Privacy Policy
How Waftr collects, uses and protects personal data on waftr.com and in client work: what you type into our forms, analytics data after consent, booking details and the account access a project needs.
Who we are
This policy covers the personal data we handle on waftr.com, in enquiries and call bookings, and in client engagements. Shuruthi Sellamuthu, founder, is responsible for how Waftr handles personal data, and questions reach her at hello@waftr.com.
Our role depends on whose data it is
| Situation | GDPR and UK GDPR | CCPA | DPDP Act |
|---|---|---|---|
| You browse waftr.com, fill in a form or book a call | Controller | Business | Data Fiduciary |
| We work inside a client's GA4, Tag Manager, consent platform or Google Ads | Processor | Service provider | Data Processor |
For our own site visitors and enquiries, Waftr decides why and how personal data is used, and this policy applies in full. In client work the client makes those decisions and stays responsible for the privacy notice and consent that cover its own visitors; we handle that data only on the client's instructions, within the limits in section 05.
What we collect
The table lists each kind of personal data we hold, where it comes from, why we hold it and the legal basis we rely on under the GDPR and UK GDPR.
| Data | Source | Purpose | Legal basis |
|---|---|---|---|
| Name, work email, website, message | Contact form | Reply to your enquiry and prepare a proposal | Steps you asked for before a contract; our legitimate interest in answering business enquiries |
| Campaign details: UTM tags and Google click ID (gclid) from the page address, plus your GA4 client ID if you accepted analytics cookies | Hidden fields in the contact form | Record which campaign or search brought your enquiry, so it is not filed as Direct | Our legitimate interest in knowing which marketing reaches business buyers; consent for the GA4 client ID |
| Website URL and work email | Tracking Scan form | Run the 8 public checks and email you the report | Providing the service you requested |
| Booking details: name, email, chosen time and anything you add to the booking form | Calendly | Schedule and hold the call | Steps you asked for before a contract |
| Emails we exchange | You | Continue the conversation and keep a record of what was agreed | Legitimate interest; contract once you engage us |
| Analytics data: pages viewed, device and browser type, approximate location, GA4 client ID | GA4 on waftr.com, only after you accept analytics cookies | See which pages help visitors and fix the ones that do not | Consent |
| Ad conversion data: ad click identifier and enquiry events | Google Ads tag, only after you accept marketing cookies | Measure which Google Ads campaigns lead to enquiries | Consent |
| Security data: IP address, browser and request details | Cloudflare, on every visit | Deliver the site and block bots and attacks | Legitimate interest in keeping the site secure |
| Client contacts: names and work emails of the people running an engagement | The client | Deliver, invoice and support the engagement | Contract |
| Data inside client accounts | Access a client grants to GA4, Tag Manager, its consent platform and Google Ads | Deliver the Audit, Build or Care work the client engaged us for | Processed as the client's processor; the client sets the legal basis |
Under India's DPDP Act, analytics and ad measurement rely on your consent. Form, booking and email data rely on the legitimate use of information you gave us voluntarily for a stated purpose, under section 7(a) of the Act.
In CCPA terms, the categories are identifiers (name, email, IP address, GA4 client ID), internet activity (pages viewed and ad clicks on waftr.com), approximate geolocation and professional information (company website and business contact details). We do not ask for sensitive data such as health details or government ID numbers, and none of our forms has a field for it.
How we use it
We use personal data for the purposes below.
- Reply to enquiries, prepare proposals and hold the calls you book.
- Send the Tracking Scan report you request to the work email you give.
- Deliver, invoice and support client engagements.
- Measure and improve waftr.com with GA4 and Google Ads conversion data, only after consent.
- Keep the site available and block automated abuse through Cloudflare's bot protection.
- Meet tax, accounting and other legal duties, and establish or defend legal claims.
Emails about our services
Replies to your enquiry and the reports you request are part of the service you asked for. Any other email about Waftr's services goes out only where the law allows it, carries a way to opt out, and stops once you ask, by reply or at hello@waftr.com.
Automated decisions
We make no decisions about you by automated means that have legal or similarly significant effects. We build no advertising profiles of visitors ourselves; Google Ads conversion measurement, after consent, is the only advertising use of site data.
Cookies and tracking
Two strictly necessary cookies run without consent: the cookie that stores your consent choice, and Cloudflare's bot protection cookie. Neither is used for analytics or advertising.
Our Cookie Policy lists the cookies the site uses and explains how to change your choice.
Sharing and processors
The providers below process personal data for Waftr under their data processing terms. Each receives only what its job needs.
| Provider | What it receives | Why |
|---|---|---|
| Google Analytics 4 | Analytics data, after consent | Site measurement |
| Google Ads | Ad click and conversion data, after consent | Conversion measurement |
| Google Sheets and Slides | Audit findings, reports and project documents, with client contact names | Delivering client work |
| Calendly | Booking details | Scheduling calls |
| Cloudflare | IP address and request details for each visit | Hosting, delivery and bot protection |
| Our consent platform | Your consent choice and a record of when you made it | Storing and proving the choice |
| Our email provider | Form submissions and the emails we exchange | Correspondence |
Other disclosures
- Professional advisers, such as lawyers and accountants, who are bound by confidentiality.
