What we collect, and what we do with it.

Three kinds of thing, and no more than these.

• What you type into a form. Your name, email, phone number if you give one, company, website address, and whatever you write in the message. On a project enquiry, the budget band and timeline you select. We ask for these because we cannot answer an enquiry without them.
• What your browser sends. Pages viewed, how you arrived, approximate location from your IP address, and device and browser type. This is ordinary traffic measurement and it is not tied to your name.
• What a client relationship needs. If you become a client: billing details, the site credentials you give us, correspondence, and the time we log against your work. Payment card numbers never reach us — the gateways hold those.

We do not buy contact lists, we do not scrape them, and we do not enrich what you give us with data bought from anybody else.

• To answer you. An enquiry is a request for a reply, which is the only reason we need your email.
• To do the work. Delivering a project or running a plan needs access, correspondence and a record of the hours.
• To get paid and stay legal. Indian tax law requires invoice records to be kept, and export invoicing requires proof of the receipt.
• To understand which pages work. Traffic measurement in aggregate, so we know which pages to write next.

If you are in the UK, the EU or anywhere else with an equivalent regime, our lawful bases are your consent for optional cookies, contractual necessity for delivering work you have engaged us for, legal obligation for tax records, and legitimate interest for replying to an enquiry you sent us.

We use other companies to run parts of this. Each one only receives what its job needs. The full list:

• Vercel — hosts this website and serves every page you load
• Google — Analytics and Search Console for traffic and search performance, Ads for advertising measurement, and Workspace for our email
• Cloudflare — a spam check on our forms, so a human enquiry reaches us and a bot does not
• TidyCal — the booking calendar, if you book a call
• Razorpay and Stripe — payments, Indian and international respectively. They hold the card details; we see the transaction, not the card
• ZeptoMail (Zoho) — delivers what you type into a form to our own inbox. It carries the enquiry itself, which is the most personal thing on this list
• Neon — the database behind our own client portal, hosted in the cloud

Several of these are outside India, so your data may be processed in the United States and the European Union. We use them under their standard data processing terms. We do not sell your data to anyone and we never will — there is no version of this business where that is the product.

This site sets no cookie of its own. The analytics described above use cookies, and the booking calendar sets its own when you open it. The spam check on our forms does not use a cookie.

The analytics cookie is off until you accept it. Nothing loads before you answer the small panel in the corner, and declining is one click in the same place, at the same size, as accepting. Your answer is remembered in your own browser, not on our server, so it is per-device.

You can change your mind at any time with Cookie choices at the foot of every page. Declining after you have accepted also deletes the analytics cookies rather than only stopping new ones. You can block or delete all of it in your browser settings instead, and every page here will still work — nothing on this site is gated behind accepting a cookie.

• An enquiry that goes nowhere — two years, then deleted. People come back, and starting from scratch wastes your time as well as ours.
• Client records — for the life of the relationship and eight years after it, which is what Indian tax record-keeping requires.
• Site backups — 30 days rolling, and 30 days after a plan ends so you can collect them.
• Credentials you gave us — revoked and deleted when the work ends. Ask us to do it sooner and we will.
• Traffic measurement — retained by the analytics provider under its own schedule, in aggregate and not tied to you.

You can ask us for a copy of what we hold about you, ask us to correct it, ask us to delete it, or tell us to stop emailing you. If you are covered by the UK or EU regimes you can also ask us to restrict or port it, and object to processing based on legitimate interest.

Email hello@ohmyweb.in. We reply within 30 days and usually within two business days, and we do not charge for it. If we cannot delete something — an invoice we are legally required to keep, for instance — we will tell you exactly what and why rather than refusing in general terms.

Complaints go to India’s Data Protection Board, or to your own supervisory authority if you are in the UK or the EU. We would rather you came to us first.

Access to client systems is on named accounts with two-factor authentication, credentials live in a password manager rather than in email, and access is revoked when an engagement ends. Backups are stored off the servers they protect.

No one can promise a breach will never happen, and a policy that says otherwise is not being straight with you. If one affects your data we will tell you what happened, what was exposed and what we are doing, within 72 hours of knowing.

The date at the top is when this version took effect. If we change anything material we will change that date and, for clients, say so in writing. Related documents: the terms of service, the service level agreement and the refund policy.