Privacy Policy
Last updated: October 2026
This policy is written to comply with India's Digital Personal Data Protection Act, 2023 (DPDP Act).
1. Who we are
This website is operated by Ishant Dubey, a sole proprietor based in Bhopal, Madhya Pradesh 462011, India. In this policy "we", "us" and "our" refer to Ishant Dubey. Under the DPDP Act we act as the Data Fiduciary for the personal data described below, and you are the Data Principal.
2. What personal data we collect
| Category | Examples | How it is collected |
|---|---|---|
| Contact data | Name, email address, phone/WhatsApp number, company name | You submit it in a form, WhatsApp message, or email |
| Enquiry data | Monthly ad budget range, services you need, website URL, your message | You submit it in an enquiry or audit-request form |
| Usage data | Pages viewed, referrer, time on page, scroll depth, clicks, approximate city, device and browser type | Collected automatically by analytics (only after you accept cookies) |
| Technical data | IP address, timestamps, security and error logs | Collected automatically by our server and CDN for security |
| Connected-account data | Ad, analytics, search, Business Profile, YouTube, Facebook Page and Instagram data from accounts you choose to connect | You connect them yourself on our Connect page (see section 6) |
We do not knowingly collect financial account numbers, government ID numbers, health data, or any data from children under 18. Please do not send such data to us.
3. Why we use it, and our legal basis
| Purpose | Data used | Basis under DPDP Act |
|---|---|---|
| Replying to your enquiry and preparing a proposal or audit | Contact + enquiry data | Your consent, given when you submit the form |
| Delivering a service you have engaged us for | Contact + enquiry data | Performance of our contract with you |
| Sending a requested guide, checklist or report | Email address | Your consent |
| Preparing an audit or reports from accounts you connect | Connected-account data | Your consent, given on Google's or Facebook's own consent screen |
| Understanding how the website performs | Usage data | Your consent via the cookie banner |
| Preventing spam, fraud and abuse; keeping the site online | Technical data | Legitimate use for security |
We do not sell your personal data. We do not rent or trade contact lists. We do not use your data to train any machine-learning model.
4. Cookies and tracking
Analytics and advertising cookies are set to denied by default. Nothing beyond strictly necessary storage runs until you press Accept on the cookie banner. This is implemented using Google Consent Mode v2.
| Cookie / storage | Purpose | Runs before consent? |
|---|---|---|
cc_consent (local storage) | Remembers your cookie choice so you are not asked again | Yes — strictly necessary |
| Google Analytics 4 | Aggregate traffic and conversion reporting | No |
| Microsoft Clarity | Anonymised heatmaps and session replay, used to find UX problems | No |
| Our first-party analytics | Page views and form events on our own domain | No |
| Google Ads | Measuring which ads produce enquiries | No |
To withdraw consent: clear this site's data in your browser settings, or email us at [email protected]. The banner will appear again and your previous choice is discarded.
5. Who we share it with
We share personal data only with processors that help us run this business, and only as far as needed:
- Google (Analytics, Ads) — website and campaign measurement
- Microsoft (Clarity) — behaviour analytics
- Meta — measuring ad performance, where you arrived from a Facebook or Instagram ad
- Razorpay — payment processing where you purchase a paid product. Card details go directly to Razorpay; we never see or store them
- Our email, hosting and workflow providers — storing and routing your enquiry to us
We may also disclose data where required by Indian law, a court order, or a lawful government request. Some of these providers process data on servers outside India; where that happens, transfers are made under the provider's standard contractual protections.
