critical fault appears, and for nothing else. There is no digest and no marketing from it.
- Every one of those emails carries a link that stops the watch in one click, without writing to anybody and without signing in to anything.
- Stopping a watch stops the looking straight away. Ask us to delete the readings as well, by replying to any of those emails, and they go.
- There is no account and no password. The link we email you is signed, which is what makes it yours, so treat it as you would any other private link.
If you stop paying, the looking stops. We do not keep watching a site we are not being paid to watch, and we do not quietly hold the readings open against a future subscription.
The lawful basis
Your account, the audits you run and the answers you write into the brand strategy and the workbooks are processed because you asked us to provide them: without that information there is no service to provide.
Where you have given consent, for an email about your result, you can withdraw it at any time and it is as easy to withdraw as it was to give.
What is never done with it
No artificial intelligence decides what your answers meant. Where a paid reading is produced by a model, the page says so before you buy and a person can be asked for instead.
Your score, your audit result and the answers you write are yours. There is no leaderboard, nothing is comparable between businesses, and nothing about you is shown to another customer unless you deliberately share it.
Nothing you write is used as marketing copy, as a testimonial, or as an example, without asking you first and separately.
Who else touches it
Only the suppliers that make the service run, and each does one job.
Some of these operate outside India, so your information may be processed abroad. We rely on contractual protection with each of them.
We will hand something over if the law requires it. If we are allowed to tell you, we will.
| MongoDB Atlas | Stores the database. | Under contract, on infrastructure we configure. |
|---|---|---|
| Our mail relay | Sends sign-in links and replies. | Sees your address and the message. |
| Our hosting provider | Runs the server. | Sees requests as any host does. |
| Razorpay | Takes payments in India. | Collects your card or bank details on its own page, under its own policy. We never see them. |
| Lemon Squeezy | Sells and takes payment outside India, as merchant of record. | It is the seller for that transaction. It collects your details and the tax on its own page, under its own policy, and we never see them. |
How long it stays
An audit you did not ask us to email leaves nothing behind at all. One you did is kept until you ask us to delete it.
Deleting an entry deletes what it built. That is a rule of the product, not only of this policy: a strategy and a tracker are exactly as true as the answers under them, so removing the answers removes what was built on top.
Close your account and everything goes with it, including the workbooks you filled in and anything a purchase unlocked.
Your rights
Under the Digital Personal Data Protection Act you can ask us to do all of this, and we will not charge you for it.
Write to info@turtlelabs.co.in. We will answer within thirty days and usually much sooner.
- See what we hold about you, and get a copy of it.
- Correct anything wrong or incomplete.
- Delete it. Where you have a paid record we will tell you what deleting removes before we do it, and the record of the payment itself stays for as long as tax law says it must.
- Withdraw consent for anything based on consent, as easily as you gave it.
- Nominate somebody to exercise these rights if you die or become incapable.
- Complain, to us first and to the Data Protection Board of India if we do not resolve it.
Grievances
Our grievance officer is Aditya Bisen, reachable at grievance@turtlelabs.co.in.
We acknowledge within forty-eight hours and resolve within thirty days. If you are not satisfied, you may take it to the Data Protection Board of India.
Children
BrandOS is sold to businesses and you must be eighteen or older to have an account. It is not designed for children, not offered to them, and nothing here is aimed at them.
We do not knowingly hold a child’s information. If you believe a child has an account, write to info@turtlelabs.co.in and it will be deleted.
Turtle Labs does run a programme that works with schools. It is Find Your Passion, it is a different product on a different site, and it has its own notice covering how a school arranges consent. Nothing on this site is part of it.
Security
No system is perfectly safe. If something happens that puts your information at risk we will tell you and the Board, promptly and in plain words.
- Sign-in links and session tokens are stored hashed, never in readable form, so a copy of the database does not hand anybody a working login.
- A sign-in link works once and expires in twenty minutes.
- Player accounts and staff accounts are kept in separate collections behind separate cookies, so a fault in the public sign-up cannot produce access to the content management system.
- Connections are encrypted in transit.
If something goes wrong
A promise to tell you promptly is worth nothing without a route that starts the moment somebody notices. This is that route.
- It goes to the proprietor, Aditya Bisen, directly and first. Not to a queue, and not to whoever happens to be on shift.
- The proprietor names one person to own the fix, that same day. That person owns it until it is closed and reports back to the proprietor and the grievance officer as it moves.
- Containment comes before explanation. We shut the hole first and work out how it opened afterwards.
- You are told what happened, what of yours was involved and what to do about it. The Data Protection Board of India is told in the same breath, and questions go to grievance@turtlelabs.co.in.
- Afterwards we write down what happened and what changed because of it, so the same fault does not need discovering twice.
Cookies
A cookie to keep you signed in, if you sign in. A preference stored in your browser for light or dark. Nothing for advertising, and no third-party tracker.
Changes
If we change something that matters we will say so on this page and, where it affects what happens to your information, write to you. The date at the top is the last change.