Privacy
Last updated 18 September 2026. This describes what actually happens, not what we intend to build. If you find a difference between this page and the site, that is a bug: tell us and we fix the site or fix this page.
The short version. You can use the whole map without telling us anything. There is no login, no account, and no advertising tracker. This site sets no cookies at all. We count how many people open each page, and what gets tapped on it, with a counter we run ourselves, which stores nothing in your browser and never keeps your IP address. We only hold personal data if you choose to send it: an order, a correction, a salary row, or an email for the brief. We do not sell it and we never will.
What we collect, and only when you give it
| What | When | Why | How long |
|---|---|---|---|
| Name, email, phone, company, and the UPI transaction reference (UTR) if you give it | You buy something or ask for a quote | To match your payment, to deliver what you bought, to invoice you, and to answer you about it | Eight years for anything with money attached, because income tax law requires the record |
| Email address | You join the Bombay Brief or ask for the first cut of the salary index | To send you that and nothing else | Until you ask us to take it off, then deleted. Every send will carry a way off the list |
| Email address, and the company, area, sector, station or line you asked to watch | You press Watch on one of those pages | To email you when a role is posted for that one thing, and nothing else | Until you ask us to take it off, then deleted |
| What you sent through a correction, claim or add form | You submit that form | To check the change and publish it | Until the change is made, then the queue entry is cleared |
| A salary row: employer, area, function, level, role, years, pay, work mode | You add your salary | To build the index | Indefinitely, as an anonymous row |
| Which job link was clicked, and which area, rent and commute a search used | You click an apply link or run the moving search | To count what is used and to tell an advertiser how their slot performed | Indefinitely, with no identifier attached to it |
| Which page was opened, the name of the site that linked to it, the campaign tag if the link carried one, the country the connection comes from, whether it is a phone, tablet or computer, and the hour of the day. Then, on the page, a fixed list of things you do: what you tap, what you search for, how far you scroll and roughly how long you stay. All of it filed under a visit code that changes every day | You open or use a page, unless your browser sends Do Not Track or Global Privacy Control | To know how many people use the site, which pages help them and where it fails them | Row level for thirteen months (395 days), daily totals after that. No name, no IP address and no browser details are stored. How it works |
The salary index is genuinely anonymous, and here is the mechanism
Your pay row is stored with no name and no email on it. If you give an email so we can send you the first cut, it is written to a completely separate table, never on the pay row, and we do not match the two. The pay row keeps only the month it arrived and the address only the day, so they cannot be lined up by time. We do not store your IP address against either. A single row is never published on its own, and no company is named until enough rows exist that no individual can be picked out of them.
One thing to check before you contribute: many Indian offer letters treat pay as confidential. If yours does, please do not add a row. We would rather have a smaller index than cause anyone a problem at work.
What we do not collect
- No card or bank details, ever. Payment is a UPI transfer you make in your own banking app. Nothing about your card, account or UPI PIN reaches this site or this database.
- No advertising or cross site tracking. No advertising pixels, no remarketing, no data brokers, no profiles.
- No accounts and no passwords, because there is nothing to log in to.
- No personal data in the company listings. The directory describes companies, not people. No director name, no employee name, no personal email and no personal phone number goes into the dataset or into anything we sell. That is a hard rule in how the product is built, not a preference.
Where the company listings come from
Of the 598 company records on the map today, 366 come from third party business data enrichment, 124 from the company's own website, 37 from OpenStreetMap and 8 from another primary source. 63 have no source recorded against them. Every row carries a pin precision marker, shown on its listing, and the 130 rows we have confirmed against a primary source are marked Source checked. This is not a copy of any government register, and revenue figures are third party estimates, not filed or audited numbers. If a listing about your company is wrong, write to us and it is corrected or removed. See the terms for that route.
