Privacy Policy

Who we are

WAHEED (“we”, “us”) is a halal digital studio. There is no company behind the name: WAHEED is a sole proprietorship, owned and operated by Ashraf Waheed Ansari, and Waheed Digital Studio is the same business written out in full. In law the business and its owner are one person, so the data controller for everything described in this policy is Ashraf Waheed Ansari himself, and the duties it sets out are his personally rather than a company’s.

• Data controller: Ashraf Waheed Ansari, trading as WAHEED
• Postal address: HN 1/1183, Golaghat, Ramnagar, Varanasi 221008, Uttar Pradesh, India
• GSTIN: 09ECPPA9080K1ZZ
• Email: info@waheedlabs.com
• Website: waheedlabs.com

We work with clients across Europe and the Americas, so this policy is written to the standard of the EU and UK GDPR wherever you happen to be.

What we collect

Information you give us deliberately:

• Name, email address, phone or WhatsApp number, organisation name, location, the service you are interested in, your stage, budget range, timeline and your message, when you submit a project application or contact form.
• Email address when you subscribe to the newsletter.
• Name, email, the time you picked and your timezone when you book a call. We also record the IP address that made the booking, once, as a safeguard against automated and duplicate bookings.

Information collected automatically by our own software, without cookies:

• Which pages you read, what referred you here, and your browser, operating system, device type, screen size, language and approximate country. This is counted by our own copy of Umami, running on the same server in Germany that served you this page. It sets no cookies and stores nothing in your browser. Your visit is grouped under a one-way hash of your IP address and browser, and the secret behind that hash is regenerated every day, so your visits on two different days cannot be joined together. We never store your IP address itself: there is no column for it in the database. If your browser sends Do Not Track, nothing is counted at all.

Information collected only if you allow it:

• Deeper analytics from Google Analytics and Ahrefs, which is what the cookie banner asks about.

That is off until you turn it on. This is the part of the policy that used to say we did not use analytics at all, which was wrong, and we would rather correct it plainly than quietly. The full list of what it sets is on our cookie policy, and you can change your answer at any time: Cookie settings.

Our web server keeps standard access logs, including IP addresses, for security and troubleshooting. Those are not linked to anything else and are not used to profile you. Our fonts are served from our own server, so loading a page on this site does not contact Google.

Why we use it, and on what legal basis

• To answer your enquiry or run your booking. Legal basis: steps taken at your request before entering a contract, and our legitimate interest in responding to people who contact us.
• To send the newsletter you asked for. Legal basis: your consent. Every edition carries an unsubscribe link, and unsubscribing takes effect immediately.
• To deliver a project once we begin working together. Legal basis: performance of our contract with you.
• To measure the audience and improve the site. Legal basis: your consent, given through the cookie banner and withdrawable at any time.
• To keep the site up and secure. Legal basis: our legitimate interest in a site that works and is not being abused.

We do not sell or rent your personal information, we do not share it with data brokers, and we do not use it to build advertising profiles.

Who else handles it

We use a small number of service providers, and each one only receives what it needs to do its job:

• Hetzner Online GmbH (Germany) hosts the website and its database.
• HubSpot (Ireland and United States) is our CRM. Contact form and booking details are recorded there so an enquiry does not get lost.
• Beehiiv (United States) sends the newsletter, and holds the email addresses of subscribers.
• Google (Ireland and United States) provides Calendar and Meet for booked calls, and Google Analytics if you have consented to it.
• Nobody, for our visit counting. Umami is software we run ourselves, not a service we send you to. That data never leaves our server.
• Ahrefs (Singapore) provides a second page-view count, only if you have consented to it.

What we stopped doing

Until 22 August 2026 this site ran Microsoft Clarity, which recorded visits as replayable sessions: pointer movement, clicks, scrolling and the page as you saw it. We have removed it. It is no longer loaded on any page, for anyone, with or without consent, and the cookies it left behind are deleted from your browser the next time you load the site. We are naming it here rather than quietly deleting the paragraph, because if you visited before that date you were recorded, and you are entitled to know that from us.

Where your data is stored and sent

The website, its database and your form submissions are stored on a server in Nuremberg, Germany, inside the EU. An earlier version of this policy said India; that was out of date.

Some of the providers above are based in, or transfer data to, the United States. Those transfers rely on the EU-US Data Privacy Framework where the provider is certified under it, and on the European Commission’s Standard Contractual Clauses otherwise. We are happy to tell you which applies to a specific provider if you ask.

How long we keep it

• Contact and booking records: up to 3 years after our last contact with you.
• Newsletter subscriptions: until you unsubscribe.
• Your cookie choice: 180 days, after which we ask again.
• Server access logs: 14 days, then they are rotated away.
• Visit counts: kept as aggregate statistics, with no identifier that can be traced back to you after the day of your visit.

If we are working together, records connected to the engagement are kept for as long as accounting and tax rules require. Ask us and we will tell you exactly what we still hold on you.

Your rights

Wherever you are, and free of charge, you can ask us to:

• Give you a copy of the personal data we hold about you.
• Correct anything that is wrong or incomplete.
• Delete it.
• Restrict what we do with it, or object to us using it.
• Send it to you, or to someone else, in a portable format.
• Withdraw a consent you gave. For cookies that is the Cookie settings panel; for the newsletter it is the unsubscribe link. Withdrawing does not undo what was lawful before you withdrew.

Email info@waheedlabs.comand we will respond within one month, in shā’ Allāh. We will not charge you or make you justify the request.

If you are in the EU or the UK and you think we have got something wrong, you can complain to your national data protection authority. In the UK that is the Information Commissioner’s Office; elsewhere in the EU, your country’s supervisory authority. We would rather you told us first, but you do not have to.

Children

This site is aimed at businesses and is not intended for children. We do not knowingly collect data from anyone under 16. If you believe we have, tell us and we will delete it.

Changes to this policy

When we change it we update the date at the top. If we add a service that receives your data, your stored cookie choice stops counting and you will be asked again, because consent to what was here is not consent to something new.

Contact

For any privacy question at all, and for any of the requests above: info@waheedlabs.com, addressed to Ashraf Waheed Ansari, who is the data controller. If you would rather write, the postal address is HN 1/1183, Golaghat, Ramnagar, Varanasi 221008, Uttar Pradesh, India. Email reaches us faster.