Your information, handled with care

1. Who we are

Shubhvastu Interior Design Studio, a proprietorship of Surbhi Porwal (GSTIN 06CXEPP0472L1Z8) (“Shubhvastu”, “we”, “us”), designs and builds interiors from studios in Gurgaon, Rohtak and Sonipat, Haryana, India. For the personal data described here we are the Data Fiduciary under the DPDP Act: we decide why and how it is used.

Privacy and grievance contact: shubhvastuinteriordesignstudio@gmail.com · +91 74500 49001 (Mon–Sat, 10:00–19:00 IST) · or use the data request form. Postal: Gurgaon Studio, Gujjar Chowk, Maidawas Road, Sector 64, Gurugram, Haryana 122101.

2. What we collect

Details you give us. When you fill in our consultation form, a lead form on Facebook or Instagram, message us on WhatsApp, call, email or write to us on Google: your name, phone number, email (optional), the city of the property, and your answers about the type of home, scope, budget band, timeline and who will decide. Anything you choose to add in a message.

Where you came from. The advertisement, post, Reel, link or page that brought you to us (for example a campaign name or a short code such as REEL-SNP-01), attached to your enquiry so we know which of our work helps people.

Basic site measurement (no cookies). Our own counter records which pages are viewed, the referring website (domain only), the device type, page speed and clicks on the WhatsApp, call and form buttons. It stores no IP address, no browser fingerprint and nothing that identifies you, and it sends nothing when your browser's Do Not Track setting is on.

Advertising and analytics tools (only with your consent). If you press Accept on our cookie notice, Google Analytics 4 and the Meta Pixel load and set cookies, and our server may send the enquiry event to Meta through the Conversions API. Section 4, 5 and 6 explain exactly what that involves. If you choose Only essential, none of these load.

From Meta. When you submit one of our lead forms inside Facebook or Instagram, Meta passes us the answers you submitted in that form. Meta's own handling of your data is covered by the Meta Privacy Policy.

We do not ask for, and ask you not to send, government ID numbers, bank or card details, health information or passwords through any of these channels.

3. Why we use it

• To reply to your enquiry by phone, WhatsApp or email, share a starting range and arrange a consultation or site visit.
• To prepare a design proposal and quotation, and, if you go ahead, to deliver, supervise and service your project.
• To route your enquiry to the right studio and designer, and to keep a record of what was discussed.
• To measure which pages, posts and advertisements bring genuine enquiries, so we spend less on what does not help (with your consent where cookies or pixels are used).
• To keep the website secure, prevent spam and meet legal, tax and accounting duties.

We process your data on the basis of the consent you give when you submit a form or accept cookies, and, for records the law requires us to keep, on the legitimate uses the DPDP Act allows. We do not sell personal data, and we do not use your enquiry for purposes unrelated to it without asking you again.

4. Facebook, Instagram and Meta tools

We advertise on Facebook and Instagram and use these Meta business tools:

• Lead forms (Instant Forms). The answers you submit in our form inside Facebook or Instagram are passed to us by Meta and entered in our customer system, where our studio team uses them only to contact you about your enquiry.
• Meta Pixel (only after you accept cookies). A small script that tells Meta when a page is viewed and when an enquiry is sent, using the _fbp and _fbc cookies, your browser's details and IP address, so we can measure our adverts and show them to people likely to need interiors.
• Conversions API (only after you accept cookies). When you send our consultation form, our server tells Meta that an enquiry happened. Your email and phone number are first converted into a one-way code (SHA-256 hashing) so Meta can match the event to an account without receiving them in readable form, together with the IP address, browser details and Meta cookie values. We use this only to measure and improve our advertising, never to sell your data.
• Custom audiences. We may ask Meta to show our adverts to people who visited our website, or to avoid showing them to existing clients. Meta does this without giving us anyone's identity.

You can control the adverts Meta shows you in Facebook ad preferences and review or disconnect activity that businesses share with Meta in your Facebook or Instagram settings under “Your activity off Meta technologies”. Meta's use of this data is described in the Meta Privacy Policy.

5. Google tools

With your consent, Google Analytics 4 measures visits and actions on this site using first-party cookies (_ga, _ga_*). We do not send names, phone numbers or email addresses to Google Analytics. See how Google uses information from sites that use its services and the Google Privacy Policy. You can also install the Google Analytics opt-out browser add-on. Videos from our YouTube channel load only when you press play, through YouTube's privacy-enhanced mode.

6. Cookies and your choice

You can change your mind at any time: open cookie choices. Choosing Only essential stops Google Analytics, the Meta Pixel and the Conversions API from that moment; cookies already set can be cleared in your browser settings.

7. Who we share it with

• Our own team at the studio handling your enquiry or project.
• Service providers who process data for us under our instructions: our website host (Hostinger), our customer system (SIDS CROWN, hosted on Google Cloud in the Mumbai region), WhatsApp and Meta for messaging and lead forms, and Google for analytics and email.
• Meta and Google as described in sections 4 and 5, only after your consent for the pixel, Conversions API and analytics.
• Authorities when the law requires it.

Some of these providers may process data outside India. The DPDP Act permits this except to countries the Government restricts; we will follow any such restriction.

8. How long we keep it

• Enquiries that do not become projects: deleted or anonymised within 24 months of our last contact with you.
• Project records, invoices and contracts: for the period tax, accounting and contract law requires.
• A copy of a website enquiry our customer system could not receive at first: kept on our web server for at most 30 days so it can be re-sent, then deleted.
• Records of privacy requests (what was asked and when we acted): kept to show we handled them.

9. Your rights

Under the DPDP Act you may ask us for a summary of the personal data we hold about you and how we use it; ask us to correct, complete or update it; ask us to erase it; withdraw your consent (as easily as you gave it); nominate a person to act for you; and raise a grievance. Use the data request form, write to shubhvastuinteriordesignstudio@gmail.com or message us on WhatsApp at +91 74500 49001. We may ask you to confirm the phone number or email on the enquiry so we act for the right person. We aim to respond within 30 days. If you are not satisfied with our response you may complain to the Data Protection Board of India.

10. Deleting your data

To have your enquiry and contact details deleted, including data that reached us from a Facebook or Instagram lead form:

1. Open the data deletion request page (or send “DELETE MY DATA” with your name to shubhvastuinteriordesignstudio@gmail.com or on WhatsApp).
2. Give the phone number or email you used when you contacted us.
3. We confirm receipt with a reference number, delete your enquiry from our customer system, messaging records and website server, and stop all contact.
4. We tell you when it is done. Only what the law obliges us to keep (for example invoices for a completed project) is retained, and only for that purpose.

Withdrawing consent does not affect processing already done before you withdrew it.

11. Photographs of homes

We publish photographs of completed projects only with the client's written consent, never with an address or anything that identifies the family, and we remove any photograph on request.

12. Security, children and changes

Data travels over encrypted connections (HTTPS). Access to our customer system and admin pages is limited to named staff with individual passwords. Our web server keeps no contact details except the short-lived copy described in section 8. No method is perfect; if a breach affecting you occurs we will inform you and the Data Protection Board as the law requires.

Our services are for adults. We do not knowingly collect personal data from anyone under 18; if you believe a child has sent us details, tell us and we will delete them.

We will post any change to this policy on this page with a new date, and tell people with an open enquiry about significant changes.

Related: Terms of use · Data deletion and privacy requests