Privacy
What this site collects, why, who else sees it, how long we keep it, and what you can control.
Who we are
This site is run by Shivam Ojha, trading as ConsulShivTech, a sole proprietorship based in India (“we”). We are the controller (under India’s Digital Personal Data Protection Act 2023, the data fiduciary) for the personal data described here.
For any privacy request, use the contact form and start your message with “Privacy request”. We reply within 30 days, and we may ask you to confirm your identity from the email address we hold.
What we collect and why
| What | Why | Legal basis | Kept for |
|---|---|---|---|
| Contact form: name, email, stage, budget, message | To reply to you | Our legitimate interest in answering enquiries; steps you ask for before a contract | 24 months after our last exchange, unless you hire us |
| Payment: name, email, phone number, card network, last four digits, country, payment status | To take payment for the website deposit and keep accounts | Contract; legal obligation (tax and accounting records) | 8 years, the period Indian tax law requires |
| Your agreement to the terms, with its time | To show what you agreed to if a payment is disputed | Contract; our legitimate interest in defending claims | 8 years, with the payment record |
| Brief: your idea, stage, budget, launch date and any document link | To prepare for your call | Contract | 90 days after you send it, unless you hire us |
| Booking: the details you enter in Google Calendar | To hold the call | Contract | 12 months after the call, unless you hire us |
| Chat messages | To answer your question | Our legitimate interest in answering enquiries | Not stored by us |
| Quote Review: the link to your quote and what you tell us about it | To write your review | Steps you ask for before a contract | 24 months after our last exchange, unless you hire us |
| Campaign details: the ad or post that brought you (utm tags, ad click ID) and the page you landed on | To know which advertising works. If you came from a Google ad and send a Quote Review request, book a call or pay a deposit, we send Google Ads the ad click ID and the time of that action, and nothing else (no name, email or message), so Google can count that the ad worked | Our legitimate interest in measuring our own marketing | Kept with your enquiry or payment record |
| Updates you opt in to (optional tick box) | To send occasional updates on planning a product build | Your consent, which you can withdraw at any time | Until you unsubscribe |
If you hire us, the records above become part of the engagement and are kept for the engagement plus 8 years. We never sell personal data or use it to target ads at you.
Cookies
This site sets no cookies of its own. If you arrive from an ad or a link with campaign tags, the page keeps those tags in your browser’s session storage until you close the tab, so a form you send can say where you came from. The site itself stores nothing else on your device.
Analytics (Plausible)
We use Plausible Analytics to count page views, clicks on the booking button, payment steps, video plays and views of the booking calendar. Plausible sets no cookies, stores no personal data and does not track you across sites. Its data is hosted in the EU.
Payments (Razorpay)
The website deposit, if you choose to pay it online, is paid on Razorpay’s secure payment page. Your card details go to Razorpay and its card networks and never touch this site. We receive the payment details listed above, under Razorpay’s privacy policy.
Your brief and documents
When you book a discovery call, you describe your idea and can share a link to your documents. The brief passes through our server, which emails it to us through Cloudflare Email Service and Formspree. The documents stay wherever you host them, and you control who can open the link. You can revoke access at any time. Share only what you are comfortable sharing before an NDA.
Contact form (Cloudflare Email Service and Formspree)
Messages from the contact form, Quote Review requests, discovery call requests and website consultation requests pass through our server, which emails them to us in two ways: directly through Cloudflare Email Service, and through Formspree. When you start or complete a payment, Cloudflare Email Service also emails us your name, email and the amount. These emails go only to our own inbox.
Our enquiry log (Cloudflare, Google Sheets and Gmail)
Each enquiry, Quote Review request, discovery call request, website request and payment is also recorded in our own private database, run on Cloudflare (Cloudflare D1), and in a private Google Sheet. Only we can open either one. We use them to follow up on time and to see where each request stands. The database holds what you sent, the date, which page and campaign brought you to us, and whether you ticked the updates box. When you send a message or a request, an automatic email from our Gmail account confirms we have it. The database is held by Cloudflare under Cloudflare’s privacy policy; the Sheet and emails are held by Google under Google’s privacy policy. Each record is deleted after the retention period in the table above.
Booking calendar (Google Calendar)
After you send the brief for a discovery call, request a free website consultation or pay a website deposit, the page can show a Google Calendar booking page. It does not load until you press “Load calendar”. Once it loads, Google may set cookies and receives your IP address and browser details, under Google’s privacy policy. If you book, Google Calendar stores the details you enter and sends them to us. You can use the new-tab link instead, and the site does not remember your choice.
Chat assistant (Google Gemini, Cloudflare Workers AI)
The chat assistant sends the messages you type to Google’s Gemini API to generate replies. If Gemini is unavailable, the same messages go to Cloudflare Workers AI instead, which runs on Cloudflare’s network. We do not store the conversation. Do not enter personal or confidential information in the chat.
Hosting (Cloudflare)
The site is served by Cloudflare, which processes technical request data such as IP addresses to deliver and protect the site.
Transfers outside your country
We work from India, and the services above run in India, the EU and the US. Where UK or EU data protection law applies, transfers rely on the providers’ standard contractual clauses or an adequacy decision.
Your rights
Depending on where you live, including under the UK GDPR, the EU GDPR, the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and India’s Digital Personal Data Protection Act 2023, you can ask to:
- see the personal data we hold about you, and get a copy;
- correct it or complete it;
- delete it, unless the law requires us to keep it (for example, payment records);
- restrict or object to how we use it;
- withdraw consent where we rely on it;
- nominate someone to act for you (India).
Use the contact form as described above. If you are not satisfied with our answer, you can complain to your data protection authority: the ICO in the UK, your national authority in the EU, the UAE Data Office, or the Data Protection Board of India.
Children
This site and our services are for adults running a business. We do not knowingly collect data from anyone under 18.
Changes
If we change this notice, the date below changes. Material changes apply only to data collected after the change.
Last updated 15 October 2026.