Websitune · Policies
Privacy policy
Draft under review. Highlighted items are still being confirmed.
This policy explains what personal data Websitune collects through websitune.com and the Websitune client portal (app.websitune.com), why, who processes it for us, and the choices you have.
Who we are
Websitune is a web agency based in India that builds and looks after websites for small businesses. For this policy, “Websitune”, “we” and “us” means [To confirm: legal name of the business / proprietor], [To confirm: registered address]. Contact: hello@websitune.com.
What we collect
- Enquiries — when you use the contact form: your name, email, business name, website (if any), what you need, budget range and your message. A hidden anti-spam field and timing check are used to stop bots; [To confirm: whether Cloudflare Turnstile is enabled on the form].
- Client portal accounts — for invited clients only: email address, sign-in method (password or Google), your organization and role, and security events such as sign-ins. Staff accounts also use a second factor (authenticator app).
- Work records — change requests, messages, files you attach, website health checks, the maintenance timeline, and documents we share with you.
- Billing — if you pay for Websitune Care online: subscription status, amounts, dates and the payment method type (for example “UPI”). Card numbers and UPI credentials are handled by the payment provider and never reach us.
- Technical data — IP address, browser and request details in security and error logs kept by our hosting providers.
Why we use it
- To reply to enquiries and prepare quotes.
- To provide the services you asked for — building, maintaining and monitoring your website, and running the client portal.
- To bill for Websitune Care and keep accurate records.
- To keep our systems and your data secure, and to prevent abuse.
- To meet legal, tax and accounting obligations.
We do not sell personal data and we do not use it for advertising.
Who processes it for us
We use a small number of service providers, each only for the purpose listed:
- Cloudflare — hosting of websitune.com and the portal, security protection, and privacy-friendly, cookie-less visitor statistics.
- Google Firebase — portal sign-in, database, file storage and background functions. Data location: [To confirm: Firebase region — planned asia-south1 (Mumbai)].
- Resend — sending enquiry and portal notification emails.
- Razorpay — online payments for Websitune Care, once online billing is switched on.
- Anthropic — only if we switch on AI-assisted request triage: the title and text of a change request (never your name, email or company) may be sent to suggest whether it is covered by Care. A person always makes the decision. [To confirm: whether AI triage will be enabled].
Some providers may process data outside India. We choose providers with strong security practices and use them only as needed to run the service.
Cookies and local storage
websitune.com stores only your light/dark theme choice in your browser. It sets no advertising or tracking cookies. Cloudflare may set a strictly necessary security cookie to tell people from bots. The client portal keeps your sign-in session in your browser's storage so you stay signed in.
How long we keep it
- Enquiries that don't become projects: [To confirm: e.g. 12 months].
- Client portal data: while you are a client, then [To confirm: retention period after the relationship ends], unless the law requires longer (for example, billing records).
- Automated website health-check history: 30 days.
Your rights
Under Indian law, including the Digital Personal Data Protection Act, 2023 as it comes into force, you can ask to access, correct or erase your personal data, withdraw consent where we rely on it, and nominate someone to exercise your rights. Email hello@websitune.com. We will reply within [To confirm: response time, e.g. 30 days].
Grievance officer: [To confirm: name and email of the grievance officer].
Security
We use encryption in transit, invitation-only portal access with per-organization separation, a second factor for staff, and least-privilege access for our own tools. No system is perfectly secure; if we become aware of a breach affecting your data, we will tell you and the relevant authorities as the law requires.
Children
Our services are for businesses and are not directed at children.
Changes
We will update this page when our practices change and note the date below. Significant changes will also be announced in the client portal.