Privacy policy

Who we are

This website is run by Rhytmelo Designs (proprietor: Asha Tyagi), a sole proprietorship registered in India. We decide why and how your personal data is used, so we are the “Data Fiduciary” under the Digital Personal Data Protection Act, 2023 (DPDP Act) and the “controller” under the GDPR and UK GDPR.

What we collect

• What you type into our forms: name, work email, phone, company, store URL and your message. On the application form, also your monthly revenue range and your biggest growth blocker.
• Email and phone conversations with us, and notes we take on calls.
• Call recordings and transcripts, where a call is recorded (see “Call recordings”).
• When you visit: your IP address and browser and device details, which our hosting and security provider (Cloudflare) and our server use to deliver the site, keep it secure and show prices for your country. We also count clicks on our buttons without identifying you, unless you’ve allowed analytics.
• A record of your cookie choice: a random ID, what you chose, when, on which page and under which policy version. It doesn’t include your name, and we don’t add your IP address to it.
• If you allow analytics: how you use this site, including session recordings in which what you type into forms is hidden (see our cookie policy).
• If you allow marketing: which ad or campaign brought you here, and which company your visit comes from (see “Advertising and measurement”).
• If you use our client workspace: your sign-in details. Passwords are stored only in encrypted (hashed) form.
• Data in your store or systems that we can see while we work on a project for you, such as customer or order records. For that data you are the Data Fiduciary (controller), and we act only on your instructions under our contract with you.

Why we use it

Advertising and measurement

If you allow marketing cookies (or tick the box on a form that asks for this) and then send us a sales enquiry (contact form, project brief, audit request, including the UK free audit, or application), our server sends Meta a record of that enquiry so we can measure our ads. It includes your email address and phone number, each converted into a code (SHA-256 hash) before it leaves our server; your country, also hashed; your IP address and browser details; Meta’s cookie IDs; the form’s name; and, on the application form, the revenue range and growth blocker you chose. Hashing hides the actual email and phone, but Meta can still use the code to recognise you if you have a Meta account, so this is still personal data. Meta uses it to match the enquiry to an ad and, under its own terms, to provide and improve its advertising services. We don’t send Meta your name or your message.

We don’t do this if you haven’t given that consent, if your browser sends Global Privacy Control, or for careers applications, complaints or grievances. You can withdraw at any time in Cookie settings or by writing to us; we then stop sending new records, but this doesn’t undo records already sent.

If you allow marketing cookies, Apollo.io tells us which company a visit comes from, based on your network address. We may then contact that business about our services using business contact details (see “How we contact businesses”). In the UK and EU we don’t use this to email sole traders or partnerships unless they have asked to hear from us. You can object at any time and we will stop. See Apollo.io’s privacy policy for how Apollo.io handles this data.

How we contact businesses

We find business contact details (name, job title, work email, company) through business-data providers such as Apollo.io and from public professional sources, and use them to email businesses about our services. We contact people only in their work role, and in the UK and EU we email only company addresses, not sole traders or partnerships, unless they have asked to hear from us. Every email says where we got your details and has an unsubscribe link, which we honour promptly. You can also object at any time by writing to us; we will stop and keep only what we need to make sure we don’t contact you again.

Call recordings

Calls may be recorded or transcribed. We tell you at the start of each call, and you can object; if you do, we don’t record that call. We keep recordings and transcripts only as long as we need them, unless they form part of a project file. For the UK and EU, our basis is legitimate interests (keeping an accurate record of what was agreed).

Consent, and how to withdraw it

Where we rely on your consent, we ask for it clearly and separately, and it is never a condition of sending a form. You can withdraw it as easily as you gave it: use the unsubscribe link in any email, change your Cookie settings, or write to us. When you withdraw cookie consent, we delete the cookies those tools left on this site. Withdrawing consent doesn’t affect what we did before you withdrew it.

We ask for your cookie choice again every 12 months, and whenever we change what you are agreeing to.

Who we share data with

We share personal data only with service providers that help us run the business, and only as much as they need:

• Hosting and infrastructure: Cloudflare (website, API and bot protection) and Supabase (database).
• Email delivery: Amazon Web Services (Amazon SES).
• Business software: email, calendar and documents (Google and Microsoft).
• AI tools we use to draft and organise work: Anthropic (Claude) and xAI (Grok), under terms that do not allow our data to be used to train their models.
• Team notifications: Slack (new enquiries).
• Analytics, only with your consent: Google (Google Analytics 4), Microsoft (Clarity) and Contentsquare.
• Advertising and contact tracking, only with your consent: Google (Google Ads), Meta, Apollo.io and HubSpot.
• Payments: Razorpay and PayU. Booking calls: Calendly.
• Shopify, when we work in your store.
• Contractors who work on projects under a written confidentiality agreement.
• Professional advisers, and authorities where the law requires.

