Privacy Policy.

Websterfly is a design and marketing studio based in Bengaluru, India, serving clients worldwide. For the purposes of EU/UK GDPR, Websterfly is the controller of personal data collected through this website and the data you submit when contacting us. When we process data on behalf of a client (for example, while delivering a campaign), we act as a processor under a separate data processing agreement.

We collect only what we need to respond to you and run our business:

• Contact data you provide — name, email, phone, company, message content.
• Project data shared with us during an engagement (briefs, assets, credentials limited to what's needed for delivery).
• Technical data automatically logged when you visit — IP address, browser type, device, referrer, pages viewed, timestamps.
• Cookies and similar technologies — see Section 10.

We do not knowingly collect special categories of data (race, health, biometric, sexual orientation, religious beliefs, etc.). Please do not send us such information.

• To reply to enquiries and provide proposals.
• To deliver, invoice, and support agreed services.
• To operate, secure, and improve our website.
• To comply with legal, tax, and accounting obligations.
• With your consent, to send occasional updates about our work. You can withdraw consent at any time.

We do not sell personal information, and we do not use it for automated decision-making that produces legal or similarly significant effects.

For individuals in the EEA, UK, and Switzerland, we rely on one of the following GDPR bases:

• Contract — to take steps at your request and to perform agreed services.
• Legitimate interests — to operate and secure our website, prevent abuse, and develop our services, balanced against your rights.
• Consent — for non-essential cookies and marketing communications.
• Legal obligation — to meet tax, accounting, and regulatory requirements.

We share data only with vetted providers who help us run our business, under written contracts that restrict use to our instructions. Typical categories include cloud hosting, email and productivity (e.g. Google Workspace), analytics, customer messaging, payment processors, and accounting tools. We also disclose data where required by law or to protect rights, safety, and property.

A current list of subprocessors is available on request at hello@websterfly.com.

We are based in India and may transfer personal data to service providers in other countries, including the United States and the European Union. Where data leaves the EEA, UK, or Switzerland, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum / Swiss equivalent), supplemented by technical and organisational measures, or other lawful transfer mechanisms such as adequacy decisions.

We keep personal data only as long as needed for the purposes above. Enquiry emails are typically kept for up to 24 months; client project records for the duration of the engagement plus the period required by tax and contract law (typically 7 years in India). Backups are rotated on a defined schedule and then permanently deleted.

Subject to local law, you have the right to access, correct, delete, restrict, or object to our processing of your data, to data portability, and to withdraw consent. You also have the right to lodge a complaint with your local supervisory authority — for example, your EU data protection authority, the UK ICO, or India's Data Protection Board.

To exercise any right, email hello@websterfly.com. We respond within 30 days (or the period required by your local law). We will not discriminate against you for exercising a right.

California (CCPA/CPRA). In the past 12 months we have collected the categories above (identifiers, commercial information, internet activity). We do not sell or "share" personal information for cross-context behavioural advertising. California residents may request to know, delete, correct, and limit use of sensitive data, and may use an authorised agent.

EEA / UK / Switzerland. See Sections 4, 6, and 8. Our EU/UK representative can be appointed on request for ongoing client engagements that require one under Article 27 GDPR.

Brazil (LGPD). Our legal bases mirror Section 4 (execução de contrato, legítimo interesse, consentimento, obrigação legal). You may contact us to exercise the rights granted under Art. 18.

Canada (PIPEDA) & Australia (Privacy Act). We collect with knowledge and consent, limit collection to identified purposes, and provide access on request.

India (DPDP Act 2023). You may withdraw consent, request correction or erasure, nominate a person to exercise rights in the event of your death or incapacity, and raise grievances with our contact below before approaching the Data Protection Board of India.

We use strictly necessary cookies to run the site, and — only with your consent where required — analytics cookies to understand aggregate usage. You can control cookies through your browser settings; blocking essential cookies may affect site functionality.

We use industry-standard administrative, technical, and physical safeguards — encryption in transit (TLS), access controls, least privilege, and vendor due diligence. No system is perfectly secure; if you suspect a vulnerability, please contact us promptly.

Our website and services are intended for adults and businesses. We do not knowingly collect personal data from children under 16 (or the age of digital consent in your jurisdiction). If you believe a child has provided us data, contact us and we will delete it.

We may update this policy as our services or the law evolve. Material changes will be reflected by updating the "Last updated" date above and, where appropriate, by a notice on the site.

For any privacy question, request, or complaint — including matters routed to our Grievance Officer under India's DPDP Act — please contact:

Websterfly · Bengaluru, India · Worldwide.