Master Data Protection Version 4.2 • Updated: 2026

Master Privacy Policy

How MD Technologies transparently collects, processes, encrypts, and safeguards personal data, source code, and commercial records across the global MD Colab ecosystem.

1. Zero-Sale Commitment 2. Scope Across Ecosystem 3. Direct Data Collection 4. Automated Telemetry 5. Processing Purposes 6. Cloud Sub-Processors 7. Encryption Standards 8. International Transfers 9. 72-Hr Breach SLA

1. Zero Data-Selling Commitment & Core Principles

Zero Data-Selling Guarantee: MD Colab does NOT sell, rent, monetize, or trade your personal data, developer source code, or private project databases with advertisers or external data brokers.

At MD Technologies, privacy is treated as a fundamental architectural requirement. This Master Privacy Policy outlines the comprehensive protocols governing how your personal data, developer credentials, and commercial identities are managed across all MD Colab platforms.

2. Scope Across MD Colab Ecosystem

This privacy policy applies to all interactions across our interconnected platform services:

MD Workspace & IDE

Browser Monaco editor sandboxes, multiplayer room state, live preview sessions, and repository tokens.

TalentX Creator Directory

Public creator listings, skill endorsements, OrangeTick verification data, and direct message communications.

MD Business & KYC

Corporate registration records, GSTIN certificates, authorized signatory records, and Razorpay Route accounts.

MD DropShip & Supplier

Order routing, buyer shipping details, wholesale SKU pricing, and Razorpay Route settlement payouts.

MD Invoice

GST business identifiers, line item tax calculations, and WhatsApp transaction snapshots.

MD Plus & Cloud Services

High-tier compute allocations, priority bandwidth, cloud storage quotas, and encrypted session archives.

3. Information We Collect Directly from Users

Account Credentials: First name, last name, registered email address, securely salted/hashed passwords, date of birth, and avatar images.
Portfolio & Professional Footprint: Claimed username (e.g. /@username), professional role, biography, skill keywords, GitHub/LinkedIn links, and public showcase projects.
Commercial Tax Data (MD Business): Registered business name, GSTIN number, PAN identifier, business address, and linked Razorpay Route account ID.
Support Inquiries: Ticket transcripts, bug reports, and diagnostic logs submitted via our Support Desk.

4. Automated Telemetry & System Logs

When interacting with our browser sandboxes and APIs, we collect minimal technical telemetry:

IP addresses (used transiently for geolocation and DDoS rate-limiting).
Browser client fingerprints, user agent strings, and viewport dimensions for IDE rendering compatibility.
Client-side JavaScript console error traces and WebContainer build diagnostics.

5. Lawful Bases & Purposes of Processing

Data Category	Purpose of Processing	Lawful Basis (DPDP / GDPR)
Auth Credentials	Authenticating user sessions and granting workspace access	Contractual Necessity
GSTIN & Banking IDs	Executing automated Razorpay Route T+1 settlements	Legal Obligation & Contract
Buyer Shipping Info	Transmitting package details to Delhivery/BlueDart couriers	Contractual Performance
Error Logs	Debugging IDE crashes and optimizing database indexing	Legitimate Interests

6. Authorized Cloud Infrastructure & Sub-Processors

MD Colab relies on enterprise-grade infrastructure providers adhering to SOC-2 and ISO-27001 standards:

Google Cloud Platform (Firebase Firestore): Real-time database hosting, authentication, and secure document storage (Asia-South1 Mumbai region).
Razorpay Software Pvt. Ltd.: Payment gateway and automated Razorpay Route split settlement engine (RBI-regulated).
Cloudinary Ltd.: Secure image CDN hosting for invoice WhatsApp snapshots and portfolio assets.
Vercel Inc. & Netlify: Edge network hosting, serverless functions, and static CDN asset caching.
Google Gemini API (Google Cloud): Large language model inference for Zainin AI and code co-pilot.

7. Cryptographic Standards & Data Security

We employ defense-in-depth protection across all layers:

In-Transit Encryption: All traffic is enforced over TLS 1.3 with HSTS headers and strong cipher suites.
At-Rest Encryption: Cloud databases and snapshot backups are encrypted using AES-256.
Granular Firestore Rules: Server-side security rules ensure users can only access authorized documents and projects.

