What we collect — and why.
This page was written from what the site actually does, not from a template. If any of it stops being true, it gets rewritten.
The short version
We sell no data and we buy no data. There is no account to create and no password to lose, because the public side of this site has no login. We count visits anonymously, in a way that cannot identify you; everything else, including analytics and session recordings, only happens if you agree to it first.
What we hold
Your name, email address, phone number and message
When: Only when you send an enquiry. Why: To reply to you about the piece or commission you asked about. Where: Stored on Cloudflare's infrastructure, alongside the reference of the piece you enquired about.
When you tap a WhatsApp button: the pieces you were about to message us about, a reference for your visit (it also ends your WhatsApp message, as “Ref: VJ-…”), the page, your kind of device and your country — and, only if you sent us an enquiry earlier in the same visit, the name and contact you gave there
When: Each time you tap “Buy on WhatsApp” or “Order on WhatsApp”. Why: So the message that reaches our phone can be matched to what you were looking at, and so we can follow up if it never arrives. Where: Stored with our enquiries on Cloudflare, and emailed to the shop. Never your IP address or browser details. Kept as long as enquiries are.
Anonymous visit counts: which pages and pieces were opened, what was added to the cart, how far an enquiry got, which pieces a WhatsApp button was tapped for, and from which site, country and kind of device
When: On every visit, whatever you choose in the cookie banner — because none of it identifies you. Why: To know how many people visit, what they look at, and where the site gets in their way — and, when a WhatsApp button is tapped, to tell the shop to expect your message. Where: Cloudflare, on our own account. No cookie and nothing stored in your browser. Your IP address is never saved: it is mixed with the date and a secret into a code that changes every midnight, so one day's visits can be counted but never linked to you or to another day. Deleted after 90 days.
Pages viewed, pieces looked at, how far down a page you read, how long you stayed, and whether you came from one of our ads
When: Only if you accept analytics in the cookie banner. Why: To understand which pieces people are drawn to, so we know what to buy more of, and which ads are worth paying for. Where: Google Analytics and Google Ads measurement. No advertising cookies. Never sold, never used to advertise to you.
A copy of which pieces are in your cart
When: Only if you accept analytics, from the moment the cart changes. Why: To see which carts are left unsent, so we can find out why. Where: Cloudflare, under a random cart number made by your browser. No name, contact details, IP address or browser details. Deleted after 90 days, or straight away if you withdraw consent.
Session recordings: how you scroll, tap and move through pages
When: Only if you accept session recordings in the cookie banner. Why: To see where the site is confusing or broken, and fix it. Where: Microsoft Clarity, which keeps recordings for 30 days. Anything you type is masked and never recorded. Never sold, never used for advertising.
Your cookie choice
When: As soon as you make it. Why: So we do not ask again on every page. Where: Your own browser's local storage. It is never sent to us or to anyone else.
We do not collect your address, date of birth, or any payment details through this website. Payment is arranged separately once you enquire, and card details never touch our servers.
Cookies and similar storage
The site sets no cookies of its own. Your cookie choice is kept in your browser’s local storage, which — unlike a cookie — is never attached to a request and never sent to us. When you tap a WhatsApp button or send an enquiry, the tab also keeps a short visit reference (“VJ-…”) in session storage, which is cleared when the tab closes; it is how your WhatsApp message is matched to what you were looking at.
If you accept analytics, Google Analytics sets its own cookies to tell one visit from another. If you accept session recordings, Microsoft Clarity sets two cookies (_clck and _clsk) to join the pages of one visit into a recording. If you decline either, it is never loaded at all: not loaded and blocked, but never fetched. You can choose each one separately, change your mind at any time, and it takes effect immediately rather than on some later visit.
Who else can see it
- Cloudflare
- Hosting, anonymous visit counts, saved carts, and where enquiries are stored
- Google Analytics and Google Ads
- Only if you accepted analytics
- Microsoft Clarity
- Only if you accepted session recordings
- Courier
- Name and delivery address, once you order
That is the complete list. Google and Microsoft may process data outside India, under their own data-protection terms. We do not use advertising cookies, remarketing, or third-party chat widgets.
How long we keep it
Enquiries are kept for about 24 months so that we can pick up a conversation where it left off, then deleted. Ask us to delete yours sooner and we will. Anonymous visit counts and saved carts are deleted after 90 days, and session recordings after 30.
Your rights
Wherever you are, you can ask us for a copy of what we hold about you, ask us to correct it, or ask us to delete it. Write to hello@byvansaj.com and we will action it within thirty days.
If you are in India, the Digital Personal Data Protection Act 2023 gives you these rights and the right to nominate someone to exercise them on your behalf. If you are in the UK or the EU, the UK GDPR and GDPR give you these rights plus the right to portability and the right to object to processing.
A named grievance officer is required under the DPDP Act and has not been set yet — see src/data/policies.js.
Changes
If we change how any of this works, this page changes with it. It is kept in the same repository as the site itself, so its history is a matter of record rather than a claim.