- Courts, regulators and other authorities, where the law requires it.
- A buyer or successor, if Waftr's business is restructured or sold, on terms that keep the protections in this policy.
Sale and sharing under the CCPA
We do not sell personal information. Google Ads conversion measurement may count as sharing for cross-context behavioral advertising under the CCPA, which is why it runs only after you accept marketing cookies. Rejecting or withdrawing marketing consent in Cookie settings opts you out, and an email to hello@waftr.com does the same. We collect no sensitive personal information as the CCPA defines it.
Data inside client accounts
We use what we see in a client's GA4, Tag Manager, consent platform and Google Ads accounts only to deliver the work that client engaged us for. We pass it to no one unless the client instructs us or the law requires it. Server-side hosting, such as Stape or Google Cloud, is contracted and billed by the client directly.
International transfers
The Waftr team works from Chennai, India. When you contact us from the EU, the UK or the US, your data comes to us in India, and the protections in this policy apply to it there.
Some providers in section 05, including Google, Calendly and Cloudflare, process data in the United States and other countries. For data from the EU and the UK, they rely on the EU-US Data Privacy Framework and its UK Extension, or on Standard Contractual Clauses, as their own terms set out.
When a client in the EU or the UK gives us access to its accounts, we sign the European Commission's Standard Contractual Clauses with that client, plus the UK Addendum where UK data is involved, as part of the data processing terms for the engagement.
Transfers of personal data out of India follow section 16 of the DPDP Act, which permits them except to countries the Government of India restricts. Ask at hello@waftr.com for a copy of the safeguards that apply to your data.
Your rights
Depending on where you live, privacy law gives you rights over your personal data. These four laws apply to the visitors and clients Waftr works with, and each sets a deadline for our answer.
| Right | GDPR and UK GDPR | CCPA, as amended by the CPRA | DPDP Act |
|---|---|---|---|
| See your data | Access a copy of it | Know what we collected, from where and why | Get a summary of your data and how it is processed |
| Correct it | Rectification | Correction | Correction, completion and updating |
| Delete it | Erasure | Deletion | Erasure |
| Take a copy elsewhere | Portability | A portable copy, as part of a request to know | No equivalent right |
| Stop or limit use | Object, restrict, or withdraw consent at any time | Opt out of sale or sharing | Withdraw consent at any time |
| Complain to a regulator | Your local data protection authority, or the ICO in the UK | California Privacy Protection Agency | Data Protection Board of India, after our grievance process |
| Our deadline | One month, extendable by two more for complex requests | 45 days, extendable by 45 more with notice | Within 90 days |
How to use your rights
Email hello@waftr.com with the right you want to use and the email address you used with us. We confirm receipt within 10 business days, check your identity against the details we already hold, and then act within the deadline above. Requests are free unless one is manifestly unfounded or excessive.
In California you can act through an authorized agent with your signed permission, and using your rights will not change how we treat you. Under the DPDP Act you can nominate someone to use your rights if you die or become unable to act, and you need to raise a grievance with us before going to the Data Protection Board.
If your data reached us through a client engagement, the client decides how to answer. We forward your request to that client and help it respond.
Retention and security
We keep personal data only as long as its purpose needs, then delete it.
| Data | How long we keep it |
|---|---|
| Enquiries, Tracking Scan requests and booking details | While the conversation is active and for as long afterwards as a follow-up is likely; deleted sooner if you ask |
| Client engagement records: proposals, invoices, project emails | For the engagement, then for as long as tax, accounting and contract law requires |
| Analytics data in GA4 | Under the property's data retention setting, which caps event-level data at 14 months in a standard GA4 property |
| Consent records | As long as needed to show which choice you made; the consent cookie itself lasts up to 12 months |
| Cloudflare security data | Under Cloudflare's own retention; the __cf_bm cookie expires after 30 minutes |
| Access to client accounts | Until the engagement ends and the access is removed |
How we protect it
- Only the people working on your enquiry or engagement can open your data.
- Client platforms are reached through each platform's own user management, at the lowest role the work needs, read-only for a Tracking Audit. We do not ask for passwords.
- Every page of waftr.com is served over HTTPS through Cloudflare, which also filters bot traffic.
- If a breach puts your data at risk, we tell you and the regulators where the law requires it. For data inside client accounts, we tell the client without undue delay.
Children
Waftr's site and services are for businesses and are not directed at children. We do not knowingly collect personal data from anyone under 18, the age the DPDP Act uses to define a child. If we learn that a child's data has reached us, we delete it. Write to hello@waftr.com if you think this has happened.
Changes to this policy
We update this policy when our tools, providers or the law change, and the date at the top of the page shows the current version. When a change affects how we use data you have already given us, we tell you by email before it applies, where we have your address.
Contact
If you are in the EU or the UK and our answer does not settle your concern, you can complain to your data protection authority or to the ICO.