Legal
Consent notice
Served under Rule 3 of the Digital Personal Data Protection Rules 2025, which requires this notice to be understandable on its own. It therefore repeats what it needs to and refers to nothing. The Privacy Policy says more; it does not replace this, and nothing in it narrows what is written here.
Served independently, as the Rules require
Rule 3(a) requires a consent notice to be presented and understood without reference to any other information. This page is that notice; it is shown at the moment consent is requested and stands alone.
1The Personal Data, Itemised
Each item below is collected for the purpose stated beside it, and for nothing else.
| Personal data | Specified purpose | Retention |
|---|---|---|
| Name, work email address, organisation name, role | To create your account and operate it | Life of the account, then 90 days |
| Password hash, multi-factor secrets | To authenticate you | Life of the account |
| Billing contact, billing address, tax identifier, invoice history | To charge you, and to meet tax and company law duties | 8 financial years |
| Card token, last four digits, brand, expiry | To take payment and prevent fraud. We never see the full card number | Life of the account |
| Request counts, storage and network consumption, agent-hours | To run the service, enforce the limits of your plan, and bill you accurately | 13 months, then aggregated |
| IP address, user agent, authentication events, administrative actions | Security, and the prevention of abuse and fraud | 180 days |
| Support tickets, emails and attachments you send us | To answer you | 3 years from closure |
| Email address, opens, clicks, subscription state | To send you product email, if you ask for it | Until you withdraw, then 3 years |
| Website analytics identifiers | To understand which pages are read. Not collected unless you accept | 2 years |
| Licence identifier, instance identifier, licensed-unit counts, source IP (self-hosted deployments) | To validate your licence and enforce its limits | Licence term plus 12 months; source IP 90 days |
We do not ask for, and do not want, sensitive data about you — health, biometrics, religion, political opinion, sexual orientation, precise location, or any government identifier other than the tax identifier we are required to record.
2What You Get in Return
Minimal turns a database you already run into working API endpoints, MCP tools for AI agents, and permissions scoped to each identity, without you writing integration code. It is delivered either as a hosted service on our cloud in the region you choose — Germany, Finland or India — or as software you install on your own infrastructure.
The data in your own projects is yours. We process it only on your instruction, we do not sell it, and we do not use it to train AI models. On a self-hosted deployment we never receive it at all.
3Three Things You Can Do, Starting Now
Withdraw your consent. Email privacy@littlebit.in. For website analytics, use Cookie settings, which takes effect on the spot. Withdrawal is as easy as consent was; we stop processing for the withdrawn purpose, and anything we must keep by law we tell you about.
Exercise your rights. Email privacy@littlebit.in and say which right you are exercising — a summary of your data and our processing, correction, completion, updating, erasure, or nomination of someone to act for you. We respond within 90 days.
Complain. Our Grievance Officer is Harish S S, harish@littlebit.in, at the address above; complaints may also be sent to grievance@littlebit.in, which reaches the same officer. We respond within 30 days. If you are not satisfied, you may then complain to the Data Protection Board of India, which under s. 13(3) of the Act you may approach after using this route.
4Language
This notice is served in English. You may ask for it in any language listed in the Eighth Schedule to the Constitution of India by writing to privacy@littlebit.in, and we will provide it before asking for your consent.