Privacy Policy

1. Who we are and how to reach us

DataDab is operated by DataDab LLP, a limited liability partnership registered in India. The founder and principal contact is Amit Ashwini. For any question, complaint, or data-subject request related to this policy, write to privacy@datadab.com. We aim to acknowledge every privacy request within five business days and resolve verified requests within thirty calendar days, as required by applicable law.

Postal correspondence: [registered office address - to be added]. Until the postal line is published in a later revision, all requests must be sent to privacy@datadab.com.

2. What this policy covers

This policy applies to information we collect through:

• The marketing site at datadab.com and all pages under it, including service pages, case studies, research, and the homepage.
• The blog at datadab.com/blog, which is a separate Ghost-hosted publication with its own member and subscription features.
• The free AI audit tools at datadab.com/tools/ai-extractability-audit, datadab.com/tools/agent-audit, and datadab.com/tools/decision-friction-scanner (the "Audit Tools").
• Any lead-capture, contact, or diagnostic form on our properties.
• Email, scheduling, and document exchanges that take place as part of a paid engagement (audit, fractional CMO, advisory).

This policy does not cover third-party sites we link to. When you click an outbound link, the destination site's own privacy policy applies.

3. Plain-language summary

4. What we collect - by surface

We collect different information depending on which part of the service you use. The table below is exhaustive of what we actively collect. We do not collect special categories of personal data (race, religion, health, sexual orientation, political views, trade-union membership, genetic or biometric data).

4.1 Marketing site (datadab.com)

• Server logs - IP address, user-agent, referer, request path, response code, byte count. Retained for 30 days, used for security and capacity planning.
• Cloudflare analytics - aggregated, sampled traffic metrics.
• Google Analytics 4 - page-path, device, campaign, and allowlisted conversion-event data. We do not send form text, email addresses, submitted URLs, or payment details to GA4.
• First-party funnel identifiers - random anonymous and session identifiers stored in local/session storage, plus allowlisted conversion events stored on our VPS. These connect source pages to audit, request, and scheduling outcomes without putting contact details in GA4.
• No marketing-site accounts. The marketing site has no login or comments. The random funnel identifiers are not advertising identifiers and are not sold or shared for third-party marketing.

4.2 Blog (datadab.com/blog, Ghost)

• Newsletter subscription - email address, optionally your name. Used to send blog digests and announcements. Unsubscribed via the link in every email or by emailing privacy@datadab.com.
• Member account - if you create one, we store email, display name, and a hashed password. Ghost handles authentication.
• Comments - if you comment on a post, we store the comment text, display name, email (not displayed publicly), and timestamp.
• Google Analytics 4 - the blog uses GA4 with the property ID visible in its page source. GA4 stores anonymized IP, device class, and page-path metrics.

4.3 Lead-capture and contact forms

• Contact form (/contact) - name, email, message body.
• Diagnostic request form (/about) - email, optional company URL, optional free-text description of the challenge you are working on.
• Calendly - if you book a 40-minute diagnostic, Calendly collects your name, email, and any answers you type into its custom-question fields. Calendly's privacy policy applies to that data.
• hCaptcha - our forms and audit tools use hCaptcha to deter bots and abuse. hCaptcha evaluates device and interaction signals under its own privacy policy; we receive only a pass/fail verdict, not the underlying data.

4.4 Audit Tools (free)

• Submitted URL - the URL you ask us to analyse.
• Submitted email (optional) - only if you provide it to receive a copy of the report.
• Submitted company / context (optional) - any free-text context you add in the input form.
• Fetched page content - the HTML and rendered text of the URL you submitted, plus any metadata (title, headings, schema.org structured data, link graph). Fetched by our background worker, used to build the LLM prompt, then deleted from transient cache within minutes of analysis completing.
• IP address and timestamp - stored in a per-IP rate-limit file. We retain the file for the rolling 1-hour window used for rate limiting and then overwrite it. We do not retain a long-term log of which IP submitted which URL.
• Audit result - a structured JSON response (scores, issues, recommendations) cached on our server for 30 days, then deleted by a daily cron job. A random, public-by-link report URL is generated so the result email can open the report; anyone with that unguessable link can view it until it expires after 30 days.

By submitting a URL to an Audit Tool, you represent that you have the right to fetch and analyse that URL. Do not submit URLs that contain personal data you do not have the right to share, URLs that are behind authentication we do not have credentials for, or URLs that violate any law or third-party right.

4.5 Paid engagements

• Paid-audit request data - company, work email, one page URL, desired outcome, source page, and request status. A request is not a payment.
• Payment data - accepted one-page audits receive a separate Payoneer payment request. Payoneer handles payment credentials; DataDab stores only an operator-safe reference, amount, currency, and lifecycle status.
• Engagement data - name, role, company, work email, billing contact, and billing details needed for accounting.
• Project materials you share with us - documents, decks, dashboards, analytics exports, recorded interviews. We treat these as confidential and use them only to deliver the engagement.
• Engagement correspondence - emails, call recordings (if any), meeting notes.

5. How we use information

We use the information we collect for the following purposes. We do not use it for any other purpose without your consent.

