This policy explains what personal data Bowline Labs collects, why we collect it and what you can ask us to do with it. We keep it short and plain on purpose.
Who we are
Bowline Labs builds apps and automations for businesses. Bowline Labs is a trading name of Sameer Ahmed, a sole proprietorship based in India, who is the data controller for the personal data described here. You can reach us at info@bowlinelabs.com.
What we collect
When you contact us or book a call
- Your name, email address, company name and anything you tell us in your message.
- Notes from our call: what you want built, your timeline and budget.
- If you book through a scheduling tool, the time you chose and the details you entered there.
When you become a client
- Contact and billing details for your company, and the people we work with day to day.
- Project material you share: documents, designs, and access to accounts or software we need for the build.
- Payment records. Card payments are handled by the payment provider. We never see or store full card numbers.
When you visit this website
- This site has no analytics, no advertising trackers and no forms. Fonts and images load from our own domain.
- Our hosting provider keeps standard server logs (such as IP address, browser type and the page requested) for a short period, to keep the site secure and working.
Business outreach
We sometimes email businesses we think could benefit from our work. To do that we use business contact details that the business has published itself, for example on its own website or in public business listings such as Google Maps: company name, website, business email address, phone number and, where published, the name and role of a contact.
- We rely on our legitimate interest in offering relevant services to businesses.
- We check that an address is deliverable before writing, using an email verification service.
- Every email tells you how to opt out. Reply "no" or "unsubscribe" and we will not email you again.
- We keep a short suppression list of addresses that opted out, so we never contact them again.
- We do not email private individuals, and in countries that require consent before any marketing email (including to businesses), we do not send cold emails.
How we use it and our legal bases
- To reply to you and prepare a proposal: steps you asked for before a contract, and our legitimate interest in answering enquiries.
- To deliver the work and invoice it: performance of our contract with you.
- To keep accounts and meet tax rules: legal obligation.
- To contact businesses about our services: legitimate interest, with an opt-out in every message.
- To keep the website secure: legitimate interest.
We do not sell personal data, and we do not use it for automated decisions that have legal or similar effects on you.
Who we share it with
Only with service providers that help us run the business, under their own data protection terms:
- Email and documents (Google Workspace).
- Website hosting (Vercel).
- Call scheduling, if you book through a scheduling link.
- Payments and invoicing (for example Stripe, Wise or our bank).
- Email address verification, for business outreach.
- Developers on our team who work on your project, all bound by confidentiality.
We may also disclose data where the law requires it.
International transfers
We are based in India and some of our providers are in the United States or the European Union. Where data from the UK or the European Economic Area is transferred, we rely on the safeguards our providers offer, such as the European Commission's standard contractual clauses.
How long we keep it
- Enquiries that do not become projects: up to 24 months after our last contact.
- Client and billing records: as long as tax and accounting law requires, typically up to 8 years.
- Access to your accounts and systems: removed at handover, or sooner if you ask.
- Business outreach data: up to 24 months after our last message, except the opt-out list, which we keep so we can respect it.
- Server logs: kept by our host for a short period, normally days to weeks.
Your rights
Depending on where you live (including under the UK GDPR, the EU GDPR and India's Digital Personal Data Protection Act), you can ask us to:
- Tell you what personal data we hold about you and give you a copy.
- Correct it, or delete it.
- Stop or limit how we use it, including objecting to direct marketing at any time.
- Move it to another provider, where that applies.
Email info@bowlinelabs.com and we will reply within 30 days. If you are unhappy with our answer you can complain to your local data protection authority, for example the Information Commissioner's Office in the UK.
Cookies
This website does not set cookies for analytics or advertising. If we add a booking tool, analytics or anything else that uses cookies, we will update this section first and ask for your consent where the law requires it.
Security
We use two-factor authentication on our accounts, give team members only the access a project needs, and remove access when a project ends. No system is perfectly secure, so if something goes wrong that affects your data we will tell you without undue delay.
Changes to this policy
If we change this policy we will update the date at the top. If a change is significant, we will tell our clients directly.
Contact
Bowline Labs is a trading name of Sameer Ahmed, a sole proprietorship based at Ulubari Chariali, Guwahati, Assam 781007, India. Questions about this page: info@bowlinelabs.com.