Privacy Policy

The short version

We collect what you send us in an enquiry so we can reply to it. We do not sell it or add you to a mailing list, and we never pass the contents of your enquiry to advertisers. This website does use the Meta Pixel to measure our ads on Facebook and Instagram and to show our ads to people who have visited — see Advertising measurement (Meta Pixel) below, including how to opt out.

Who we are

Xaevora is a founder-led AI and web studio run from India. For anything in this policy, contact us at hello@xaevora.com.

What we collect

When you submit a project enquiry

The form asks for, and we store:

• Your name, and optionally your company
• Your email address, and optionally a phone number
• Your current website address, if you provide one
• The region and country you select
• The service, budget range and timeline you choose
• Your project description and any reference links you include
• Attribution data: the page you first landed on, the site that referred you, and any UTM campaign parameters in the link you followed

We do not store your IP address with the enquiry. An IP address is briefly hashed in memory to apply rate limiting, and is never written to the record or to any log.

When you browse the site

Apart from the Meta Pixel described below, the site itself collects nothing about you personally. It stores a small amount of information in your browser so it behaves consistently:

• xv_country — a cookie holding a two-letter country code, used to pick a starting currency. Expires after one year.
• xv_region — a cookie recording the region you chose, if you changed it. Expires after one year.
• xv.theme and xv.region — stored in your browser's local storage to remember your colour theme and region. Never transmitted to us.
• xv.attribution — stored in session storage for the length of your visit so campaign parameters can be attached to an enquiry if you choose to send one. Discarded when you close the tab.

None of these identify you, and none are used for advertising or profiling. You can clear them at any time in your browser settings without breaking the site. Cookies set by Meta are covered in the next section.

Advertising measurement (Meta Pixel)

We run ads on Facebook and Instagram. To see whether those ads work, and to show our ads to people who have already visited this site, our public pages load the Meta Pixel, a script provided by Meta Platforms, Inc. (and Meta Platforms Ireland Ltd. for some regions). It loads only after the page has finished loading, and it is not used on our private admin pages.

When it runs, the pixel sends Meta:

• That a page was viewed, and its address (URL, including any campaign parameters)
• That you clicked to book a call or contact us, or sent an enquiry (a “Lead” event) — not what you wrote, your name or your email address
• Standard technical details your browser shares with any website: IP address, browser and device type, and the referring page

Meta may set or read cookies such as _fbp (a browser identifier, kept for about 90 days) and _fbc (set when you arrive from a Meta ad), and may connect this activity to a Facebook or Instagram account if you are logged in. Meta processes this data under its own privacy policy. We see only aggregate reports (for example, how many people who clicked an ad later booked a call); we do not receive your Facebook profile.

How to opt out. Any of these work, and none of them break this site:

• Change your ad settings in Meta's Ad Preferences (including turning off ads based on activity from other websites)
• Block third-party cookies, or clear cookies, in your browser settings
• Use a browser or extension that blocks trackers, or turn on your browser's “Do Not Track” / Global Privacy Control setting together with a blocker
• On a phone, limit ad tracking in your device settings (“Ask App Not to Track” on iOS, “Delete advertising ID” on Android)
• Industry opt-outs: aboutads.info (US) and youronlinechoices.com (EU/UK)

You can also email us and we will stop any direct follow-up with you and delete the records we hold.

When you follow a link we sent you

If we email you directly, the link may be a short tracked link (xaevora.com/d/…) or carry a ref code that identifies the message we sent. When you use it we record that the link was opened: the time, your browser's user-agent string, an approximate location (country, region and city from our hosting provider), and a one-way hash of your IP address so repeated visits can be grouped. We use this only to know whether a message was useful and when to follow up. Some of our emails may also include a small image that records when the email is opened.

The ref code is kept in your browser's local storage as xv.ref for up to 90 days, so it can be attached to an enquiry or booking you choose to make. It is never used for advertising and is not shared. Clearing your browser storage removes it, and you can ask us to delete the records linked to it at any time.

Analytics

If analytics are enabled on this deployment, we use a privacy-conscious, cookieless provider that reports aggregate page views and events such as which calls to action are used. It does not set cookies, does not collect personal data, and does not track you across other websites. When no analytics host is configured, no analytics script is loaded at all.

Why we are allowed to hold it

For enquiry data, our lawful basis is your request that we take steps before entering a contract, and our legitimate interest in replying to business enquiries sent to us. For the preference cookies described above, our basis is the legitimate interest in the website working the way you left it. For the Meta Pixel, our basis is our legitimate interest in measuring and improving our advertising, with the opt-outs described above. We ask for consent where the law in your region requires it for anything beyond that.

Who else can see it

Your enquiry may pass through service providers we use to run the studio. Depending on how this deployment is configured, that can include:

• Vercel, which hosts this website and runs the form endpoint
• Web3Forms, which delivers enquiry form submissions to our inbox
• Google Cloud (Firebase), where enquiry and link-tracking records described above are stored
• Cal.com, if you book a call through our booking link
• Telegram, which we use for private notifications to ourselves about new activity
• Meta Platforms, which receives the browsing and Lead events described under Advertising measurement (not the contents of your enquiry)

Each is bound to handle the data only on our instructions, except Meta, which also uses pixel data under its own terms as described above. We do not sell your enquiry details or contact information, and we do not share them with advertising networks or data brokers.

International transfers

We work with clients outside India, so your data may be processed in a country other than your own. Where required, transfers rely on appropriate safeguards such as standard contractual clauses or an adequacy decision.

How long we keep it

Enquiries that become projects are retained for the life of the engagement and for as long afterwards as tax and contractual record-keeping requires. Enquiries that do not become projects are deleted within 24 months. You can ask us to delete yours sooner.

Your rights

Depending on where you live — including under Australia's Privacy Act, US state privacy laws such as the CCPA, the UK and EU GDPR, and India's Digital Personal Data Protection Act — you may have the right to:

• Ask what personal data we hold about you, and receive a copy
• Have inaccurate data corrected
• Have your data deleted
• Object to or restrict how we process it
• Withdraw consent, where we relied on it
• Complain to your local data protection authority

Email hello@xaevora.com and we will respond within 30 days. There is no charge, and you do not need to explain why.

Security

The site is served over HTTPS with a strict content security policy. Form submissions are validated and rate limited on the server. Credentials for the services we use are held as server-side environment variables and are never exposed to the browser. No system is perfectly secure, but we keep the amount of data we hold deliberately small, which is the most effective control available to us.

Children

This is a business-to-business studio site. It is not directed at children and we do not knowingly collect data from them.

Changes

If this policy changes materially we will update the date at the top and, where the change affects data we already hold, contact anyone affected directly.