Privacy Policy

This Privacy Policy explains how Web Zosh, a sole proprietorship in Proddatur, Andhra Pradesh (“we”, “us”), handles personal data when you use www.webzosh.in (the “website”). Web Zosh decides why and how this personal data is used, so we are responsible for it — under India’s Digital Personal Data Protection Act, 2023 and the rules made under it (“DPDP Act”) we are the Data Fiduciary.

We keep this simple: we collect only what we need to reply to you or consider your job application, and we do not sell your data.

1. Which laws this policy follows

Today, personal data handled by businesses in India is governed by the Information Technology Act, 2000 (section 43A) and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. The DPDP Act and the Digital Personal Data Protection Rules, 2025 are coming into force in stages, and most of their duties for businesses apply from May 2027. We have written this policy to meet both: we already give you the notice, choices and rights described below, even where the law does not yet require them.

2. What we collect

When you send an enquiry through the contact form: your name, email address, phone number (optional), company name (optional), the service you are interested in, and your message.

When you apply for a job: your name, email address, phone number, the area you are interested in, optional profile links (such as LinkedIn or a portfolio), your message and the résumé file you upload.

Your confirmation and consent: when you submit a form, we record that you confirmed you are 18 or older and agreed to this policy, together with the policy version and the form you used.

How you found us (with an enquiry or application only): the campaign tags in the link you followed to our website (such as utm_source or a Google Ads click ID), the website that referred you and the first page you opened. Your browser keeps these in session storage until you close the tab, and sends them to us only together with a form you submit.

Technical and security data: to protect the website from spam and abuse, we process your IP address and basic request details. Our own systems store IP addresses only in a scrambled (hashed) form, as short-lived counters for rate limiting; the spam check (Cloudflare Turnstile) processes browser and device signals to confirm a real person is submitting the form. Our hosting set-up may also record standard server and security logs, described in section 5. Some of our clients’ websites load our WhatsApp chat button from this website; when they do, our server receives that request (with the IP address and browser details) in the same way and keeps it only in these logs. The chat button itself stores nothing in the browser except whether you closed its greeting.

Error reports: if a page or our server runs into a technical error, we send a report to our error-monitoring service (Sentry) so we can fix it. Reports describe the error — such as the page address without any query string, the browser and device type, and the technical steps that led to it. They pass through our own server first, so Sentry does not receive your IP address, and we remove form contents, what you type and any identifiers before they are sent.

When you contact us directly by phone, WhatsApp or email, we receive the information you choose to share in that conversation. If you message our WhatsApp number, your messages are processed by Meta (WhatsApp) and by Wylto, the WhatsApp chatbot platform whose automated assistant answers you. The assistant uses both fixed menus and AI-generated replies, so your messages may also be processed by the AI service Wylto uses to write those replies. Automated replies can be incomplete or wrong; prices, scope and other commitments are only those in a written quotation from us.

Analytics: we count visits with Umami, a privacy-friendly analytics tool that runs on our own server. It uses no cookies, honours “Do Not Track” and keeps only aggregated figures such as page views, referring sites, country and device types; your IP address is used briefly to work these out and is not stored. Google Analytics runs only if you choose “Allow analytics” in the banner; it then uses cookies to measure how pages are used (with Google’s advertising features turned off). If you choose “No thanks”, or your browser sends Global Privacy Control, Google Analytics does not load. When switched on, our own click and scroll statistics (heatmaps) record, on our server, roughly where on a page links and buttons are clicked, which ones, and how far down the page you scroll — as anonymous counts per page, day and device type (desktop, tablet or mobile), using a random code kept in your browser’s session storage for that visit. They never record what you type, form contents, your IP address or cookies, and they are off when your browser sends Do Not Track or Global Privacy Control, or when you choose “No thanks” in the cookie banner where it is shown.

We do not use advertising cookies, and we do not ask for passwords, bank or card details, health information or other sensitive personal data. Please don’t include such details in your message or résumé.

3. Why we use it

• To respond to your enquiry and discuss a possible project (based on your consent, which you give by ticking the box and submitting the form).
• To assess your job application and contact you about suitable roles (based on your consent).
• To learn which campaigns and websites bring us enquiries and applications (from the “how you found us” details sent with your form).
• To keep the website secure, find and fix technical errors, and prevent spam, fraud and abuse.
• To understand how the website is used and improve it — through cookieless, aggregated Umami statistics, and through Google Analytics only when you have agreed to it.
• To meet legal obligations, where applicable.

We will not use your data for unrelated purposes, and we will not send you marketing messages unless you separately agree to receive them. We do not make decisions about you based solely on automated processing.