We don’t sell personal data for money. Some US laws treat sharing data with advertising platforms as “sharing”; see “If you’re in the United States”.

Transfers outside your country

We are based in India, and most of our service providers are in the United States, the European Union or India, so your data may be handled outside your country. When you send us your details, we receive them in India. When we pass personal data to a provider in another country, we do so under that provider’s data processing terms, which we have accepted and which include the European Commission’s Standard Contractual Clauses and, for UK data, the UK International Data Transfer Agreement or the UK Addendum to those Clauses, as each provider’s terms provide. Some of our US providers are also certified under the EU–US Data Privacy Framework and its UK Extension; that certification is the provider’s own. Where a business in the UK or EU sends us personal data, we agree the transfer safeguards the law requires with that business. We don’t transfer personal data to any country the Government of India restricts under the DPDP Act. Ask us if you’d like details of the safeguards for a particular provider.

How long we keep data, and security

We keep personal data only as long as we need it for the purpose it was collected for:

• Enquiries that don’t turn into work: our systems delete the enquiry records automatically within 12 months. Copies in our email and team messages are kept no longer than we need them.
• Contracts, invoices and tax records: 8 years after the end of the financial year they relate to, as Indian tax law requires.
• Google Analytics data: 14 months.
• Session recordings: Microsoft Clarity keeps recordings for 30 days, except a small random sample and any we save, which it keeps for up to 9 months; its click and heatmap data are kept for 9 months. Contentsquare keeps recordings for 1 month and other analytics data for 13 months.
• Records of your cookie choice: 2 years.
• Cookies: as listed in our cookie policy.

Access to personal data is limited to our team members who need it, and we use two-factor authentication on our accounts where available. Data is encrypted in transit. Analytics and advertising tools never run on private pages, such as our client workspace, proposal and invoice links, or unsubscribe pages.

Your rights

We already give you the rights below, which the DPDP Act will require once its rules take effect. You can ask us to:

• tell you what personal data we hold about you and how we use it (access);
• correct or complete it (correction);
• delete it, unless the law requires us to keep it (erasure);
• stop using it where we rely on your consent (withdrawal);
• resolve a complaint (grievance); and
• nominate someone to exercise these rights for you if you die or can’t act yourself (nomination).

To use any of these rights, raise a request with our Grievance Officer.

If you’re in the UK or EU

Under the UK GDPR and the GDPR you also have the right to restrict or object to our use of your data, to receive it in a portable format, and to complain to your data protection authority (in the UK, the Information Commissioner’s Office). Our UK representative is named in the UK Privacy Notice. We don’t currently offer our services to people in the European Union; if you are in the EU and use our site or contact us, the rights in this section still apply to you.

If you’re in the United States

Some US states give residents rights over their personal data, including to know, correct and delete it and to opt out of its “sale” or “sharing” for targeted advertising. Even where these laws don’t apply to a business of our size, we honour these requests. We don’t sell personal data for money. To opt out of sharing for advertising, choose Reject or turn off Marketing in Cookie settings, or turn on Global Privacy Control in your browser, which we honour automatically. To use your other rights, write to onboarding@rhytmelo.com. You can ask someone to make the request for you, and if we refuse, you can ask us to reconsider. We won’t treat you differently for using these rights.

If you’re in the UAE or Saudi Arabia

If you are in the UAE or Saudi Arabia, you have rights under local data protection law, including to be told how we use your data, to access, correct and delete it, to withdraw consent and to object to direct marketing. We use your data on the bases in this policy: mainly to answer your enquiry and deliver our contract, and with your consent for analytics and advertising. Write to onboarding@rhytmelo.com to use these rights. If you are in the DIFC or ADGM, their own data protection laws apply.

Children

Our site and services are for businesses. We don’t knowingly collect personal data of anyone under 18. If we learn we have, we delete it.

Data breaches

If a personal data breach affects you, we act quickly to contain it, and we report it to the authorities and tell the people affected as the law requires: in India to CERT-In and, once the DPDP Act’s rules apply, the Data Protection Board; in the UK to the Information Commissioner’s Office; and to other regulators where their law applies.

Contact and Grievance Officer

Questions about this policy go to onboarding@rhytmelo.com or +91 9899885363. Complaints go to our Grievance Officer, Asha Tyagi, at onboarding@rhytmelo.com, +91 9899885363, or 362, Near Peer Wali Gali, Muzaffarnagar, Uttar Pradesh 251001, India. See Grievances for how to raise one and how quickly we respond.

If we change this policy, we update the date and version at the top, and earlier versions stay readable below.