Who else can see anything
We do not sell personal data, we do not share it for advertising, and we do not transfer it to anyone for their own purposes. These are the only companies that handle any of it, each doing one job for us:
| Who | What they do | What they see |
|---|---|---|
| Tencent EdgeOne | Hosts the site | Standard web request logs, including your IP address, as any host does |
| Cloudflare | Runs the small backend that stores orders, salary rows and subscriptions, counts visits and what is tapped, and serves the live job list, and serves the map library | Your IP address when the page calls the backend. The counter uses it for a moment to make a daily code and never stores it |
| OpenFreeMap and OpenStreetMap | Serve the map tiles | Your IP address while the map loads |
| Komoot (Photon) | Suggests an address, only if you type into the address box | What you typed and your IP address |
| The companies' own hiring systems | Return their live job lists to your browser | Your IP address when their board is read |
| Resend | Sends the emails we send you | Your email address and the message |
We disclose personal data to anyone else only where the law compels it, and we will tell you if that ever happens unless we are forbidden from doing so.
Analytics
One counter, and we built it. Since 17 September 2026 the site counts page visits on our own backend, and since 18 September 2026 it also counts a fixed list of things people do on a page. It sets no cookie, writes nothing to your browser and loads no third party script. There is no Google Analytics, no Meta pixel and no advertising tag. Everything below is the whole of it.
What is sent when a page opens
Your browser tells our backend which page it was, the name of the website that linked you here, and, if the link names one, the company, area, sector, station line, view or commute it opens. If you came through a campaign link, the campaign tag written into that link is counted too: the newsletter, post or partner it came from, which describes the link and not you. Nothing else is sent. Free text that does not look like one of our pages, such as a mistyped address, is stored as "other".
The backend adds three things of its own: the country the connection comes from, whether it is a phone, tablet or computer, and the hour of the day, counted in UTC. The hour is kept on its own, as a tally of how many pages were opened in each hour, with no visit code beside it, so we can see the shape of a day without following anyone through it.
The visit code
To count people rather than page loads, the backend makes a visit code by mixing your IP address and your browser's identifying text with a random value that exists for one day. Your IP address and browser text are used for that moment and never stored, and no request log is kept.
The random value is deleted within fifteen minutes of its day ending. From then on a code cannot be recreated, so no visit can be connected to another day or back to a person. It also means there is no count of returning visitors: the same person on two days is two codes, and nothing joins them. While the day lasts, a code could only be matched to you by someone with access to our database who already had your exact IP address and browser details, and we do not do that. Our database provider keeps automatic recovery copies for up to 30 days; we use them only to recover from a failure, never to look at visits.
What you do on the page
The page also counts a short list of actions. The list is fixed in the code and the backend refuses any name that is not on it, which is what lets this page name every kind of record that can exist:
- opening the map, opening a company, opening that company's jobs, and following an apply link, with the company and the hiring board it leads to;
- what you typed into the search box, and separately the searches that came back with nothing, because those are the gaps worth filling;
- which filter you pressed: a sector, an area or a railway line;
- running the commute search, starting or finishing a salary row, asking to watch a company, opening the export panel, pressing share, and starting or paying for an order, with what was bought;
- how far down the page you reached, as one of 25, 50, 75 or 100 per cent;
- how long you stayed, in four bands: under ten seconds, ten to thirty seconds, thirty seconds to two minutes, or longer.
Each one is stored as that name, at most one short label, and a count that stops at fifty, under the same daily visit code. The label is cut to forty characters, and a label holding an @ sign or a run of six or more digits is thrown away whole rather than trimmed, so an email address or a phone number typed into a search box is never stored. No row carries a clock time, a name, a sequence, or the page the action happened on. Within one day the actions under one visit code are counted together, which is how we see where people give up; there is no order and no timing in them, and once that day's random value is deleted the code cannot be tied to another day or back to a person.
The promises that hold
- If your browser sends Do Not Track or Global Privacy Control, the page sends nothing and the backend refuses anything that does arrive. You are not counted at all.
- Nothing is written to your device for any of this: no cookie, no browser storage, nothing to clear.
