This policy explains, in plain language, what personal data CraftLayer Studio (“we”, “us”) collects through craftlayerstudio.com, why, and what your rights are. It is written to follow India's Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Information Technology Act, 2000 and its rules.
1. Who we are
- Name: CraftLayer Studio (operator)
- Location: Delhi, India
- Email: contact@craftlayerstudio.com
- WhatsApp: WhatsApp
We are a web studio that builds websites, online stores, apps and automation for businesses.
2. What we collect
a) When you just browse the site
We use Google Analytics 4 (see section 5). It collects things like pages viewed, time on page, approximate location (city/country, derived from your IP address), device and browser type, the website or link that referred you (including campaign tags in the link, e.g. utm_source), and clicks on our WhatsApp, email and audit buttons. We do not use this to identify you personally.
b) When you contact us
There are no forms on this site; you can contact us only through WhatsApp links and an email (mailto) link. If you message us on WhatsApp or email us, we receive whatever you choose to share, typically your name, phone number or email address, business name, and your message. WhatsApp messages are also handled under WhatsApp/Meta's own privacy policy; emails under your and our email provider's policies.
c) When you ask for a free website audit
You may send us your website link and details about your business and goals. A website link is usually business information, not personal data, but anything personal you include is covered by this policy. We review only publicly available pages; we never log in to your site.
We do not knowingly collect data from children under 18. We do not ask for sensitive data such as financial, health or ID details — please don't send them.
3. Why we use it
- To reply to your enquiry and give you the audit or quote you asked for.
- To provide services you hire us for (under a separate agreement).
- To understand how visitors use the site and improve it (analytics).
- To keep the site secure and meet legal obligations.
We do not sell your data. We do not send marketing messages unless you ask us to.
4. Legal basis (DPDP Act)
- Voluntarily provided data for a specified purpose (Section 7(a)): when you contact us or request an audit, we use what you send only for that purpose.
- Legal obligations, where a law requires us to keep or share data.
Analytics: Google Analytics runs on every visit so we can understand how the site is used. You can opt out at any time (see section 5).
5. Cookies and Google Analytics 4
Google Analytics 4 (GA4) runs on every visit to understand how the site is used, with IP addresses anonymised and Google signals and ad personalisation turned off. It is the only analytics we use. We use no advertising, social media or other tracking cookies.
GA4 sets first-party cookies in your browser:
| Cookie | Purpose | Typical duration |
|---|---|---|
_ga | Distinguishes visitors | up to 2 years |
_ga_<container-id> | Keeps session state | up to 2 years |
(Source: Google Analytics cookie usage documentation; durations are Google's defaults.)
Google processes this data on our behalf and may store it outside India. See Google's policy: policies.google.com/privacy and “How Google uses information from sites that use our services”: policies.google.com/technologies/partner-sites.
How to opt out:
- Install the Google Analytics Opt-out Browser Add-on: tools.google.com/dlpage/gaoptout
- Block or delete cookies in your browser settings, or use private browsing.
The site works fully without analytics cookies.
Our GA4 settings: data retention 2 months; Google Signals off; ads personalisation off.
6. Who we share it with
- Google (analytics), Meta/WhatsApp, Hostinger (our email provider) and Netlify (our website hosting provider, which may log IP addresses for security), as service providers.
- Authorities, only when the law requires it.
Nobody else. Some providers process data outside India; we rely on their safeguards and the DPDP Act rules on cross-border transfer.
7. How long we keep it
- Enquiry messages and audit requests: 1 month, unless you become a client.
- Client project records: as long as needed for the project and legal/tax requirements.
- Analytics: per the GA4 retention setting in section 5.
Then we delete or anonymise it.
8. Your rights
Under the DPDP Act you can:
- ask what personal data we hold about you and how we use it;
- ask us to correct, complete, update or delete it;
- opt out of analytics (section 5);
- nominate someone to exercise your rights if you die or become unable to;
- raise a grievance with us, and then with the Data Protection Board of India.
Email contact@craftlayerstudio.com or message us on WhatsApp. We may ask you to confirm your identity. We respond within 48 hours.
9. Security
We use reasonable security practices: HTTPS across the site, access to messages limited to CraftLayer Studio, and trusted providers. No method is 100% secure; if a breach affects you, we'll inform you and the Data Protection Board as the law requires.
10. Grievance Officer
Under the IT Act, 2000 and the DPDP Act:
- Grievance Officer: CraftLayer Studio
- Email: contact@craftlayerstudio.com (subject: “Grievance”)
- WhatsApp: WhatsApp
- Hours: Mon–Fri, 9 AM–6 PM IST
We respond to grievances within 48 hours.
11. Changes
We may update this policy. The “Last updated” date shows the latest version. Significant changes will be noted on this page.