4. Who we share it with

We share personal data only with service providers that help us run the website and respond to you, under appropriate terms:

• Google (Google Workspace — Sheets and Drive) to record enquiries and store application files.
• Zoho (Zoho Mail) and Google (Gmail), our email providers, to deliver form notifications (with any résumé attached) to our team and to hold the emails we exchange with you.
• Cloudflare (Turnstile) for spam protection — see Cloudflare’s Turnstile Privacy Addendum.
• Google (Google Analytics) — only if you allow analytics cookies. Google explains how it uses this information in How Google uses information from sites or apps that use our services.
• Sentry (Functional Software, Inc.) for error monitoring, as described above — without your IP address or form contents.
• Slack (Slack Technologies) to alert our team that a new enquiry or application has arrived. These alerts contain only the type of request, the service or area, how the visitor found us and a reference number — never your name, email address, phone number, message or résumé.
• Meta (WhatsApp) and Wylto (our WhatsApp chatbot platform, including the AI service it uses for automated replies) — only when you choose to contact us on WhatsApp.
• Hostinger, our hosting provider, which runs the website, our Umami analytics and our rate-limiting store on a virtual private server in India (Mumbai).

Some of these providers (including Google, Zoho, Cloudflare, Sentry, Slack, Meta and Wylto’s AI service) may process data outside India, for example in the United States or the European Union. We transfer personal data only as Indian law permits, and not to any country or territory the Government of India restricts. We may also disclose information when the law requires it, for example to a court or a government agency with legal authority to ask.

5. How long we keep it

• Enquiries: for up to 24 months after our last interaction, unless we enter into a contract with you, in which case contractual and legal record-keeping periods apply.
• Job applications and résumés: for up to 12 months, so we can consider you for upcoming roles, unless you ask us to delete them sooner.
• Rate-limiting data: minutes to hours (hashed IP addresses only).
• Server and security logs (which may include IP addresses and request details), kept on our server in India: for at least 180 days, as Indian cyber-security rules require, and normally for one year; then deleted, unless the law requires us to keep them longer or they are needed to investigate a specific incident.
• Error reports: for the retention period of our error-monitoring account (no longer than 90 days).
• Google Analytics data: for the retention period set in our Google Analytics account (no longer than 14 months).
• Click and scroll statistics: anonymous daily counts, deleted automatically after 60 days.

When data is no longer needed for its purpose, we delete it.

6. How we protect it

We use reasonable security safeguards, including encrypted connections (HTTPS), restricted access to the systems where enquiries and applications are stored, server-side validation of every submission, checks on uploaded files (type and size), rate limits and spam protection. No system is completely secure, so we cannot promise that data will never be accessed without permission. If a personal data breach occurs, we will inform the authorities and the people affected as Indian law requires. To report a security problem with the website, see our Security page.

7. Your rights and choices

You can ask us to:

• Access a summary of the personal data we hold about you and how it is processed;
• Correct, complete or update inaccurate or incomplete data;
• Erase your data when it is no longer needed or you withdraw consent (unless we must keep it by law);
• Withdraw consent at any time — as easily as you gave it — without affecting processing already carried out (for analytics cookies, use “Cookie settings” at the bottom of any page);
• Raise a grievance with our Grievance Officer (section 8); and
• Nominate another person to exercise your rights in the event of your death or incapacity.

These are the rights the DPDP Act gives you; we honour them now.

How to make a request (including deleting your data): email contact@webzosh.in with the subject “Privacy request” from the email address you used with us, and tell us what you would like us to do. We do not have user accounts, so there is nothing to sign in to. We may need to verify your identity before acting on a request. We aim to respond within 30 days.

If you withdraw consent or ask us to delete your data, we stop using it for that purpose and delete your enquiry or application data (from our mailboxes, Google Sheets and Google Drive) within 30 days, unless the law requires us to keep it. We may then be unable to answer your enquiry or consider your application.

To nominate someone, email us the nominee’s name and contact details from the email address you used with us.

8. Grievance Officer

If you have a concern about how we handle your personal data, contact our Grievance Officer first:

• Name: The Grievance Officer, Web Zosh
• Email: contact@webzosh.in (subject: “Grievance”)
• Address: Web Zosh, Proddatur, Kadapa District, Andhra Pradesh — 516360, India

We acknowledge grievances promptly and resolve them within one month of receiving them. Once the relevant provisions of the DPDP Act are in force, if you are not satisfied with our response you may also complain to the Data Protection Board of India.

9. Children

This website is intended for businesses and adult job seekers. Our forms ask you to confirm that you are 18 or older, and we do not knowingly collect personal data from anyone under 18. If you believe a child has sent us personal data, contact us and we will delete it.

10. If you are outside India

The website is meant for people and businesses in India. If you use it from elsewhere, we rely on your consent for forms and analytics, and on our legitimate interest in keeping the website secure and working. Depending on where you live, you may also have the right to object to processing, to receive your data in a portable format, and to complain to your local data protection authority. We do not sell personal information or share it for cross-context behavioural advertising, and we honour Global Privacy Control.

11. Changes to this policy

We may update this policy as our website or the law changes. We will post the updated version here with a new “last updated” date. If a change affects how we use data you have already given us, we will ask for your consent again where the law requires it.

12. Contact

Web Zosh, Proddatur, Kadapa District, Andhra Pradesh — 516360, India · contact@webzosh.in · +91 99666 77597