- Your IP address and your browser string are never stored, and nothing personal goes into any value: not a name, not an email address, not a phone number.
- No profile is built, and nothing is kept that could become one. These rows are joined to each other, within one day, and to nothing else: not to a person, not to an email address, not to an order.
- The page visits, the actions and the hourly tally are each kept row by row for thirteen months (395 days) and then deleted, leaving the daily totals: how many visits and how many page views, per day.
- They are never sold, never shared and never used for advertising. They are read by one person, on a page behind the admin token described below.
What we store in your browser
No cookies. Some settings and drafts are kept in your own browser's local storage, where they stay on your device and are never sent to us. The visit counter uses none of it. The full list, and how to clear it, is on the cookies and storage page.
How it is kept safe
The whole site is served over HTTPS. Personal data sits in one database behind an admin token that one person holds, and that person is Kaavish Ramchandani. Nobody else has access. We receive no card data, no bank credentials and no government identity numbers, so none of that can leak from here. There is no third party with a copy of the database.
If a breach ever affects your data, we will email everyone affected and say plainly what happened, what was exposed and what to do about it. We will not wait for a regulator to make us.
Your rights, and how to use them
Write to connect@mask360.agency and you can:
- ask what we hold about you, and get a copy;
- have anything corrected;
- have it deleted;
- withdraw consent for anything you agreed to, including the brief;
- complain about how we handled any of the above.
We act within thirty days, and usually the same week. Two honest limits. Financial records we are legally required to keep, we keep. And a salary row already stored without your name or email cannot be found again in order to delete it, because that is exactly what anonymous means: tell us within seven days of adding it and we can remove the most recent matching row, after which it is genuinely untraceable.
Children
This site is built for people looking for work and for companies buying advertising. It is not directed at children and we do not knowingly collect data from anyone under eighteen. If you believe we have, write to us and it is deleted.
The law this follows
This policy is published under rule 4 of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011, made under section 43A of the Information Technology Act 2000, which is the law that binds us today.
India's Digital Personal Data Protection Act 2023 is not yet in force for operators like us. Its rules were notified on 13 November 2025 and the substantive duties on notice, consent, retention, erasure and breach reporting commence on 13 May 2027. We have written this page to meet that standard now rather than on the deadline. When those duties commence, and when the Data Protection Board is operating, this page will name the complaint route to it.
The site is aimed at people in India and priced in rupees. We do not target anyone in the European Union or the United Kingdom, and we do not profile anyone there or anywhere else: the visit counter cannot follow a person from one day to the next. For those reasons we do not believe the GDPR or the UK regime applies. If you are outside India and want your data removed anyway, ask and we will remove it.
Changes
If this policy changes in any way that matters, the date at the top changes and anyone on the brief is told by email. We do not make quiet changes.
Who runs this
The Bombay Data Company is a service of Mask Management, a sole proprietorship of Kaavish Ramchandani. Mumbai, Maharashtra, India. The full correspondence address is on every invoice and is sent on request to the email above.
Email connect@mask360.agency. WhatsApp +91 85917 50510. These reach the same person.
Mask Management is not registered under GST. Turnover is below the threshold in section 22 of the Central Goods and Services Tax Act 2017, so no tax is charged on anything sold here, no tax is collected, and no tax invoice is issued. You get a plain numbered invoice. If you need a PAN for tax deducted at source, ask and we send it.
Grievance officer
Kaavish Ramchandani, Grievance Officer and nodal person of contact, Mask Management, Mumbai, Maharashtra, India.
Email connect@mask360.agency. WhatsApp +91 85917 50510.
Write to that address about anything on this site: a wrong listing, a refund, an advertisement, your own data, or a complaint about how we handled something. Every complaint is acknowledged within forty eight hours and resolved within one month. If a complaint needs longer we say so, in writing, before the month is up, and tell you why.
This satisfies rule 5(9) of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011 and rules 4(3), 4(5) and 4(6) of the Consumer Protection (E-Commerce) Rules 2020.
Back to the map