This Privacy Policy explains how DevStackIO collects, uses, shares and protects personal data when you visit https://www.devstackio.com/ (the “Site”). It is written in plain language and covers the requirements of the EU General Data Protection Regulation (GDPR), the UK GDPR and Data Protection Act 2018, the ePrivacy rules where they apply, the California Consumer Privacy Act as amended by the CPRA, other US state privacy laws, and India’s Digital Personal Data Protection Act 2023 and Digital Personal Data Protection Rules 2025.
Last updated: 5 October 2026. Effective date: 5 October 2026.
1. Who is responsible for your data
DevStackIO is an independent technology publication. It is operated by a single publisher, who acts as the data controller (the “Publisher”, “we”, “us”).
| Data controller | Vinod Kumar Rodda, operating as DevStackIO |
|---|---|
| Place of establishment | Hyderabad, Telangana, India |
| Privacy contact | [email protected] |
| Data Protection Officer / Grievance Officer | Not separately appointed. Data protection enquiries and grievance handling are handled by the Publisher at [email protected], which is also the notice address required under section 5(5) of the DPDP Act, 2023. |
| EU and UK representatives | Where GDPR Article 27 or the UK GDPR requires a representative, enquiries may be made to [email protected] and will be routed to the appointed representative. Where no representative is currently required, this is because our processing is occasional and does not meet the Article 27(2) threshold; we will appoint a representative before that ceases to be accurate. |
| Data Protection Officer (GDPR Article 37) | Not appointed, because our core activities do not consist of processing operations that require regular and systematic monitoring of data subjects on a large scale, nor large-scale processing of special category data. |
This policy applies only to the Site. tools.devstackio.com is a separate service with its own legal documentation at tools.devstackio.com/privacy.
2. What we collect
2.1 Information you give us directly
- Comments on articles. When you post a comment, WordPress records the content you submit, your display name, the email address you enter, the website URL you enter if you supply one, and the IP address and browser user agent string captured with the request. An anonymised hash derived from your email address may be passed to Gravatar (operated by Automattic Inc.) to check whether you have a Gravatar profile. If the hash matches, your Gravatar profile image is shown next to your comment.
- Email. If you email us, we hold your email address, the contents of your message and any attachments you send.
- Requests and complaints. Copyright notices, correction reports, privacy requests and security reports are stored with your contact details so that we can act on them and retain a record of the outcome.
You are never required to provide personal data to read the Site. Analytics and non-essential cookies are not set unless you consent, as described in the Cookie Policy.
2.2 Information collected automatically when you browse
Because you interact with a website over the internet, some technical data is produced without you actively submitting it:
- your IP address, which Cloudflare, Inc. processes at the network edge for delivery, security and abuse prevention;
- browser type and version, operating system, language, screen resolution and viewport size;
- the referring page, the pages you visit, and the date and time of the request;
- request headers, response status codes and latency measurements;
- any site search term you type, so the search results can be returned to you.
Where this data is gathered from your device or your browser rather than from you directly, GDPR Article 14 is the relevant basis for this notice.
2.3 Information we do not collect
We do not ask for payment details, we do not require an account to read articles, we do not sell or rent personal data, and we do not build advertising profiles. We do not collect special category data under GDPR Article 9, or sensitive personal information under the California Consumer Privacy Act.
3. Why we process data, and the lawful basis
| Purpose | Data | GDPR Article 6 basis |
|---|---|---|
| Delivering pages, comments and search results | Technical request data; comment content | Article 6(1)(f) legitimate interests — operating and securing the Site. Consent under Article 6(1)(a) where required for comment and cookie storage in the EEA and UK. |
| Cloudflare content delivery, DDoS protection, WAF and rate limiting | IP address, request metadata | Article 6(1)(f) legitimate interests — network security and availability. |
| Website analytics (Google Analytics 4) | Client ID, page views, device and coarse location | Article 6(1)(a) consent, obtained through the cookie banner. Analytics does not run for visitors who decline. |
| Remembering your cookie consent choice | Consent record | Article 6(1)(c) legal obligation under ePrivacy rules, and Article 6(1)(f). |
| Responding to email, correction, copyright and privacy requests | Name, email address, message content | Article 6(1)(f) legitimate interests; Article 6(1)(c) where a legal obligation applies, such as 17 U.S.C. 512(c) record-keeping. |
| Site backups and disaster recovery | Site content including published comments | Article 6(1)(f) legitimate interests — availability and integrity of the Site. |
Under India’s DPDP Act, 2023, we process personal data of visitors in India for the purposes set out above. Where consent is the basis, you may withdraw it as easily as you gave it, using the consent panel in the site footer at any time.
