Privacy policy.

Last updated 9 November 2026. This policy explains what personal data Gabieta Creative Ventures (“Gabieta”, “we”) collects on gabieta.com, why, how long we keep it, who helps us handle it, and how you can control it.

1. Who is responsible

Gabieta is the data fiduciary (controller) for the personal data described here. Privacy questions, requests and complaints: admin@gabieta.com. That address is also our grievance contact.

2. What we collect and why

If you create an account or sign in

Name, email address, a one-way hash of your password (we cannot read it), whether your email is verified, and, only if you choose to give it, a phone or WhatsApp number and your WhatsApp opt-in. If you use Google sign-in we receive your Google name, email address and Google account ID, never your Google password. We use this to run your account, keep it secure and send you service messages (one-time verification codes by email and, once connected, by WhatsApp to your mobile number, password resets, quotations). One-time codes are stored only as a one-way hash and expire after 10 minutes. Our concept studio at studio.gabieta.com opens only after you sign in and verify; administration runs on a separate private site.

If you send an enquiry, project request or message

Whatever you write or select (name, email, phone, business details, project answers, messages). We use it to reply, prepare quotations and deliver agreed work.

Security and traffic log (every visitor)

For each page request we record: your IP address, approximate location (country, region and city, taken from Cloudflare's lookup of your IP), the browser or tool identifier (user agent), the page requested, the time, the website that referred you, whether you were signed in, and a classification of the visit: human, search engine, AI crawler or AI assistant, SEO tool, uptime monitor, script or probe. If a page in your browser hits an error, a short report (the page address, the error message and your browser identifier) is added to our error log so we can fix it. A small script on each page tells us whether a real browser ran it and saw real interaction; it sends only the page address, and nothing is stored in your browser. We do this to keep the site secure, stop abuse, keep it running and understand how much of our traffic is automated. Full IP addresses are kept for 30 days, then shortened to a network prefix; all log rows are deleted after 90 days.

Google Analytics (only if you click Allow)

If the site owner has switched on Google Analytics 4 and you click Allow in the privacy panel, Google Analytics records page views and basic interactions with shortened IP addresses and sets its own cookies (starting with _ga). Advertising features, advertising personalisation and Google signals are switched off. Google acts as our service provider for this. If you do not click Allow, or your browser sends Do Not Track or Global Privacy Control, Google Analytics is never loaded.

Anonymous click map

To see which parts of a page people use, we record where on a page clicks, pointer movement and scrolling happen, together with the page and your device type (phone, tablet or desktop). This is anonymous: no cookie, no random ID, nothing is stored in your browser, and it is not linked to your IP address, your account or any other record. It is never collected if you click No thanks, or if your browser sends Do Not Track or Global Privacy Control. Kept up to 90 days.

Optional visit measurement (only if you click Allow)

If the site owner has switched measurement on and you click Allow in the privacy panel, we record which pages you open and in what order, where on the page you click, where your pointer rests (positions only, sampled a few times a second, in small blocks of the page), how far you scroll, which button or link you used (its label, not anything you typed), how long you stay, your device type (phone, tablet or desktop), your approximate city and country, the referring website, and a random ID stored in your browser. If you are signed in, we link this activity to your account so we can see how customers use the site. We use this only to improve the site and our services. We do not record what you type into forms or any keystrokes, we do not make screen recordings, and we do not use it for advertising. It is never collected if your browser sends Do Not Track or Global Privacy Control, and it is kept for up to 90 days.

3. Cookies and browser storage

• gabieta_session (cookie, essential, 24 hours): keeps you signed in.
• gabieta_oauth (cookie, essential, 10 minutes): protects the Google sign-in step.
• __Host-gabieta_demo (cookie, essential, 1 hour): lets you view a demo site you opened.
• gabieta-measurement (local storage): remembers your Allow / No thanks choice.
• _ga and _ga_* (cookies from Google Analytics, only if it is switched on and you click Allow; up to 2 years).
• gabieta-vid and gabieta-sid (local and session storage, only if you click Allow): the random IDs used for optional measurement.
• Your service selection and demo basket choices are kept in local or session storage on your own device and are not sent to us until you submit a request.

We use no advertising cookies and no third-party tracking cookies. You can clear or block storage in your browser settings; essential items are needed for sign-in to work.

4. Who helps us process data

We do not sell personal data. These providers process data for us, only to provide their service:

• Cloudflare: DNS, secure connection, caching, bot and attack protection. Visitor traffic passes through it.
• Google: Google sign-in (if you use it) and Search Console statistics about how people find our site.
• Zoho Mail: our business mailbox, which receives email you send to us.
• Resend: sends our service emails (verification, reset, quotation).
• Meta (WhatsApp Cloud API): only if you opted in to WhatsApp messages and the feature is enabled.
• UptimeRobot: checks that the site is online. It receives no visitor data.
• Our own server in India stores the site database and backups.

We may also disclose data if the law or a court requires it, or to protect the site and people from fraud or attack.

5. Transfers outside India

Cloudflare, Google, Resend and Zoho run global infrastructure, so some data may be processed outside India. We use providers that publish data-protection terms, and we do not transfer data to any country the Indian Government restricts under the DPDP Act.

6. How long we keep data

• Account details: while your account exists, and for a short period afterwards for security and legal records.
• Project requests and quotations: while needed to deliver and support the work, then as required for business and tax records.
• Messages sent as a quick enquiry: archived ones are deleted after 180 days and all others after 12 months.
• Security and traffic log: full IP 30 days, shortened prefix up to 90 days, then deleted.
• Optional measurement data: up to 90 days.
• Error reports: up to 60 days.
• Activity log of account actions (sign-ins, verification, studio visits, requests, deletions) kept for administrators: 12 months.
• One-time verification and deletion codes: 10 minutes. Password reset codes: 30 minutes.
• Backups: daily copies kept on our own server and drive for up to 90 days, then overwritten.

7. Your rights and choices

Under the Digital Personal Data Protection Act, 2023 you may: ask for a summary of the personal data we hold about you and who we share it with; ask us to correct, complete or update it; ask us to erase it; withdraw consent at any time (as easily as you gave it); get your grievance addressed; and nominate another person to exercise these rights on your behalf if you die or cannot act. If you are in the EU or UK you may also object to or restrict processing, ask for a portable copy and complain to your data protection authority.

You can delete your account yourself under Account settings. This erases your sign-in, contact details and quick enquiries, and removes your name, email and phone from your project requests; quotations already issued remain as anonymous business records, and the fact that an account was deleted is kept in the activity log for 12 months.

To use a right, email admin@gabieta.com from the address on your account. We may ask you to confirm your identity and will respond within 30 days, usually much sooner. You can withdraw measurement consent at any time with Privacy preferences in the footer. If you are not satisfied with our response you may complain to the Data Protection Board of India.

8. Children

Gabieta is for businesses and adults. We do not knowingly collect personal data from anyone under 18. If you think a child has given us data, email us and we will delete it.

9. Security

We protect data with encrypted connections, hashed passwords, encrypted provider keys, limited access, two-step sign-in for administrators, rate limits and monitoring, and regular backups. No system is perfectly secure. If a breach affects your personal data we will tell you and the authorities as the law requires.

10. Automated visitors

Search engines, AI crawlers, AI assistants and other automated tools may visit our public pages. We log those visits like any other. Our robots.txt asks automated tools not to visit private areas such as the admin, account and API paths.

11. Changes

If we change what we collect or why, we will update this page and its date, and ask for your consent again where the law requires.