1. To deliver the service you asked for (run the audit, send the report, deliver the engagement).
2. To follow up on leads, including one service email after a completed free audit unless you opt out or take the next step first.
3. To send blog newsletters and product updates you have subscribed to.
4. To operate, secure, and improve our properties (server logs for security, error tracking, capacity planning).
5. To meet legal, tax, and accounting obligations.
6. To enforce our Terms of Service and prevent abuse (rate limiting, fraud detection).

We do not sell personal information. We do not share personal information with third parties for their own marketing purposes. We do not use any user-submitted content to train, fine-tune, or evaluate any AI model.

6. LLM processing for the Audit Tools

When you submit a URL to the AI Extractability Audit, the AI Agent Audit, or the Decision Friction Scanner, the following happens in sequence:

1. Our background PHP worker fetches the URL over HTTPS, parses the HTML, and extracts the content the LLM will need (text, headings, schema.org JSON-LD, link graph, metadata).
2. The worker constructs a prompt containing your URL, the extracted content, the optional context you typed into the form, and the system prompt that defines the audit task.
3. The Extractability and Decision Friction workers send the relevant page content to the MiniMax API. The Agent Audit sends a screenshot and browser-run evidence to Holo3. We do not include your email or IP in those model requests.
4. The provider returns a structured analysis. We parse it, write it to our cache, and present it to you. A deterministic/browser fallback may be shown when an AI provider is unavailable.
5. The fetched page content is transient. The result (without your email) is persisted in cache and at a random public-by-link report URL for up to 30 days, then deleted by the daily cleanup job.

Provider processing is governed by the applicable API terms. If you require a stricter data-handling arrangement, email privacy@datadab.com before submission.

7. Subprocessors and third parties

We use a small set of vetted subprocessors to deliver the service. We list every subprocessor that may receive personal information, what they receive, and where they are located. We will update this list before adding a new one.

8. Cookies and similar technologies

Cookie use is intentionally minimal.

• Marketing site: GA4 may set analytics cookies. DataDab also stores random anonymous/session funnel IDs in browser local/session storage; these are not advertising profiles.
• Blog: Ghost sets a session cookie when you sign in as a member, and a comment-cookie to remember your name on future visits if you opt in.
• Audit Tools: audit state is held server-side; the marketing analytics/funnel identifiers above may be present on tool pages.
• Calendly: sets cookies when you load the scheduling widget. Their policy governs those cookies.

We do not run advertising pixels, retargeting tags, or cross-site tracking cookies anywhere on our properties.

9. Data retention

10. Your rights

Depending on where you live, you may have some or all of the following rights with respect to your personal information. We extend all of them to every user regardless of jurisdiction, because they are cheap to honour and because we believe they are the right baseline.

• Access - request a copy of the personal information we hold about you.
• Correction - ask us to fix anything that is wrong or out of date.
• Deletion - ask us to delete the personal information we hold about you, subject to the retention periods in section 9 (for example, we are required to keep tax records for 7 years).
• Portability - receive your data in a structured, machine-readable format.
• Withdraw consent - if our processing is based on your consent (newsletter subscription, optional form fields), you can withdraw it at any time without affecting prior processing.
• Object - object to processing that we have based on legitimate interest.
• Restrict - ask us to pause processing while a complaint is investigated.

To exercise any of these rights, email privacy@datadab.com from the address you want verified, or use the contact form at datadab.com/contact with the subject "Data request". For security, we may ask you to confirm your identity before acting on a request.

If you are unhappy with our response, you may lodge a complaint with the data-protection authority in your jurisdiction. In India, that is the Data Protection Board of India under the Digital Personal Data Protection Act, 2023.

11. International transfers

Our servers are in Frankfurt, Germany. Some subprocessors (Google, Mailgun, Cloudflare, MiniMax) are based in the United States or operate globally. When we transfer personal information across borders, we rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or other lawful transfer mechanisms as applicable. We have configured Mailgun to use the EU sub-region where possible.

12. Security

We protect personal information with measures appropriate to its sensitivity:

• All traffic is encrypted in transit (TLS 1.2+ via Let's Encrypt certificates; HSTS preload enabled).
• All backups are encrypted at rest with a 32+ character passphrase stored in 0400-mode files on the server.
• Access to the production server requires an SSH key with a passphrase.
• Credentials, API keys, and OAuth tokens are stored in 0600-mode files owned by root.
• Server-software updates are applied within 7 days of a security advisory.
• Quarterly restore-tests confirm we can recover the data we claim to back up.

No system is perfectly secure. If we discover a breach affecting your personal information, we will notify you and the relevant supervisory authority in line with applicable law.

13. Children's privacy

Our services are not directed at children under the age of 16. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us with personal information, email privacy@datadab.com and we will delete it within five business days.

14. Changes to this policy

We may update this policy from time to time. When we do, we will change the effective date at the top of this page and, for material changes, post a notice on the homepage and email newsletter subscribers. The previous version is preserved at datadab.com/blog/privacy-policy for reference.

15. Contact

DataDab LLP
Email: privacy@datadab.com
General contact: amit@datadab.com
Postal: [registered office address - to be added in next revision]

For data-subject requests, please use privacy@datadab.com. We acknowledge within five business days and resolve verified requests within thirty calendar days.