6. Connected accounts (Google & Meta)
On our Connect page you can give us access to your own marketing accounts so that audits and reports come straight from the source. You sign in on Google's or Facebook's own screen and choose exactly which accounts to share. We never see or store your password.
| Service | What we can access | Why |
|---|---|---|
| Google Ads | Campaign settings, spend and performance. Google offers only one Ads permission, and it also allows changes | Audits and reporting. We change something only after you have approved it |
| Google Analytics (GA4) | Traffic and conversion reports, read-only | Audits and reporting |
| Google Search Console | Search clicks, impressions and rankings, read-only | SEO audits and reporting |
| Google Tag Manager | Free audit: read-only. Clients who hire us for tracking: editing and publishing tags | Checking, and for clients installing, the tracking tags you asked for |
| Google Business Profile | Your listing, reviews and call/direction statistics. Google offers no read-only option | Local reporting. We change nothing without your approval |
| YouTube | Channel details, views, watch time and audience, read-only | Video reporting |
| Facebook Pages | The Pages and business portfolios you select, and the posts, engagement and insights of those Pages | Social media reporting |
| Profile, posts and insights of the professional accounts you select | Social media reporting | |
| Your sign-in identity | Your name and email address on Google or Facebook | To know which login was connected and to contact you about it |
How we use it. Only to prepare the audit or reports you asked for and, for clients, to carry out work you have approved. We do not sell it, do not use it for advertising or to build profiles of you, do not share it except with the processors in section 5 where strictly needed, and do not use it to train any AI or machine-learning model.
Google API data. Ishant Dubey's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
How it is stored. The access that Google or Meta issues to us is kept on our own server, in files that only our system can read. It is never sent by email or chat. Data pulled from your accounts is used inside our reporting tools and in the reports we send you.
Removing our access. You can do this yourself at any time, and it stops working immediately:
- Google: myaccount.google.com/permissions → "Ishant Dubey" → Remove access
- Facebook & Instagram: Facebook → Settings & privacy → Settings → Business integrations → "Ishant Dubey Connect" → Remove
Deleting the data we hold. Email [email protected] with the subject "Delete connected data" and the Google or Facebook account you connected. Within 30 days we delete the stored access and the data we pulled from your accounts, and confirm by email. We also delete them within 30 days after an engagement ends.
7. How long we keep it
| Data | Retention |
|---|---|
| Enquiry that did not become a client | 24 months from last contact, then deleted |
| Client records and correspondence | Duration of engagement + 8 years (Indian tax and accounting requirements) |
| Email subscribers | Until you unsubscribe, then removed within 30 days |
| Analytics data | 14 months (Google Analytics default), then auto-deleted |
| Server security logs | 90 days |
| Connected-account access and data | While you stay connected; deleted within 30 days of your request or of the engagement ending (see section 6) |
8. Your rights as a Data Principal
Under the DPDP Act you have the right to:
- Access — get a summary of the personal data we hold about you and who we shared it with
- Correction and completion — have inaccurate or incomplete data fixed
- Erasure — have your data deleted, unless we must keep it by law
- Withdraw consent — as easily as you gave it (see section 4)
- Grievance redressal — raise a complaint with us and get a response
- Nominate — nominate another person to exercise these rights in the event of your death or incapacity
To exercise any of these, email [email protected] with the subject line "DPDP request". We respond within 30 days. There is no fee. We may ask you to confirm your identity before acting, to make sure we do not disclose your data to someone else.
9. Grievance Officer
If you are unhappy with how we handled your data or your request, contact our Grievance Officer:
Ishant Dubey, Grievance Officer, Bhopal, Madhya Pradesh 462011
Email: [email protected]
Phone: +91 87708 00440
Response time: within 30 days of receipt
If you remain dissatisfied, you may escalate your complaint to the Data Protection Board of India.
10. Security
The site is served over HTTPS with HSTS. Access to enquiry data is restricted to the proprietor. No system is perfectly secure — if a personal data breach occurs that affects you, we will notify you and the Data Protection Board as required by the DPDP Act.
11. Changes to this policy
If we change this policy materially, we will update the "Last updated" date above and, where the change affects how we use data you already gave us, notify you by email.
12. Contact
Ishant Dubey, Bhopal, Madhya Pradesh 462011, India · [email protected] · +91 87708 00440