4. Who we share data with
We do not sell or rent personal data. We share the minimum necessary with the following providers, each of which processes data on our instructions under a written agreement:
| Provider | Purpose | Location |
|---|---|---|
| Cloudflare, Inc. | Content delivery network, DNS, web application firewall, DDoS mitigation, bot and abuse controls | Global; US headquarters |
| Google LLC (Google Analytics 4) | Audience and usage measurement, only with consent | Global; US headquarters |
| Automattic Inc. (Gravatar) | Profile image lookup for commenters | United States |
| Our hosting and email providers | Site hosting, database and transactional email delivery | United States and/or other locations |
| Our managed security and backup providers | Firewalling, malware scanning, site backups | United States and/or other locations |
Because the Site has no advertising, we do not use Google AdSense or any advertising network, and we do not disclose personal data for cross-context behavioural advertising. We have not sold or shared personal data in the 12 months preceding the date of this policy.
5. International data transfers
DevStackIO is established in India. Some providers listed in section 4 are established in or route traffic through the United States and other third countries, so personal data may be processed outside your country of residence, including in the EEA and the UK.
Where personal data leaves the EEA or the UK, we rely on a lawful transfer mechanism:
- the EU–US Data Privacy Framework adequacy decision for providers that are certified under it, including Google LLC;
- the UK Extension to that framework for transfers subject to UK GDPR;
- Standard Contractual Clauses adopted by the European Commission (Decision (EU) 2021/914), together with the UK International Data Transfer Addendum, where the framework in the first two points does not apply;
- the India–EU and India–UK adequacy decisions, which the European Commission and the UK respectively have adopted for personal data transferred from those jurisdictions to India under applicable conditions.
Information about the EU–US Data Privacy Framework is published by the U.S. Department of Commerce, Justice and Data Protection. Where a transfer relies on Standard Contractual Clauses, you may request a copy of the relevant clauses by emailing us.
6. How long we keep data
| Data | Retention period |
|---|---|
| Cloudflare network and security logs | 30 days rolling |
| Google Analytics 4 identifiers and events | 14 months (Google Analytics default) |
| Cookie consent record | 12 months from your last change, then renewed consent is requested |
| Approved comments and their metadata | Retained while the comment is published, and afterwards for a short moderation period, unless we need to retain it to evidence a dispute |
| Rejected spam comments | Deleted after 30 days |
| Email correspondence | 24 months from the last reply |
| Copyright and DMCA notices and correspondence | 3 years, to meet the record-keeping expectation for 17 U.S.C. 512 |
| Privacy and data subject requests | 3 years from closure |
| Site backups | Rolling 30-day window; backups containing a deletion are purged within 30 days of that deletion |
| Security incident records | 2 years |
7. Your rights
7.1 European Union and United Kingdom
You have the right to:
- obtain confirmation of whether we process your personal data and access a copy (Article 15);
- have inaccurate data rectified (Article 16);
- have data erased (Article 17);
- restrict processing (Article 18);
- receive your data in a portable, machine-readable format (Article 20);
- object to processing based on legitimate interests, and to direct marketing at any time (Article 21);
- withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal (Article 7(3));
- lodge a complaint with your national supervisory authority — in the EU, the authority for your place of residence or place of work; in the UK, the Information Commissioner’s Office at ico.org.uk.
We do not carry out automated decision-making within the meaning of GDPR Article 22, and we do not profile you.
