( Legal )

Privacy policy

Last updated — 30 October 2026

यह नीति हिंदी में पढ़ें (this policy in Hindi).

Who is responsible

Webnet Asiais the Data Fiduciary for this site and for the Webnet Asia Laboratory under India's Digital Personal Data Protection Act, 2023 — meaning we decide why data is collected here, and we carry the responsibility for it. Isshaan Walia is the person accountable. The business is a proprietorship of Webnet Asia, GSTIN 04AALPW2407Q1Z6, at SCO 12, First Floor, Above Indian Coffee House, Sector 17-E, Chandigarh – 160017.

This policy applies only to webnetasia.com, including the Laboratory at /laboratory. The client sites in the Work section are separate businesses, each responsible for its own visitors' data, with its own privacy policy and its own grievance contact. Where we build and maintain a site for a client, we act as a Data Processor on their instructions, not as the Fiduciary.

This notice also covers personal data we collected before the Act applied to us: the same purposes, retention periods and rights apply to it.

What we collect, and why

Contact form and “Let's talk”

The name, email address and message you enter, and the fact that you ticked the consent box. Nothing else — no hidden fields, no device fingerprinting. The purpose you agree to is, word for word: “Use my name, email and message to reply to this enquiry, and keep it in the Webnet Asia inbox for up to 5 years. Not added to any mailing list.”

Chat assistant

Messages you type are sent to Google's Gemini API to generate replies, after you accept the chat notice. On Google's free tier they may be used to improve Google's products, so please share nothing confidential. A copy is emailed to us only if you tick “send a copy”(unticked by default): “Send a copy of this chat to Webnet Asia so they can follow up with me. Kept for 12 months.”

Laboratory account (Google sign-in)

  • Your Google email address, when you sign in. We receive your name and picture from Google but store only the email. Purpose: “Use my Google email address to identify my Laboratory account, count which components I copy, and record any purchase I make.” Signing in is the act of agreeing, and each agreement is recorded.
  • Which components you copied (installs), and a short rate-limit log of which source files you opened, to stop scripts copying the whole library.
  • A watermark. Source code you copy has your email address and a short code tied to it written into the copy, so a leaked copy can be traced to the account that took it. This is disclosed so it is never a surprise.
  • A sign-in cookie. Signing in sets one secure, HttpOnly session cookie that keeps you signed in. It is necessary for the account to work and is removed when you sign out.

Pro purchases and GST invoices

To take payment and issue a GST invoice we collect your name, billing country and state and, if you give one, GSTIN, and we keep the order and payment reference. Purpose: “Use my name, state and GSTIN (if given) to issue a GST invoice, and keep the invoice for 8 years as the law requires.”Indian buyers pay in rupees with 18% GST included; buyers outside India pay in US dollars with no GST. Card, UPI and bank details you type go to Razorpay directly and never reach us. Razorpay's checkout may set its own cookies for fraud prevention.

Suggestion box and contributor waitlist

Your email and idea, only if you tick the consent box. Purposes: “Use my email and idea to read my suggestion, and keep it for up to 12 months.” “Email me once when contributor accounts open. Nothing else, no newsletter.”

Everyone

Vercel Analytics and Speed Insights give aggregate traffic and performance counts (pages opened, load times, approximate region). They set no cookies and assign no persistent identifier. Vercel's request logs also record your IP address and browser on every request; that is a record we control, and it is listed below.

If you email, WhatsApp or call us directly using the links on this site, that conversation is governed by the platform you used (Gmail, WhatsApp) rather than by us. We do not ask for or want financial details, government ID numbers or passwords through the forms or the chat.

The basis we rely on

  • Consent for the contact form, the chat copy, the Laboratory account, the suggestion box and the waitlist. Always a clear action, never pre-ticked, one purpose per question, and withdrawable as easily as given.
  • Legal obligation (DPDP s.7) for purchase records and GST invoices: tax law requires us to keep them, so erasure cannot remove them.
  • Serving the page you asked for for request logs and the IP address in them.

Once the Data Protection Board has registered Consent Managers (from 13 November 2026), we will accept withdrawals and requests made through one.

Who else receives it

Every third party that touches personal data is listed below, with what each one actually receives and where it sits. The DPDP Act permits transfer to any country the Central Government has not restricted, and none has been. Our responsibility for these processors does not transfer to them — it stays with us.

  • Vercel (United States) — Hosting, content delivery, and aggregate traffic counts. Receives: requests to the site — the pages opened, your IP address and browser, kept in Vercel’s request logs.
  • Hostinger (Lithuania / EU) — Runs the webnetasia.com mailbox that form submissions land in. Receives: the contents of the submission email.
  • Google (Gmail) (United States) — The mailbox info@webnetasia.com forwards to. Receives: the contents of the submission email.
  • Google (Sign-In) (United States) — Laboratory login: proves the email address is yours. Receives: that you signed in to the Laboratory; we receive your name, email address and profile picture URL from Google and store only the email address.
  • Google (Gemini API) (United States) — Answers the website chat assistant. Receives: the messages you type into the chat. On the free tier Google may use them to improve its products.
  • Supabase (India (Mumbai region)) — Database for the Laboratory: installs, purchases, GST invoices, consent and audit records. Receives: your email address, the components you copied, purchase and invoice details, and your consent history.
  • Razorpay (India) — Takes payment for Pro plans. Receives: your email address, the plan and amount; the card, UPI or bank details you type go to Razorpay directly and never reach us.