8. International Data Transfers

While our primary database clusters reside within India (Mumbai region), certain global CDN edge caches or third-party APIs may process data across international server nodes under Standard Contractual Clauses (SCCs).

9. 72-Hour Security Breach Notification SLA

In the unlikely event of a confirmed security incident affecting personal user data, MD Colab will notify affected users and relevant statutory authorities within 72 hours of confirmation, accompanied by technical impact assessments and remediation steps.

Storage & Session Tokens Version 3.0 • Updated: 2026

Cookie & Tracking Technologies Policy

How we utilize essential session tokens, browser LocalStorage, and IndexedDB caching to deliver ultra-low latency developer sandboxes.

1. What Are Cookies & Local Tokens?

Cookies and local storage tokens are small text files stored on your device that enable our browser IDE to remember active file tabs, cursor states, and authenticated login sessions.

2. Strictly Necessary Session Tokens

Firebase Auth JWTs: Cryptographic tokens that maintain your secure login across page reloads without exposing your password.
Workspace State Caches: Storing your active editor tab selection, split screen pane ratios, and open files.
Theme & UI Preferences: Remembering your chosen theme mode and sidebar collapsed/expanded state.

Zero Advertising Trackers: We do NOT employ third-party cross-site advertising cookies, tracking pixels, or third-party behavioral profiling beacons.

3. Browser LocalStorage & IndexedDB Usage

To prevent data loss during network disruptions, MD Colab utilizes browser LocalStorage and IndexedDB to cache your offline project drafts, unposted invoice drafts, and local compiler caches.

Statutory Compliance Version 3.8 • Updated: 2026

Your Global Data Rights (DPDP, GDPR & CCPA)

Comprehensive framework outlining your statutory rights under the Indian DPDP Act 2023, European GDPR, and California CCPA/CPRA regulations.

1. Universal User Rights Matrix

Statutory Right	Description	How to Exercise
Right to Access	Request a full electronic copy of all personal data held about you	Email Data Protection Officer
Right to Portability	Receive your profile, project code, and invoice records in JSON/CSV	Profile Settings Export / DPO Request
Right to Rectification	Update inaccurate name, email, bio, GSTIN, or banking details	Instant edit in Profile Settings
Right to Erasure ("Forget")	Permanently delete your account and all associated personal data	Profile Settings > Delete Account
Right to Restrict Processing	Toggle visibility to Private to immediately delist from search engines	Profile Settings Visibility Toggle

2. Statutory Grievance Redressal (Indian DPDP Act 2023)

In compliance with the Digital Personal Data Protection Act of India, users can submit data grievances directly to our Data Protection Officer. We maintain a strict 30-day resolution SLA for all formal requests.

Official DPO Channel: Email your request with subject "Statutory Data Request" to supportmdcolab@gmail.com.

E-Commerce Data Policy Version 3.2 • Updated: 2026

MD DropShip Customer & Merchant Privacy

Data controller distinctions, buyer shipping information handling, carrier transmission, and 5-year statutory order archiving.

1. Data Controller (Merchant) vs. Data Processor (MD Colab)

In the MD DropShip ecosystem:

The Merchant (Store Owner): Acts as the Data Controller, establishing consumer privacy terms with their retail buyers.
MD Colab: Acts strictly as the Data Processor, executing the technical transmission of shipping details to partnered suppliers and couriers.

2. End-Customer Shipping Data Lifecycle

When a buyer completes a checkout on an MD DropShip store, we securely process:

Buyer Full Name & Contact Phone Number (required for courier delivery coordination).
Shipping Address & Pin Code (transmitted directly to Delhivery/BlueDart dispatch APIs).
Order SKU Items, Quantities, and Transaction IDs.

Zero Marketing Ban: MD Colab will NEVER contact, market, or cross-sell products to your retail buyers. Buyer records are processed solely to fulfill their authorized order.

3. 5-Year GST Statutory Order Archival

To comply with the Indian GST Act and commercial tax regulations, order records, invoice numbers, and payment routing receipts are securely archived for 5 years post-fulfillment before automated cryptographic purging.

Wholesale Privacy Version 3.4 • Updated: 2026

Supplier Platform & Manufacturing Privacy

Confidentiality of wholesale base pricing, bank account vaulting, and customer shipping slip redaction.

1. Wholesale Pricing & Margin Confidentiality

Supplier wholesale base costs, manufacturer inventory margins, and SKU stock volumes are strictly isolated. Competing suppliers on MD DropShip cannot inspect another supplier's internal pricing or fulfillment pipelines.

2. Banking & Razorpay Route Account Security

Supplier bank account numbers, IFSC codes, and settlement schedules submitted during Razorpay Route onboarding are encrypted using bank-grade hardware security modules (HSM) and are never exposed to retail dropshippers.

3. Shipping Slips & Customer PII Protection

Platform-generated courier dispatch slips display only the customer shipping address and contact number required for logistics execution. Suppliers must not scrape, aggregate, or repurpose end-customer contact data for external marketing.

Creator Network Version 3.0 • Updated: 2026

TalentX & Creator Portfolio Data Protection

Masked identity architecture, direct messaging encryption, code review confidentiality, and search visibility controls.

1. Public vs. Private Creator Identity

Publicly Searchable

Display Name, @username, Bio, Verified Skills, Hourly Rate, Availability Status, and Public Showcase Projects.

Strictly Private

Personal phone number, email address, direct chat message histories, and draft repository sandboxes.

2. Masked Email & Phone Architecture

To protect creators from spam, harassment, and unsolicited telemarketing, email addresses and phone numbers are never displayed in the search directory. Initial client inquiries occur securely via the internal TalentX Direct Chat.

3. OrangeTick Portfolio Code Reviews & NDA Standards

When a creator submits project repositories for OrangeTick VPC verification, our engineering reviewers treat all submitted codebases under strict internal non-disclosure agreements.

Corporate KYC Security Version 3.0 • Updated: 2026

MD Business KYC & Banking Data Security

Handling of corporate GSTIN certificates, PAN tax documentation, multi-account tokens, and financial audit trails.

1. Corporate KYC Certificate Vaulting

GST certificates, PAN verification proofs, and authorized signatory identification documents uploaded during MD Business onboarding are stored in encrypted cloud vaults with role-based access limited exclusively to compliance officers.

2. Multi-Account Switcher Token Isolation

The multi-account switcher isolates entity session tokens, preventing cross-organization data leakage when an entrepreneur manages multiple corporate entities under one master login.

Machine Learning Version 2.9 • Updated: 2026

Zainin AI & LLM Data Processing Safeguards

Zero foundational model training on private codebases, ephemeral memory processing, and enterprise API boundaries.

1. Ephemeral Context Processing

Code prompts, syntax refactoring requests, and document drafts submitted to Zainin AI or MD Co-Pilot are processed in transient memory solely to return your immediate answer.

Zero Model Training Guarantee: Your private source code repositories and proprietary documents are NEVER used to train or fine-tune public foundational AI models.

2. Enterprise API Boundaries (Google Gemini 2.5 Flash)

Our AI integrations operate under Google Cloud Enterprise terms, ensuring zero data retention on upstream AI server clusters following prompt completion.

Storage Limitations Version 3.1 • Updated: 2026

Data Retention Schedules & Destruction Matrix

Exact timelines governing how long specific data categories are retained before automated cryptographic deletion.

1. Data Retention Matrix

Data Type	Retention Duration	Destruction Method
Active User Accounts	Duration of active account lifecycle	Instant deletion upon user request
GST Invoices & Orders	5 Years (Statutory Indian Tax Act)	Automated database purge
Multiplayer Room Drafts	30 Days of inactivity	Temporary container cleanup
Server Access Logs	90 Days	Cryptographic overwriting
AI Ephemeral Prompts	0 Days (Transient Memory)	Immediate process flush

Governance & DPO Version 3.5 • Updated: 2026

Data Protection Officer & Security Triage

Direct escalation channels to our privacy legal team and 24/7 technical incident response desk.

Official Privacy Escalation Channels

If you wish to submit a data subject access request (DSAR), report a privacy concern, or contact our Data Protection Officer:

Data Protection Officer

supportmdcolab@gmail.com

Official response within 24-48 business hours.

Emergency Security WhatsApp

+91 8082587203

Mon - Sat, 9:00 AM - 8:00 PM IST.

Physical Mailing & Corporate Office

MD Technologies Legal Operations
Attn: Data Protection & Privacy Office
New Delhi, India
Official Support Portal: MD Support Center