Privacy Policy

This site is operated by Aashapura LLC ("we", "us", "our"), the data controller responsible for the personal data described here. If you have any question about your data, or want to exercise any of the rights below, email us at [email protected]. Email is the contact channel for this site, including for formal data requests; we do not publish a postal address and do not require one from you to act on a request.

We collect only what we need to talk with you, deliver our services, and improve the site:

• Contact and booking details you give us. When you message us, request your free scan report, submit the contact or booking form, or subscribe to the newsletter, we collect your email address and any details you choose to share — such as your name, company, project type, budget range, preferred call time, and the content of your message.
• Chatbot conversation transcripts. Our site includes AI assistants (the hero terminal and the concierge dock). We store and analyze the transcripts of those conversations — the messages you send and the assistant's replies — so we can respond to you, follow up on projects you ask about, tailor proposals, and improve the assistants' quality. Please do not paste passwords, payment card numbers, or other sensitive secrets into the chat.
• Free scan inputs. If you run the free scan, we receive the URL you submit and the resulting score so we can show you the result and, only if you ask, send a fuller report.
• Analytics and technical data. We use our own self-hosted, privacy-respecting analytics (Prahari) to understand how the site is used — pages viewed, approximate session activity, referrer, browser and device type, screen size, and the IP address your request arrives from. This is used in aggregate to improve the site; it is not sold and not shared with advertising networks.
• Performance measurement (Cloudflare Web Analytics). Our content-delivery network, Cloudflare, adds a small measurement script to pages at the edge (static.cloudflareinsights.com). It reports how quickly pages actually load and respond for real visitors — Core Web Vitals such as loading, interaction and layout-stability timings — together with the page address, referrer, and browser and device type. Cloudflare states that it uses no client-side state for this: no cookies and no localStorage, and it does not fingerprint visitors. We see it only in aggregate, we use it only to find and fix slow pages, and it is never sold or shared with advertising networks.
• Google Analytics (only if you accept). If you choose "Accept" on the cookie banner, we load Google Analytics 4 (from www.googletagmanager.com) to measure, in aggregate, which pages are visited and how people move through the site. Google sets first-party cookies (_ga and _ga_<id>) and receives the page address, referrer, approximate location derived from your IP address, and browser and device type. Advertising features and signals are switched off. If you decline or do not answer, Google Analytics is never loaded and none of these cookies are set.
• Local storage identifiers. The site stores two small random identifiers in your browser so analytics can tell repeat visits apart: a session ID (_ph_sid, in sessionStorage, cleared when you close the tab) and a visitor ID (_ph_vid, in localStorage, which persists until you clear your site data). Neither is used to track you across other websites.

We do not knowingly collect data from children (see below), and we do not ask for special-category data such as health data. If you start a voice conversation with the on-site assistant, your browser asks your permission and then records short audio clips and uploads them so they can be transcribed; we do not use that audio to identify you, and it is never used for voice or face recognition. Voice is entirely optional — the assistant works fully by typing.

We use a split consent model so the site works for you whether or not you opt in to personalization:

• Strictly necessary (always on). A single random session identifier (ark_session_id) lets the site and the assistants keep the thread of a conversation. It is a first-party cookie set to expire one year after your last visit — so it outlives the browser session and will recognise you as the same visitor when you come back. It carries no consent requirement because the assistants cannot work without it, and it is not used to track you across other websites.
• Personalization (opt-in). If you choose "Accept" on the cookie banner, we build a lightweight profile from what you search for and ask about, so we can tailor recommendations and the assistants' answers to you, and we load Google Analytics (described above). Your choice is stored in your browser as ark_cookie_consent.

If you choose "Decline", none of that profiling happens — no profile is fetched and no behavioral signals are sent, and Google Analytics is not loaded — and search, recommendations, and both assistants continue to work fully. You can change your mind at any time by clearing your site data, which brings the banner back.

• To answer your messages and follow up on projects and calls you ask about.
• To tailor proposals and recommendations to the goals you describe.
• To send you the scan report or newsletter you requested.
• To understand, in aggregate, what is useful on the site and improve our service.
• To keep the site secure, prevent abuse, and comply with our legal obligations.

Where the GDPR applies, we rely on the following lawful bases:

• Consent — for the newsletter and for optional personalization. You can withdraw consent at any time (for example, by unsubscribing or clearing your site data).
• Legitimate interests — for responding to inquiries, analyzing chatbot transcripts to improve our assistants, running aggregate analytics, and keeping the site secure, balanced against your rights and expectations.
• Contract — where we process data to take steps at your request before entering into, or to perform, an engagement with you.
• Legal obligation — where we must retain records (for example, for tax or accounting).

We keep third parties to a minimum and use trusted providers for specific functions:

• Payment processing. None. This site does not take payments: there is no checkout, no card form, and its Content-Security-Policy does not permit any payment provider's script to load. Invoicing for an engagement happens outside this site, under your service agreement.
• Hosting and infrastructure. The site and its data run on our own self-hosted infrastructure, fronted by Cloudflare as our content-delivery and security network. Cloudflare therefore sees the requests it proxies, and it also provides the performance measurement described above. Providers that process data on our behalf do so as processors under written terms.
• Site analytics. Google, for Google Analytics, only after you accept cookies (see above). Google processes that data under its own terms and privacy policy.
• Scheduling. If you book a call, the booking is handled through a scheduling service so we can find a time.

We never sell your personal data, and we never share it for third-party advertising.

We are based in California, United States, so if you contact us from outside that jurisdiction your data will be transferred to and processed there. Where we transfer personal data out of the UK, EU, or EEA, we rely on an appropriate safeguard — such as the European Commission's Standard Contractual Clauses (and the UK Addendum) or an adequacy decision — so your data keeps an equivalent level of protection.

We keep your contact details, messages, and chatbot transcripts only as long as needed to respond to you and maintain a record of our relationship, and then for a reasonable period afterwards in case you return. Newsletter subscribers are kept until you unsubscribe. We retain aggregate site analytics for approximately 24 months, after which it no longer identifies you. Records we must keep for tax or accounting are retained for the period the law requires. When a retention period ends, we delete or anonymize the data.

Depending on where you live (including under the GDPR and California's CCPA/CPRA), you may have the right to:

• Access the personal data we hold about you and receive a copy.
• Correct anything that is wrong (rectification).
• Ask us to delete your data (erasure).
• Object to or restrict how we use it, and to data portability.
• Withdraw consent at any time (for example, by unsubscribing from the newsletter).
• As a California resident: know what we collect, request deletion, and not be discriminated against for exercising your rights. We do not sell or "share" personal information as those terms are defined under the CCPA/CPRA.

To exercise any of these, email us at [email protected] and we will respond within the time the law allows (generally within 30–45 days). You also have the right to complain to your local data protection authority.

This site and our services are intended for businesses and professionals and are not directed at children under 16. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, email us at [email protected] and we will delete it.

We take reasonable technical and organizational measures to protect your data, including encryption in transit, access controls, and a restrictive security policy on this site. No method of transmission over the internet is perfectly secure, but we work hard to keep your information safe and will notify you and the relevant authority of a qualifying breach where the law requires.

We may update this policy as the site and our services evolve. When we do, we will change the effective date at the top, and we will make material changes clear.

Questions about your privacy, or a request to exercise your rights? Email us at [email protected]. That address reaches Aashapura LLC and is the only channel you need — we answer data requests sent to it, and no postal correspondence is required. This policy is governed by the laws of California, United States.

This page is a good-faith policy, not legal advice. We recommend having it reviewed by a qualified lawyer for your jurisdiction.