Last changed 2026-09-12
Privacy
This covers WebOS: the free website audit and the Build subscription. It is written to describe what the software actually does, so where it is specific, that specificity is deliberate. Turtle Labs runs other sites, and each has its own notice.
Who is responsible
Turtle Labs is the trading name of a sole proprietorship of Aditya Bisen, at #3, L2, Maxx Pride, Manish Nagar, Nagpur, Maharashtra 440037, India.
In the language of the Digital Personal Data Protection Act, Aditya Bisen, trading as Turtle Labs, is the Data Fiduciary and you are the Data Principal. A proprietorship has no legal personality of its own, so the person named here is the one accountable for your information, rather than a company standing between you and them.
You can reach us about anything here at info@turtlelabs.co.in.
What we hold, and why
Grouped by what it is, because the categories behave differently and deserve different treatment.
We do not buy information about you, we do not sell anything about you, and we do not use anything you write to train a model.
| Your account | Your email address, and your name if you gave one. There is no password: signing in works by a link sent to that address. | So your workspace can find you again. An account is only needed for Build, never for an audit. |
|---|---|---|
| Enquiries | What you type into a contact form, and the address it came from. | To answer you. |
| Payments | What you bought, when, how much, and the reference Paytm gives us. Not your card number, which we never receive. | To prove you paid for what you have, and to keep the books. |
| Technical | Your IP address at the moment of a request, for rate limiting. | So the forms cannot be used to send mail at scale. |
Websites you ask us to audit
The audit is the one place where this site processes something that is not about you, and it deserves saying plainly.
You give us an address and this server fetches that site, the way a browser would. We read up to twelve pages, stop at five megabytes and give up after twelve seconds. Only ordinary web ports are used, and a redirect is followed one hop at a time and re-checked at each hop.
We read what is publicly reachable. We do not sign in, submit forms, accept cookies on your behalf, or go around anything that restricts access.
- The report is built while you wait and written into the page you get back. It is not saved, it has no address of its own, and there is nothing stored for anyone to find later.
- Report pages ask search engines not to index them, because a report is about somebody’s business and is often unflattering.
- Your network address is held briefly, in memory only, to stop the same visitor running more than three audits a minute. It is not written to the database and it is not linked to the address you audited.
- We keep no history of what has been audited. Asking us to delete an audit is not something we can do, because there is nothing to delete.
Audit only a site you own or have been asked to look at. Reading a page is what any browser does, so this is not an attack, but permission is still yours to have rather than ours to assume.
The lawful basis
Your account is processed because you asked us to open it: without an address there is no workspace to give you and no way to send you a sign-in link.
A website you ask us to audit is fetched because you asked for the audit. Nothing about it is kept once the report has been handed back to you.
Enquiries and anything we send you are processed on your consent, which you gave when you submitted the form and can withdraw at any time.
Rate limiting is processed on our legitimate interest in not having the audit used to hammer other people’s servers, which is also their interest and yours.
What is never done with it
A report is never published, listed, or shown to anybody but the person who asked for it. It has no address of its own and it is not saved, so there is no copy for us to publish even if we wanted to.
We do not keep a record of which sites have been audited, we do not build a list of sites with low scores, and we do not approach anybody because their site scored badly.
Nothing you write to us is used as marketing copy, as a testimonial, or as an example, without asking you first and separately.
Who else touches it
Only the suppliers that make the service run, and each does one job.
Some of these operate outside India, so your information may be processed abroad. We rely on contractual protection with each of them.
We will hand something over if the law requires it. If we are allowed to tell you, we will.
| MongoDB Atlas | Stores the database. | Under contract, on infrastructure we configure. |
|---|---|---|
| Our mail relay | Sends sign-in links and replies. | Sees your address and the message. |
| Our hosting provider | Runs the server. | Sees requests as any host does. |
| Paytm | Takes payments. | Collects your card or bank details on its own page, under its own policy. We never see them. |
How long it stays
| Audit reports | Not kept at all. The report is written into the page you get back and exists nowhere else. |
|---|---|
| The address you audited | Not kept at all, and not written to the database at any point. |
| Your account | Until you close it. An account with no activity for three years is deleted after we write to the address first. |
| Enquiries | Two years, so we can pick up a conversation you started. |
| Rate limiting records | Minutes. They are held in memory and disappear when the process restarts. |
| Records of payment | Eight years, because tax law requires it. Closing your account does not remove these, and we would be breaking the law if it did. They hold what was bought and when. |
Your rights
Under the Digital Personal Data Protection Act you can ask us to do all of this, and we will not charge you for it.
Write to info@turtlelabs.co.in. We will answer within thirty days and usually much sooner.
- See what we hold about you, and get a copy of it.
- Correct anything wrong or incomplete.
- Delete it. Where you have a paid record we will tell you what deleting removes before we do it, and the record of the payment itself stays for as long as tax law says it must.
- Withdraw consent for anything based on consent, as easily as you gave it.
- Nominate somebody to exercise these rights if you die or become incapable.
- Complain, to us first and to the Data Protection Board of India if we do not resolve it.
Grievances
Our grievance officer is Aditya Bisen, reachable at info@turtlelabs.co.in.
We acknowledge within forty-eight hours and resolve within thirty days. If you are not satisfied, you may take it to the Data Protection Board of India.
Children
This is a tool for people running a website, which in practice means a business. It is not built for children and nothing here is aimed at them.
You must be eighteen or older to open an account. We do not knowingly hold information about anybody younger, we show no behavioural advertising, and we do not track anybody across other sites.
If you believe a child has created an account here, write to us and we will delete it.
Security
No system is perfectly safe. If something happens that puts your information at risk we will tell you and the Board, promptly and in plain words.
- Sign-in links and session tokens are stored hashed, never in readable form, so a copy of the database does not hand anybody a working login.
- A sign-in link works once and expires in twenty minutes.
- Player accounts and staff accounts are kept in separate collections behind separate cookies, so a fault in the public sign-up cannot produce access to the content management system.
- Connections are encrypted in transit.
Cookies
A cookie to keep you signed in, if you sign in. A preference stored in your browser for light or dark. Nothing for advertising, and no third-party tracker.
Changes
If we change something that matters we will say so on this page and, where it affects what happens to your information, write to you. The date at the top is the last change.