These are public working principles, not a substitute for a project agreement.
This page describes Pinchit’s default approach when building or supporting software for a client. It does not itself create a client relationship, data-processing appointment, confidentiality obligation, intellectual-property assignment or service level.
The proposal, statement of work, data-processing terms and service agreement for an engagement identify the parties, systems, data categories, authorised purposes, security requirements, deliverables, ownership and retention periods that actually apply.
The client or product owner keeps control of client-provided project data.
“Client Data” means information, records, content, credentials, files and other material supplied by or for the client, or collected by a system for the client, in connection with an engagement. As between Pinchit and the client, the client retains its rights in Client Data. Access given to Pinchit is limited to the agreed work and does not transfer ownership.
Personal data is different from ordinary business property. Individuals retain the rights given to them by applicable data-protection law. A contract between Pinchit and a client cannot remove those rights.
Where Pinchit processes personal data only on the client’s documented instructions, the engagement should identify the client as the Data Fiduciary or controller and Pinchit as the Data Processor or processor. If either party decides an independent purpose or means of processing, its legal role may be different and must be documented accurately.
Client Data is used only for an authorised purpose.
Pinchit will access, copy, transform, test, transmit or otherwise process Client Data only as reasonably necessary to assess, build, test, secure, operate or support the agreed work; follow the client’s documented instructions; or comply with applicable law.
Pinchit will not sell Client Data, use it for unrelated advertising, or knowingly use it to train a public or general-purpose model for Pinchit’s or another party’s independent benefit. The client remains responsible for ensuring that it has a lawful basis and the necessary notices, permissions and rights to provide the data and instruct the agreed processing.
Production personal data should not be used for development or testing where representative synthetic, anonymised or masked data can reasonably achieve the purpose.
Security must match the data and the risk.
Pinchit applies reasonable technical and organisational safeguards appropriate to the engagement. The baseline is to limit access to people and providers who need it, use private project storage, protect credentials, keep supported software reasonably current, and use secure transmission and access-control features offered by the selected providers.
Higher-risk data or regulated systems may require additional controls such as client-managed accounts, multi-factor authentication, encryption or masking, environment separation, audit logging, backup and recovery procedures, vulnerability management, review gates, regional storage or an incident-response plan. Those controls must be verified and written into the engagement rather than assumed from this page.
No system can be guaranteed completely secure. Pinchit does not describe a safeguard as implemented unless it applies to the relevant project.
Subprocessors and AI-assisted tools require controlled use.
Hosting, repositories, databases, monitoring, communication and other specialist providers may process Client Data only where reasonably needed for the engagement and subject to appropriate account settings, access restrictions and contractual protections. The applicable engagement should identify material providers or the process for approving them where the data risk makes that necessary.
Client Data is not submitted to an AI-assisted tool merely because the tool is convenient. Where an engagement permits such a tool, the parties should agree what data may be submitted, whether the provider retains prompts or outputs, whether that data can be used for model training, and what human review is required. Credentials, secrets and regulated or confidential personal data should be excluded unless the tool and written scope specifically support that use.
Project data is returned or deleted when it is no longer needed.
During an engagement, Pinchit retains Client Data only for the agreed purpose, support period, dispute handling and applicable legal or security-record requirements. On completion or a valid written request, Pinchit will reasonably assist with return or export of agreed data and delete working copies according to the written retention plan.
Deletion may not immediately remove data from encrypted backups, security logs or records that must be retained by law. Any such residual copy remains protected, is not used for a new purpose, and is removed or overwritten through the applicable retention cycle.
Material security incidents are handled openly and proportionately.
If Pinchit becomes aware of a confirmed incident materially affecting Client Data in Pinchit’s control, Pinchit will take reasonable steps to contain and investigate it, preserve relevant evidence, reduce further harm and notify the client without undue delay, subject to any more specific contractual or legal timeline.
The client and Pinchit will cooperate on legally required notices and remediation according to their actual roles. Pinchit will not make a public statement naming the client without authority unless disclosure is legally required.
Project IP is separated into client material, bespoke deliverables and background tools.
- Client material. The client keeps its rights in Client Data, brand assets, specifications and other material it supplies.
- Bespoke deliverables. Ownership or licence rights in custom code, designs, documentation and other deliverables are stated in the signed engagement. Where transfer is agreed, it normally occurs after full payment and must be recorded in writing.
- Background material. Each party keeps its pre-existing tools, templates, libraries, methods, know-how and other material developed independently of the engagement.
- Third-party material. Open-source software, platforms, fonts, stock assets and other third-party components remain subject to their own licences and terms.
A clear engagement document should identify what the client can modify, host, transfer or reuse; what Pinchit may reuse as general know-how; and any dependencies the client must continue to license.
Confidential information stays limited to the engagement.
Confidential project information is used only for the agreed work and shared only with authorised people or providers who need it. The signed engagement should cover exclusions, compelled disclosure, protection standards and the duration of confidentiality where the project requires binding obligations.
Pinchit does not obtain a right to publish confidential project details merely by doing the work. Any right to name a client, display a logo, publish a case study or share project material is agreed or confirmed separately.
The signed engagement controls.
If a signed proposal, statement of work, confidentiality agreement, data-processing agreement or service agreement conflicts with this page, the signed document controls for that engagement. Mandatory rights and obligations under applicable law continue to apply.
Questions about client data, security or project IP can be sent to priyamjain@pinchit.in. Website inquiry and analytics data is covered separately by the Privacy Notice.