Privacy # Privacy notice What we collect, why, how long we keep it, and what you can make us do about it. LAST UPDATED : 3 September 2026 ENQUIRY RETENTION : 180 days TRACKERS ON THIS SITE : 1, Google Analytics This notice is a working draft and has not been reviewed by counsel. It is published in this state deliberately. Everything below describes what the system actually does today and was read out of the database schema rather than composed — but four fields are still bracketed, and the lawful-basis section is a legal characterisation that a lawyer has to write rather than check. India’s DPDP Act is operative from 13 November 2026. If you need a reviewed notice before then, ask and you will be told where it stands. ## The notice ## 01Who we are Rewalto is a brand execution intelligence product operated by [REGISTERED ENTITY], a one-operator company working from Gurugram and London. For the purposes of India’s Digital Personal Data Protection Act, that entity is the *data fiduciary* for everything described below. Where Rewalto processes data on a client’s behalf under a signed engagement — analytics connectors, for instance — it acts as a *data processor* for that client instead, and the client’s own notice governs. That relationship is set out in the engagement, not here. ## 02What we collect **From this website: page views and clicks, through Google Analytics 4.** It records which pages you open, which buttons you press and which of our two doors you enter — never your name, email, phone number or the domain you search on /domain. There is no advertising pixel, no ad-targeting signal (Google Signals is switched off for this property), and no tag manager beyond GA4 itself. **When you use the enquiry form on /talk** we store your name and phone number, the brand, its website, its category and your work email, because those are what a data sample or a call needs. Your role, what you feel you lose ground to, and a list of SKUs are optional and stored only if you type them. **To stop the form being abused** we keep a submission count keyed to a salted hash of the calling IP address — never the address itself. The schema comment says why in one line: *an abuse counter must not become a visitor log.* Those counters are deleted after two days. **If you hold a login** to a Rewalto console, your authentication identity is held by Clerk (§5) and the console records which account took which consequential action, because an audit trail with no actor is not an audit trail. ## 03Why we collect it, and on what basis To answer you, to run the engagement you asked for, and to stop the form being abused. Nothing else. We do not profile you, we do not build a marketing segment, and we do not enrich what you gave us against a third party. [LAWFUL BASIS — COUNSEL] The characterisation of each purpose under DPDP’s consent and legitimate-use provisions is the one part of this notice that is a legal opinion rather than a description of the system, and it is deliberately not drafted here. ## 04What we crawl, and what we do not Rewalto measures public retail and search surfaces. **We crawl what is publicly reachable. Nothing behind a login.** We do not create accounts, we do not use a device farm, we do not spoof geolocation, and we do not mystery-shop competitors covertly. When we test a client’s own channels we test only channels that client has contracted us to test. Personal data does not normally appear in that material; where a public page happens to contain some, it is held as part of the timestamped artefact and is subject to the same deletion route as anything else here. ## 05Who it is shared with We do not sell your data, we do not share it for anyone else’s marketing, and we do not enrich it. It is processed by six service providers, each doing one job: - **Supabase** — the database the enquiry record is stored in. - **Vercel** — hosting and delivery of this website. - **Resend** — sending the email that replies to you. - **Cal.com** — the scheduling embed, if you book a call. - **Clerk** — authentication, for console accounts only. - **Google Analytics** — page views, clicks and the two doors you choose between; Google Signals off, no advertising use. **None of them is an enrichment or data-broking provider**, and that is a standing constraint rather than a current fact: adding one would contradict the sentence above and both would have to change together. We will disclose data where the law requires it. If that happens and we are permitted to tell you, we will. ## 06Where it is stored, and for how long Enquiry records are stored in Supabase’s Postgres on AWS in Mumbai (ap-south-1), in a database schema that is deliberately fenced from the measurement data: nothing in the observation store or the evidence archive is permitted to join to it. **An enquiry is deleted 180 days after you send it.** That is not a policy statement — the expiry is stamped onto the row when it is written and a scheduled job deletes on it. Stamping at write rather than computing at deletion is deliberate: a later change to the period applies to enquiries received after it, never retroactively to ones already held. Abuse counters are deleted after two days. Evidence artefacts from client engagements carry their own retention, set in the engagement. ## 07Your rights Under DPDP you may ask us for the personal data we hold about you, ask us to correct or complete it, ask us to erase it, and nominate someone to exercise these rights if you cannot. You may withdraw consent at any time, and doing so is meant to be as easy as giving it. In practice: email the address in §8 and say what you want. We will not ask you to prove a legitimate interest and we will not route you through a form. If your enquiry is more than 180 days old there will be nothing to return, because it has already been deleted. ## 08Grievances If you are unhappy with how we have handled your data, the grievance officer is [GRIEVANCE OFFICER, NAME AND EMAIL]. DPDP gives you the right to escalate to the Data Protection Board of India if we do not resolve it. For a security issue rather than a privacy one, the route is [security@rewalto.com](mailto:security@rewalto.com) — the same one [/security](https://rewalto.com/security) publishes. ## 09Changes to this notice This notice is dated at the top and every previous version is in the repository’s history, so a change is visible rather than announced. If a change materially affects what we do with data you have already given us, we will email you rather than rely on you re-reading this page.