Who we are
webstoree ("we", "us") is a web design and development studio that operates webstoree.com. For the purposes of India's Digital Personal Data Protection Act, 2023 we are the Data Fiduciary, and for UK and EU data protection law we are the controller, of the personal data described here. You can reach us about anything in this policy at abhay@webstoree.com.
What we collect, and why
We only collect personal data in the situations below. Browsing the site without using any of them shares nothing that identifies you, apart from the technical data every website receives.
- Quote form. Your name, email, business name, what you need and an optional budget. The form opens your own email app with the message filled in, and also records the same details on our server so a request is not lost if you do not press send. Purpose: to reply with a quote.
- Chat assistant. The messages you type. They are sent to our AI provider to generate replies. If you choose to leave your name, phone number, email or business name in the chat, we record those with a summary of the conversation. Purpose: to answer your questions and follow up when you ask us to.
- WhatsApp, email and phone. If you contact us this way, we receive your number or address and whatever you send. WhatsApp is operated by Meta under its own privacy policy.
- Technical data. Your IP address, browser type and the pages you request, which our host processes to serve the site and which we use briefly to stop abuse (rate limiting). We also read the country your request comes from to show the right contact options; it is stored in your browser for that visit only.
- Analytics, only if you accept cookies. Microsoft Clarity and Google Analytics record how pages are used: clicks, scrolling, mouse movement and the pages visited, in pseudonymous form. Clarity masks text you type by default. Purpose: to find what confuses visitors and fix it.
- Client projects. If you hire us, we hold your contact and billing details and whatever you share for the project. Purpose: to deliver the work, invoice it and keep records the law requires.
Our legal basis
Under India's DPDP Act we process your data on the basis of your consent, given when you submit a form, write to us or accept analytics cookies, or for the legitimate uses the Act allows, such as data you share voluntarily for a purpose you asked for.
Under UK and EU GDPR we rely on: steps you ask us to take before a contract (quotes and replies); performance of a contract (client work); legal obligation (tax and accounting records); legitimate interests (keeping the site secure and working); and consent (analytics cookies, which you can withdraw at any time).
Who processes it for us
We do not sell, rent or share your personal data for marketing. We use these service providers to run the site and the business, and they process data only on our instructions:
- Vercel (hosting and server logs, United States).
- Anthropic (the AI model behind the chat assistant, United States). Chat messages are sent to it to produce replies.
- Google (Google Workspace email; Google Analytics if you accept cookies).
- Microsoft (Clarity analytics, if you accept cookies).
- Cloudinary (image delivery) and YouTube (videos embedded in some articles, loaded in privacy-enhanced mode).
- Meta (WhatsApp, only if you message us there).
We may disclose data if the law requires it, or to protect our rights in a dispute.
International transfers
We are based in India, and several of our providers store data in the United States or elsewhere. Where UK or EU data leaves those regions, we rely on the provider's standard contractual clauses or an adequacy decision. Transfers out of India follow the DPDP Act and any restrictions the Government of India notifies.
How long we keep it
- Quote requests and chat leads that do not become projects: up to 24 months, then deleted.
- Server logs: kept by our host for its standard log period, typically days to a few weeks.
- Analytics data: Clarity keeps recordings for about 30 days and aggregates longer; Google Analytics is set to its shortest practical retention.
- Client and billing records: as long as the law requires, which in India is generally up to 8 years for accounting records.
When you withdraw consent or ask us to erase your data, we delete it unless the law requires us to keep it.
Your rights
Wherever you are, you can ask us to tell you what personal data we hold about you, correct it, update it or delete it, and you can withdraw any consent you gave, as easily as you gave it.
- India (DPDP Act). You have the right to access a summary of your data and who it was shared with, to correction, completion, updating and erasure, to grievance redressal, and to nominate another person to exercise your rights if you die or become incapable. If you are not satisfied with our response, you can complain to the Data Protection Board of India.
- UK and EU (GDPR). You also have the rights to restrict or object to processing, and to data portability. You can complain to the UK Information Commissioner's Office (ico.org.uk) or your local EU supervisory authority.
- United States. Residents of states with privacy laws, such as California, can ask to know, delete and correct their data. We do not sell or share personal data for cross-context behavioural advertising, so there is nothing to opt out of, and we will not treat you differently for using your rights.
To use any of these rights, email abhay@webstoree.com. We will reply within 30 days, and may need to confirm your identity first.
Grievance officer
Questions, complaints and requests about your personal data go to our grievance officer, the founder of webstoree, at abhay@webstoree.com. We aim to resolve grievances within 30 days, and in any case within the time the DPDP Rules allow.
Security
Data travels over HTTPS, access to our accounts is limited to the founder and protected with two-factor authentication where the provider supports it, and we keep only what we need. No system is perfectly secure. If a personal data breach affects you, we will tell you and the relevant authority as the law requires.
Children
Our services are for businesses. We do not knowingly collect personal data from anyone under 18. If you believe a child has sent us their data, tell us and we will delete it.
Changes to this policy
If we change what we collect or how we use it, we will update this page and the date at the top. If the change is significant, we will ask for your consent again where the law requires it.