Privacy Policy

1. Who we are

This website is owned and operated by Kunal Singh Dabi, trading as KD Digital, a sole-proprietor SEO consultancy based in Udaipur, Rajasthan, India. For the purposes of data-protection laws (including the EU GDPR, UK GDPR, India's DPDP Act 2023, and the California CCPA/CPRA), we act as a Data Controller in respect of the personal data you submit directly to us.

Our full contact details are at the bottom of this page.

2. Information we collect

We collect three categories of information:

2.1 Information you give us voluntarily

• Contact form submissions: name, email, company, country, service interest, budget range, and the message you type.
• Email and WhatsApp inquiries: whatever you choose to send us.
• Strategy-call bookings: name, email, phone number, calendar preferences, and (optional) brief about your business.
• Client-engagement data: business details, website access, analytics access, Google Business Profile access, billing information (if you become a client).

2.2 Information collected automatically

• Website analytics: IP address (anonymized), user-agent string, referrer URL, pages viewed, approximate geographic location (city-level), session duration, and click events - collected via Google Analytics 4 (with IP anonymization enabled).
• Server logs: standard web-server logs for security and debugging, retained for up to 30 days.
• Cookies: a small number of first-party and third-party cookies (see section 5).

2.3 Information from third parties

• Reviews and ratings we display from platforms where you have chosen to publicly post them (Google, Fiverr Pro, Upwork, LinkedIn).
• Authentication data when you use OAuth (e.g. signing in with Google to grant us Search Console access).

2.4 AI Radar tool data

If you use our free AI Radar citation-tracking tool at kunaldabi.com/ai-radar, we additionally collect:

• The URL of your website and a target city/location you supply, used to run the scan.
• Your email address, used to enforce our one-free-scan-per-24-hours fair-use limit and (with your consent) to send you your scan results.
• A non-identifying browser fingerprint hash — a SHA-256 hash of your User-Agent, screen size, timezone, language preferences, WebGL renderer, and a small canvas-rendering signal. This hash is stored locally in your browser via localStorage and on our server as part of our rate-limit log. Its only purpose is to detect abuse (the same machine trying to run unlimited free scans via incognito mode, multiple email addresses, or different IPs). It is not used for cross-site tracking, advertising, or any other purpose. The hash auto-expires from our rate-limit log after 24 hours.
• Your IP address (also used solely for the same 24-hour fair-use limit; auto-expires after 24 hours).
• The AI engine responses generated for your scan, retained on our server so you can revisit your results URL. We do not share these responses with third parties.

If you would prefer not to be fingerprinted, you may decline to use the AI Radar tool. All other site features remain fully available.

3. How we use your information

We process personal information for the following lawful purposes:

• To respond to your inquiry and provide the information or quote you've requested (legal basis: legitimate interest / pre-contractual necessity).
• To deliver SEO consulting services when you become a client (legal basis: contract performance).
• To send service-related emails, such as reports, invoices, and project updates (legal basis: contract performance).
• To send occasional marketing emails only to addresses that have explicitly opted in (legal basis: consent - withdrawable any time).
• To improve our website and content via aggregated analytics (legal basis: legitimate interest).
• To comply with tax, accounting, and legal obligations (legal basis: legal obligation).

4. Who we share data with

We do not sell your personal data. We share it only with the processors strictly necessary to operate our business:

• Google LLC - Google Analytics (anonymized), Google Workspace (email), YouTube (embedded videos).
• Formspree, Inc. - for delivering your contact-form submissions to our inbox.
• Calendly, Inc. - for scheduling strategy calls (if you book one).
• Cloudflare, Inc. - for CDN, DDoS protection, and DNS resolution.
• Razorpay Software Pvt. Ltd. - for processing checkout payments from kunaldabi.com (cards, UPI, NetBanking, wallets, international cards). Razorpay is PCI-DSS Level 1 certified; KD Digital never sees or stores your card number or CVV. Razorpay's privacy policy: razorpay.com/privacy.
• Stripe, Inc. / PayPal / Wise - for processing payments from existing legacy clients or non-Razorpay regions.
• Accounting software (Zoho Books / QuickBooks) - for GST-compliant invoicing.
• Legal or regulatory bodies - only when required by law (e.g. court orders, tax audits).

We use standard contractual clauses and data-processing agreements with all processors who receive personal data.

5. Cookies and analytics

We use cookies sparingly. The cookies we set fall into three categories:

• Strictly necessary cookies - required for site function (e.g. session cookies). No consent required.
• Analytics cookies - Google Analytics 4 with IP anonymization. Set only after you grant consent via our cookie banner.
• Marketing cookies - we do not currently run any retargeting or advertising cookies.

You can withdraw your consent at any time by clearing your browser cookies or using the "Cookie Settings" link in the site footer (where available).

6. Data retention

We retain personal data only as long as needed for the purpose it was collected:

• Inquiry messages that don't convert: deleted after 24 months.
• Active client records: retained for the duration of the engagement plus 3 years.
• Financial records (invoices, receipts): retained for 8 years to comply with Indian tax law.
• Analytics data: retained for 14 months in Google Analytics, then automatically purged.
• Marketing-list subscribers: retained until you unsubscribe.

7. Your rights

Depending on where you live, you may have the following rights regarding your personal data:

• Right to access - request a copy of the personal data we hold about you.
• Right to rectification - correct any inaccurate or outdated information.
• Right to erasure ("right to be forgotten") - request deletion where legally permitted.
• Right to restrict processing - limit how we process your data in specific circumstances.
• Right to data portability - receive your data in a machine-readable format.
• Right to object - to marketing communications or processing based on legitimate interest.
• Right to withdraw consent - at any time, where processing is based on consent.
• Right to lodge a complaint - with a supervisory authority (e.g. ICO in the UK, CNIL in France, Data Protection Board of India, California Attorney General's office).

To exercise any of these rights, email us at [email protected]. We will respond within 30 days as required by law.

8. Security measures

We protect your data with appropriate technical and organizational safeguards, including:

• HTTPS encryption across the entire site.
• Strong, unique passwords and two-factor authentication on all administrative accounts.
• Least-privilege access controls for team members (where applicable).
• Regular security updates and vulnerability patching.
• Processor-vetting before we share data with any third party.

No method of transmission over the internet is 100% secure. If a breach affecting your personal data occurs, we will notify you and the relevant supervisory authority as required by law (typically within 72 hours under GDPR).

9. International data transfers

We are based in India, and many of our processors are based in the United States, the European Union, and the United Kingdom. When we transfer personal data internationally, we rely on:

• Adequacy decisions (e.g. EU → UK, EU → select countries).
• Standard Contractual Clauses (SCCs) approved by the European Commission.
• Explicit consent where no other legal basis applies.

10. Children's privacy

Our services are not directed to children under 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us and we will delete it immediately.

11. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be announced via a prominent banner on this website and, for existing clients, via email. The "Last updated" date at the top of this page always reflects the most recent revision.

12. Contact us

For any privacy-related question or to exercise your rights:

• Email: [email protected]
• General inquiries: [email protected]
• Postal address: KD Digital, 1st Floor, 53, Panday's, Suncity Delight, Udaipur, Rajasthan 313001, India
• Phone / WhatsApp: +91 96366 50036