Who we are
Cityfort (cityfort.in) is an education website that explains Indian listed companies. In this policy, "we" means the person or business that runs Cityfort. Under India's data protection law, we are the "data fiduciary" for your personal data.
The short version
- You can read Cityfort without giving us any personal data. There are no reader accounts and no email list.
- Our own visitor counter uses no cookies and does not store your IP address.
- Google Analytics and Google ads load only if you click "Accept".
- If you write to us, we keep your email address and message so we can reply.
What we collect
When you read the site
Our own analytics records which pages are viewed, the website you came from and any campaign tags in the link. It also records your device type, operating system, browser, and an approximate country and region. We log searches on Cityfort and how far you scroll. Clicks on links to other Cityfort pages and to source documents are counted too.
To count unique visitors, we create a visitor code. It is a one-way scrambled mix of your IP address, your browser details and a random value that we create each day and delete the next day. Your IP address itself is never stored. Because that value is deleted, a code can't be linked to you or to another day's code afterwards.
This counter uses no cookies. It keeps a random visit code in your browser's session storage for up to 30 minutes of inactivity, and we store that code with the pages viewed in that visit. It does not run if your browser sends Do Not Track.
Like every website host, our host receives your IP address when a page loads.
When you accept analytics or advertising cookies
If you click "Accept", Google Analytics sets cookies to measure how the site is used. On blog posts, Google AdSense may set cookies to show and measure ads.
Third-party vendors, including Google, use cookies to serve ads based on your earlier visits to this site or other sites. Google's advertising cookies let Google and its partners show you ads based on those visits. See our cookie policy for the full list.
When you write to us
We keep your email address and your message so we can reply.
Why we use your data
- To understand which pages are read, so we can improve them and choose companies to cover next.
- To show ads on blog posts, if you accept advertising cookies.
- To reply to you, fix errors you report and handle requests about your data.
- To keep the site secure and stop abuse.
We do not sell your personal data.
Our legal basis
We rely on your consent under the Digital Personal Data Protection Act, 2023 (DPDP Act).
- Google Analytics and ads: these load only after you click "Accept" in the cookie banner.
- Messages to us: you choose to write to us, and we use your email address only to reply.
You can withdraw consent at any time: change your cookie choice, or ask us to delete your messages.
Who processes data for us
We use these service providers. They handle data only to provide their service to us.
| Provider | What they do for us | Data they handle |
|---|---|---|
| Supabase | Database for our own analytics | Analytics events (no IP addresses) |
| Netlify | Hosts the website | IP address and browser details when pages load |
| Google Analytics, AdSense (only after you accept) and Search Console | Cookie identifiers, pages viewed, device details |
Search Console gives us only totals, such as how often our pages appear in Google results.
Google uses data from AdSense and Analytics under its own policies. Read how Google uses information from sites that use its services. You can turn off personalised ads in Google's ad settings, or opt out of some other vendors at aboutads.info.
Where your data is stored
Some of our providers store or process data outside India. The DPDP Act allows this unless the Government of India restricts transfers to a country.
How long we keep it
- Raw analytics events: 90 days, then deleted.
- Daily totals from analytics (for example, page views per day): kept. They contain no visitor codes.
- Messages to us: until your question is resolved, then up to 2 years.
- Google cookies: see the lifetimes in our cookie policy.
The DPDP Rules require some records of data processing to be kept for one year. Where a law requires this, we keep only that record, for that period, and then delete it.
Your rights
Under the DPDP Act, you can:
- ask what personal data we hold about you and how we use it
- ask us to correct, complete or update it
- ask us to erase it
- withdraw your consent
- nominate someone to use these rights for you if you die or cannot act yourself
- raise a complaint with us, and then with the Data Protection Board of India
To use any of these rights, write to us through the contact page. We may ask you to confirm the request from the email address you wrote from. We will reply within 30 days, and always within the 90 days the DPDP Rules allow.
Children
Cityfort is meant for adults. The DPDP Act treats anyone under 18 as a child. We do not knowingly collect personal data from children.
If you believe a child has given us their email address, please tell us. We will delete it.
Security
Data travels over encrypted connections (HTTPS). Only the site owner can see analytics, after signing in. The dashboard shows totals; the raw events behind them are deleted after 90 days.
No system is completely secure. If a personal data breach affects you, we will tell you and the Data Protection Board, as the law requires.
Grievance officer
You can contact our grievance officer through the contact page.
If you are not satisfied with our reply, you can complain to the Data Protection Board of India.
Where the law stands
The DPDP Act, 2023 is coming into force in stages. The DPDP Rules, 2025 were notified in November 2025. Most duties for websites like ours apply from May 2027. We follow this policy from launch.
Changes to this policy
We will update this page when our practices or the law change. The date of the latest update is shown here. If we ever start collecting new kinds of personal data, we will say so here before we do.