Privacy
Policy.

Forma Digital (“we,” “our,” or “us”) is a boutique digital agency operating from Jodhpur, Rajasthan and Ahmedabad, Gujarat, India. We provide web design, e-commerce development, and digital portfolio services to clients globally.

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website at www.formadigital.in or engage our services. Please read this policy carefully. If you disagree with its terms, please discontinue use of our site.

Information you provide directly:

• Name and email address submitted via our contact form
• Project details, budget range, and any other information you choose to share
• Correspondence via email or messaging platforms

Information collected automatically:

• IP address and approximate geolocation (country/city level)
• Browser type, operating system, and device type
• Pages visited, time on site, referral source, and scroll depth via Google Analytics 4
• Session duration and interaction events (button clicks, form interactions)

We do not collect:

• Payment card details (all payments are processed via third-party payment gateways)
• Sensitive personal data such as race, religion, health information, or biometrics

We use the information we collect to:

• Respond to your project enquiries and communicate with you about our services
• Deliver and manage the services you have engaged us to provide
• Analyse website usage to improve our user experience and marketing effectiveness
• Comply with applicable legal obligations
• Detect and prevent fraudulent or abusive use of our contact form

We will never sell, rent, or trade your personal information to third parties for their marketing purposes.

We use the following third-party services that may process your data:

• Google Analytics 4— website analytics. Data may be transferred to Google's servers in the United States. Google's privacy policy applies: policies.google.com/privacy
• Sanity.io— content management system. Data stored on Sanity's infrastructure. Sanity's privacy policy applies: sanity.io/legal/privacy
• Vercel — website hosting and deployment. Your IP address may be logged by Vercel for security purposes.

Our website uses cookies and similar tracking technologies to enhance your experience and collect analytics data. Cookies are small text files stored on your device.

We use the following types of cookies:

• Essential cookies: Required for the website to function properly.
• Analytics cookies: Google Analytics 4 cookies to understand how visitors interact with our site.

You can disable cookies in your browser settings at any time, though this may affect the functionality of certain features on our site.

We retain your personal information only for as long as necessary to fulfil the purposes outlined in this policy, unless a longer retention period is required or permitted by law.

• Contact form submissions: retained for up to 2 years for business relationship purposes
• Analytics data: retained in accordance with Google Analytics default retention settings (14 months)
• Client project data: retained for the duration of our engagement plus 3 years for legal compliance

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate or incomplete data
• Request deletion of your personal data (“right to be forgotten”)
• Object to or restrict how we process your data
• Request portability of your data in a structured, machine-readable format
• Withdraw consent at any time where processing is based on consent

To exercise any of these rights, please email us at golecha.aadi30@gmail.com. We will respond within 30 days.

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include:

• HTTPS encryption for all data in transit
• HTTP security headers (CSP, HSTS, X-Frame-Options) on our web server
• Rate limiting and honeypot protection on all forms to prevent abuse
• Restricted access to personal data on a need-to-know basis

No method of transmission over the Internet is 100% secure. We cannot guarantee absolute security, but we strive to use commercially acceptable means to protect your data.

Our services are not directed at persons under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have inadvertently collected data from a child, we will delete it promptly.

We may update this Privacy Policy from time to time. We will post the revised policy on this page with an updated “Last Updated” date. We encourage you to review this page periodically. Your continued use of our website after any changes constitutes acceptance of the revised policy.

If you have questions or concerns about this Privacy Policy or how we handle your data: