Legal
Privacy Policy
Effective
This policy explains what personal data Rilibay (“Rilibay”, “we”, “us”) collects through rilibay.com. It says why we collect it and what choices you have. We wrote it for people to read.
It covers this website and its forms only. Our product Rilifi has its own policy at rilifi.com/privacy. For client and partner projects, the data terms in that project’s agreement apply.
Who is responsible for your data
Rilibay controls your personal data. Our address is A-1/19B, Block-A, Paschim Vihar, New Delhi 110063, India.
Under the EU and UK GDPR, we are the “controller”. Under India’s Digital Personal Data Protection Act, 2023 (the “DPDP Act”), we are the “Data Fiduciary”.
What we collect
What you give us
- Contact form: your name, email and message. Also the topic you pick, and your company if you add it.
- Waitlist: your email. Also your industry, if you add it.
- Call bookings: if you book a call, the name, email and notes you enter with our scheduling provider.
Please don’t send us sensitive data through these forms. That includes health or financial details.
What we collect on our own
- Server logs: like every website, ours is hosted on servers that keep standard logs. Our host, Google, records your IP address, browser type, the page you asked for and the time. These logs keep the site running and protect it from attacks. We don’t use them to identify you or track you.
- Analytics, only if you agree: if you allow analytics, Google Analytics records the pages you view and the site that sent you. It also notes your rough location (city level), device and browser. We don’t use it for ads. We have turned off Google’s ad features.
How we use it, and our legal bases
| Purpose | Data | Legal basis |
|---|---|---|
| Replying to you and setting up calls | Contact and booking details | Your request, our legitimate interest in replying, and steps before a contract |
| Telling you when a build launches | Waitlist details | Your consent, which you can withdraw at any time |
| Seeing which pages help people | Analytics data | Your consent |
| Running and securing the site | Server logs | Our legitimate interest in a safe, working website |
| Following the law | As required | Legal obligation |
Under the DPDP Act, we use personal data with your consent. We also use it for the “legitimate uses” the Act allows, such as answering a request you made.
Cookies and similar technologies
We don’t load Google Analytics until you choose “Allow analytics”. Until then, we set no analytics cookies. If you decline or ignore the banner, that doesn’t change.
| Name | Set by | Purpose | How long |
|---|---|---|---|
rb-consent-v1 | Rilibay (local storage) | Remembers your analytics choice | Until you clear it |
_ga, _ga_* | Google Analytics | Tells visits apart, only after you agree | Up to 2 years |
| Provider cookies | Scheduling provider | Booking a call, only if you open the calendar | Set by the provider |
You can change your choice at any time: .
Who we share it with
We don’t sell your personal data. We don’t share it for ads that follow you from site to site. The law calls this “cross-context behavioural advertising”. A few service providers handle data for us:
- Google (Firebase Hosting, and Google Analytics if you agree): hosting, security and analytics.
- Web3Forms: sends contact and waitlist forms to our inbox.
- Our scheduling provider: if you book a call.
- Our email provider: so we can receive and answer your messages.
We may also share data when the law requires it, or to protect our rights, our users or the public.
International transfers
We operate from India. Our providers may handle data in other countries, such as the United States and the European Union. Where the GDPR applies, we use legal safeguards for these transfers. One example is the European Commission’s Standard Contractual Clauses.
How long we keep it
- Messages: up to 24 months after we last spoke. If it turns into a project, that project’s terms apply.
- Waitlist: until the build you signed up for launches, or until you ask us to remove you. Whichever comes first.
- Analytics: 14 months.
- Server logs: for the short period our hosting provider sets.
How we protect it
We serve the site over HTTPS only. Only the people who need your messages can see them. Our providers must keep data secure under their contracts with us.
No system is 100% secure, but we work hard to protect your data. If a breach happens, we will tell you and the authorities where the law requires it.
Your rights
Your rights depend on where you live.
- Everyone: you can ask what we hold about you. You can correct it, delete it or withdraw your consent.
- EU, EEA and UK (GDPR): you can also limit or object to how we use it. You can get a copy to take elsewhere, and you can complain to your data protection authority.
- California (CCPA/CPRA): you can know, delete and correct your personal information. Using these rights won’t count against you. We don’t sell or share personal information.
- India (DPDP Act): you can get a summary of your data and how we use it. You can have it corrected or erased. You can raise a complaint, and you can name someone to act for you.
To use any of these rights, contact us. We reply within one month. We may need to confirm who you are first.
Grievance Officer
India’s IT Rules and the DPDP Act give you the right to raise concerns with our Grievance Officer. You can write to A-1/19B, Block-A, Paschim Vihar, New Delhi 110063, India.
We will confirm we got your complaint and aim to resolve it within the time the law sets. If you’re not happy with our answer, you can complain to the Data Protection Board of India.
Children
This site is for businesses and professionals. It is not for anyone under 18, and we don’t knowingly collect their data.
Changes to this policy
If we change this policy, we will update the date at the top. For big changes, we will say so on this page.
Contact
Questions about privacy? Send us a message. A person reads it, not a bot.