7.2 California and other US states
If you are a resident of California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Maryland, Minnesota, Kentucky, Rhode Island or the District of Columbia, you have the right to:
- Know / access the categories of personal data we collect, the specific pieces we hold about you, the sources, the purposes, and the categories of recipients;
- Delete personal data we hold about you, subject to the statutory exceptions;
- Correct inaccurate personal data;
- Opt out of sale or sharing for cross-context behavioural advertising. We do not sell or share personal data, so there is nothing to opt out of;
- Limit the use and disclosure of sensitive personal information — we do not collect sensitive personal information in the sense of those laws;
- Non-discrimination for exercising any of these rights. We will not deny you access to the Site, or charge you a different price, because you have exercised a privacy right.
Opt-out preference signals. We recognise the Global Privacy Control (GPC) and similar opt-out preference signals. Because we do not sell or share personal data for targeted advertising, these signals do not change how the Site behaves, and we treat them as a request to keep all non-essential cookies and analytics disabled.
7.3 India
If you are a Data Principal in India under the DPDP Act, 2023, you have the right to access information about the personal data we hold about you, to seek correction or erasure, and to nominate another person to exercise these rights on your behalf. Grievances may be raised at [email protected]. We respond to requests within 30 days under the GDPR and UK GDPR, and within 90 days as required by the DPDP Rules, 2025.
We do not sell or rent personal data, and we do not process personal data for the purpose of targeted advertising, so the “notice and consent” provisions of the DPDP Act are not engaged beyond analytics consent.
7.4 How to exercise your rights
Email [email protected] with the subject line “Privacy request”. Tell us which right you wish to exercise and which article or comment you are asking about. We may ask for enough information to verify that you are the person making the request. We do not charge a fee for standard requests, and we do not apply a fee that discourages you from exercising a right. We respond to access and deletion requests within 45 days, extendable to 90 days for complex requests with notice.
8. Cookies
The Site sets no non-essential cookie until you agree to one. You can accept, reject or change your choice at any time from the cookie consent panel linked in the Site footer, or by clearing cookies in your browser. Blocking strictly necessary cookies may affect comment posting and consent remembering. Full detail is on the Cookie Policy.
9. How we protect data
- All traffic is served over HTTPS with HTTP Strict Transport Security.
- Cloudflare provides DDoS mitigation, a web application firewall and bot protection at the network edge.
- Wordfence provides host-level firewalling and malware scanning.
- The database is not publicly reachable; only the WordPress application layer and the published pages are exposed.
- We minimise collection. We do not require an account, we do not require a contact form to read content, and analytics is opt-in.
- Access to the Site’s hosting and administration is limited to the Publisher and protected with multi-factor authentication and SSH key authentication.
No method of transmission or storage is completely secure. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours of becoming aware of it, as required by GDPR Article 33, and will notify affected individuals where Article 34 requires it. Where a breach affects data of Data Principals in India, we will notify the Data Protection Board of India and the affected individuals as required by the DPDP Act, 2023.
10. Children’s privacy
The Site is a general-audience technology publication and is not directed at children under 13. We do not knowingly collect personal data from children. Comment posting is not intended for children, and we do not knowingly accept submissions from children; if we learn that a comment came from a child, we remove it. If you believe a child has provided personal data to us, email [email protected] and we will delete it.
11. Your choices and controls
- Withdraw analytics consent at any time through the cookie panel in the footer.
- Manage or delete cookies in your browser settings.
- Stop receiving RSS or Atom feed updates by using your reader’s unsubscribe or filtering function. Feeds do not set advertising cookies.
- Do not post a comment, or ask us to delete one, to object to its content.
12. Changes to this policy
We update this policy when our processing changes or when the law requires it. Material changes are posted here with a revised “Last updated” date, and we will draw attention to significant changes on the Site. Your previous consent record is retained where a change is required by law. Previous versions are available on request.
13. Contact and complaints
DevStackIO, Hyderabad, Telangana, India. Email [email protected].
If you are unsatisfied with our response, you may complain to your data protection authority. In the EU, this is the supervisory authority in the Member State of your residence, place of work, or the place of the alleged infringement. In the UK, it is the Information Commissioner’s Office (ico.org.uk). In California, complaints about data practices can be filed with the California Privacy Protection Agency (cppa.ca.gov) or with the Attorney General of California (oag.ca.gov/privacy/ccpa). In India, complaints may be filed with the Data Protection Board of India once constituted. We would always prefer to hear from you directly first.