Privacy Policy
What personal data WebFlur collects, why we collect it, who we share it with, and how you can request access, correction, or deletion.
Last updated: 8 September 2026
Who we are
WebFlur (operating as webflurstudio) is an AI SEO agency for B2B companies, with offices in Gurgaon, India and New York, USA. The data controller for this website (webflur.com) is WebFlur, reachable at [email protected]. Founded by Pankaj Raghav and Nick Smith.
What data we collect (and why)
| Data | Source | Purpose | Legal basis |
|---|---|---|---|
| Name, email, message content | Contact form + emails to [email protected] | Respond to your inquiry, schedule a call, propose an engagement | Legitimate interest / consent (GDPR Art. 6(1)(a)(f)) |
| Website analytics — page views, referrer, browser, approximate location (country/region) | Google Tag Manager + Google Analytics (loaded on every page) | Understand which content readers find useful; improve site structure | Consent (see cookie section below) |
| Server logs — IP address, timestamp, requested URL | Cloudflare edge (our hosting provider) | Security, abuse detection, uptime | Legitimate interest (GDPR Art. 6(1)(f)) |
| A2A endpoint request payloads — the message text your AI agent sent us via webflur.com/a2a/v1 | Agents calling the A2A endpoint | Serve the response, monitor for abuse of the free tier | Legitimate interest; ephemeral — not tied to any user identity |
| Newsletter subscription (implicit — you emailed us to be added) | Your email to [email protected] | Send you notifications when new blog posts publish | Consent (you initiated the email) |
What we do NOT collect: we run no email tracking pixels, no re-marketing tags, no session recorders (Hotjar / FullStory / etc.), no fingerprinting, no ad platforms. The RSS feed and the mailto: newsletter are un-instrumented — we do not know if or when you open our emails.
Cookies
This site uses cookies. We categorise them and describe what each is used for.
- Essential cookies — a small session cookie set by Cloudflare (`__cf_bm`) for bot protection. No ability to opt out; strictly necessary for site operation.
- Analytics cookies — Google Analytics via Google Tag Manager sets `_ga` and `_gid` to aggregate anonymised traffic. You can decline via your browser's cookie settings or an ad-blocker; site functions normally without them.
We do not use advertising cookies, third-party retargeting tags, or social pixels.
Third-party processors
We use a small number of vendors to run the site. Each is bound by their own privacy policy (linked):
- Cloudflare, Inc. — hosting + CDN + bot protection. Data processed: request logs, IP addresses. Cloudflare Privacy Policy.
- Google LLC (Google Analytics + Tag Manager) — analytics only. IPs anonymised where supported. Google Privacy Policy.
- Google Fonts — Inter + Instrument Serif fonts served from Google's CDN. Google receives IP and User-Agent when the font loads. Google Fonts privacy FAQ.
- GitHub, Inc. — source hosting only (webflurstudio/webflur-website). No visitor data sent to GitHub from your browser at runtime.
- Render, Inc. — hosts the A2A endpoint backend at webflur-a2a.onrender.com. Processes A2A request payloads for the seconds needed to respond, then discards.
We do not sell your data. We do not share it with data brokers. We do not use it for any purpose beyond what is listed in the table above.
Data retention
- Contact-form / email conversations: retained as long as the working relationship or its follow-ups make sense, typically 24 months, then deleted from our inbox.
- Analytics data: 26 months (Google Analytics default).
- Server logs: 30 days at the Cloudflare edge, then rotated.
- A2A endpoint payloads: not retained beyond the response cycle (measured in seconds).
- Newsletter list: retained until you email us to be removed.
Your rights
Under GDPR (if you are in the EU/EEA/UK) and CCPA / CPRA (if you are a California resident), you can:
- Request access to the personal data we hold about you.
- Request correction if any of it is wrong.
- Request deletion — we will do this unless we have an overriding legal obligation to retain it.
- Request a copy in machine-readable form (data portability).
- Object to processing based on legitimate interest.
- Withdraw consent at any time (for anything based on consent).
- Lodge a complaint with your national data protection authority (e.g. the ICO in the UK, CNIL in France, DPA in Germany).
International data transfers
Our operations run out of India and the USA. If you are contacting us from the EU/EEA/UK, your personal data is transferred outside the EEA under Standard Contractual Clauses with our processors (Cloudflare, Google) where applicable. We do not transfer data to any jurisdiction on the EU adequacy blacklist.
Children
WebFlur services are B2B and directed at professional buyers. We do not knowingly collect data from anyone under 16. If you believe a child has submitted personal data via this site, email [email protected] and we will delete it.
Changes to this policy
We update this policy when practices change. The "Last updated" date at the top always reflects the latest revision. Substantive changes are noted in a change log at the bottom of this page (below). For material changes affecting existing engagements, we also email affected contacts directly.
Change log
- 2026-09-08 — Initial publication.
Contact
Questions about this policy or how your data is handled: [email protected]. Same channel for compliment, complaint, or data-subject request.