Privacy notice

Who we are

This site is operated by Innovative, an unincorporated partnership based in Ahmedabad, Gujarat, India. We are the controller of the personal data described in this notice.

We are in the process of registering the business formally. Until that completes, the partners are the controllers personally and are jointly responsible for everything set out here. This page will be updated with the registered entity's details once they exist, and the substance of what we do with your data will not change.

We are based in India, and Indian data protection law applies to us directly. Most of our clients are in the United States, and we also work with businesses in Canada, the United Kingdom and the UAE.

Rather than apply the minimum each country allows, we hold ourselves to the standard set by the GDPR for everyone who contacts us, wherever you are. The rights below are therefore available to you regardless of where you live.

You can reach us about anything in this notice at hello@byinnovative.com.

What we collect

Only two things: what you send us through the contact form, and the technical records our hosting provider keeps automatically in order to serve the site.

Your name

So we know who we are replying to. Required.

Your email address

So we can reply. Required.

Company and website

Optional. Helps us understand the situation before we reply.

Where you are

Optional. Whether you are exploring or ready to start.

Your message

Whatever you choose to tell us. Required.

Server logs

Our host records IP addresses and request details automatically as part of serving and securing the site. We do not use these to identify or profile visitors.

Analytics and tags

We run a Google Tag Manager container, and product analytics through PostHog. Both are configured so that no cookies are set: PostHog keeps its identifier in memory for the length of the page visit only, and is not permitted to write to cookies or local storage.

That is a deliberate choice. It means we cannot recognise you as a returning visitor, and our visitor counts are approximate — we would rather that than ask you to dismiss a banner.

Because nothing is stored on your device, no consent is required and none is requested. If we ever add a tag that does set cookies — advertising or conversion tracking would be the likely reason — a consent banner will appear first and nothing will load until you choose.

• No advertising or conversion pixels are currently active, and no data is sent to any advertising platform.
• No session recording, heatmaps or scroll tracking.
• No fonts loaded from Google or any other third party. They are compiled into the site at build time and served from our own domain, so your browser never makes a request that reveals your visit to anyone else.
• No accounts, so no passwords and nothing stored in your browser.
• We never put your name, email address or website into analytics. Only categories — industry, objective, revenue band — are recorded against an event.

Why we are allowed to hold it

When you send an inquiry, our lawful basis is legitimate interests — specifically, responding to someone who has deliberately asked us to get in touch. You would reasonably expect a reply, and we do not use the information for anything else.

Our forms include an optional tick box to receive occasional emails from us. That box is never pre-ticked, and leaving it unticked has no effect on your inquiry. Where you do tick it, consent is the lawful basis, and every email carries a one-click unsubscribe that we action immediately.

We also contact businesses directly who have not approached us first, using business contact details published for that purpose. The lawful basis is legitimate interests. Every such message identifies who we are, includes our postal address, and offers a way to decline — reply once and we will not contact you again.

For server logs, the basis is also legitimate interests: keeping the site available and defending it against abuse.

Who else sees it

Contact form submissions are delivered by Resend, an email service acting as our processor under a data processing agreement. They handle the message in order to deliver it and do not use it for their own purposes.

The site is served by Cloudflare, Inc., which hosts it, terminates TLS and filters malicious traffic. Cloudflare processes request metadata and IP addresses to do that, acting as our processor.

Google Ireland Limited provides the tag manager, and PostHog provides product analytics on their EU infrastructure. Both receive page and event data as our processors.

If you book a call, Cal.com receives the details you enter on the booking form in order to schedule it.

That is the complete list. We do not sell personal data, we do not share it with advertising networks, and we do not pass it to anyone else without telling you first.

Where it goes

We read and respond to inquiries from India, so your message is accessed there. Our email, analytics and hosting providers operate infrastructure in the United States, the European Union and at edge locations worldwide.

Where a transfer needs a safeguard — for anyone protected by UK or EU GDPR — we rely on the standard contractual clauses entered into with each provider.

If you would rather your details did not leave your own country, do not use the form. You are welcome to raise anything with us by email or on a call instead.

How long we keep it

Inquiries that do not lead to work are deleted 12 months after the last contact.

Where an inquiry becomes a client relationship, the records are kept for the life of the engagement and then for 8 years. That period is set by Indian company and tax law rather than chosen by us, and it also covers the limitation period for contract claims in the countries we work in.

Server logs are kept for the short period our host applies by default — days rather than months — and are then rotated out automatically.

You can ask us to delete your inquiry sooner and we will, unless we are required to keep it.

Your rights

You can ask us for a copy of the personal data we hold about you, correct it if it is wrong, delete it, restrict what we do with it, or have it provided in a portable format. You can also object to processing that relies on legitimate interests, which includes everything described here.

To exercise any of these, email hello@byinnovative.com. We will respond within one month. There is no charge, and you do not need to give a reason.

If you are not satisfied with how we have handled it, you can complain to the data protection authority where you live — the Data Protection Board of India, the Information Commissioner's Office in the UK, or your state Attorney General in the US. We would rather you came to us first so we can put it right.

Where you live

One standard applies to everyone who contacts us, so the rights above are yours wherever you are. For completeness, this is the law that governs each case.

• India — the Digital Personal Data Protection Act 2023 applies to us directly, because that is where we are established and where your message is read.
• United States — there is no general federal privacy law, and the state laws that exist apply only to businesses above revenue or volume thresholds we are well below. We extend the same rights to you regardless. We do not sell or share personal information as those terms are defined in California law. Commercial email we send identifies us, carries our postal address, and honours an opt-out immediately, as CAN-SPAM requires.
• United Kingdom and European Union — if you are there, UK or EU GDPR applies and the rights above are the same. We do not target either market, so we have not appointed an Article 27 representative; if that changes, we will appoint one and say so here.
• Canada — PIPEDA applies. Access and correction are covered above, and complaints can go to the Office of the Privacy Commissioner of Canada. In Quebec, Law 25 adds data portability, which we also honour.
• United Arab Emirates — Federal Decree-Law 45 of 2021 applies. The rights it grants are a subset of those described above.

Changes to this notice

We will update this page if what we do changes — adding a tag that sets cookies would be the likely reason, and a consent banner would arrive with it. The date at the top always reflects the current version. This notice was last reviewed on 31 July 2026.