How long we keep it

  • Contact form submissions in the inbox — 5 years from the last exchange, then deleted. Project enquiries have a long tail — a lead often returns years later.
  • Vercel request logs (include your IP address) — Retained by Vercel on their plan’s schedule. Serving the site, and investigating faults or abuse.
  • Laboratory sign-in and copies (email address, which components you copied) — While your account exists; deleted when you erase it from your account page. Letting you copy code, and counting installs per component.
  • Laboratory rate-limit log (email address, component, time) — 7 days, then deleted automatically. Stopping a script from copying the whole library; only the last 24 hours is ever read.
  • Suggestion-box ideas and contributor waitlist — 12 months, then deleted automatically; or sooner on request. Deciding what to build next and telling you when contributor accounts open.
  • Purchase records and GST tax invoices (name, email, state, GSTIN if given, amounts) — 8 years from the end of the financial year, then deleted. Legal obligation: GST Act s.36 and Rule 56 (72 months from the annual return), Income-tax Act. Erasure cannot override this (DPDP s.8(7)(a)).
  • Consent ledger (what you were shown, which version, when you agreed or withdrew) — 3 years after your last entry, then deleted. Evidence that consent was real; 3 years is the limitation period for a claim.
  • Audit log (who exported, erased, refunded or changed what) — 3 years, then deleted. Demonstrating accountability to the Data Protection Board (DPDP s.8(5)).
  • Chat transcripts you chose to send us — 12 months from receipt, then deleted. Following up on what you asked. Nothing is sent unless you opt in.
  • Aggregate traffic counts (Vercel Analytics) — Retained by Vercel on their own schedule; not linked to a person. Knowing which work pages get read.

To be straight about the mechanism: items marked as emails or records are cleared by a person working to a reminder rather than an automatic job; the rate-limit log and the suggestion box are cleared by a daily job. If you would rather not wait, ask and we delete yours — or do it yourself from your account page.

What we don't do

  • No advertising, retargeting or tracking pixels.
  • No cookies other than the sign-in cookie described above and the light/dark preference, which stays in your browser and is never sent to us.
  • No selling, renting or sharing your data for anyone else's marketing.
  • No newsletter. The waitlist gets one email when contributor accounts open.
  • No profiling, behavioural tracking or automated decisions about you.
  • Typefaces are downloaded at build time and served from our own domain, so your browser never contacts Google to render a page.

Your rights under the DPDP Act

If you have a Laboratory account, your account page lets you download everything we hold under your email and delete what the law lets us delete, in one click. Being signed in is how we know it is you. For anything else, or without an account, use these links, and to protect you we reply to the address the data is held under and never ask for more personal data to prove who you are. We respond within 30 days, and usually far sooner.

Each right, in full:

  • Access — what personal data we hold about you, what we use it for, and who else has received it.
  • Correction — have anything inaccurate, incomplete or out of date fixed. An issued GST invoice cannot be edited; a mistake is corrected by a credit note and a new invoice.
  • Erasure — have it deleted, unless a law requires us to keep it (purchase records and GST invoices, 8 years).
  • Withdraw consent — at any time, as easily as it was given.
  • Nominate— name another person to exercise these rights on your behalf if you die or become incapable. This right is specific to Indian law and has no equivalent under GDPR. Write to the Grievance Officer with the nominee's name and contact details and we will record it.
  • Complain — to our Grievance Officer first, and to the Data Protection Board of India if we do not resolve it.

Grievance Officer

The Act requires a named individual, not a generic support address. This is ours:

Write with “Grievance” in the subject line. You will get an acknowledgement, and a substantive answer within 30 days. If you are not satisfied, you can escalate to the Data Protection Board of India.

Children

This is a business-to-business studio and developer library and is not directed at anyone under 18. We do not knowingly collect data from children — and because nobody using this site is tracked, profiled or advertised to at any age, the Act's protections for children are satisfied by the site simply not doing those things. If you believe a child has given us their details, tell the Grievance Officer and we will delete it.

Keeping it safe

  • Everything travels over HTTPS. The Laboratory database (Supabase, Mumbai) is encrypted at rest and in transit.
  • Database tables allow no public access: only our server, holding a secret key that never reaches your browser, can read or write them.
  • Access is role-based: ordinary signed-in accounts see only their own data; one administrator account (protected by Google two-factor sign-in) manages the library. Administrator actions are written to an audit log.
  • Email addresses shown in the administrator's lists are masked.
  • Our inbox is protected by two-factor authentication.

If a personal data breach occurs we will notify the Data Protection Board and everyone affected as soon as we become aware, with a detailed report to the Board within 72 hours — telling you what happened, what data of yours was involved, what you can do to protect yourself, and how to reach us about it.

Changes

If this policy changes materially, the “Last updated” date above changes with it, and the consent wording is versioned so we can tell what any given person was actually shown. When the Laboratory notice changes you are asked to agree again the next time you sign in.