Privacy Policy.
This Privacy Policy explains how IDEA & WORKS collects, processes, and protects information gathered through our public website, contact mechanisms, and operational telemetry.
Who Operates the Website
This website (ideaandworks.com) is operated under the public brand IDEA & WORKS, an independent digital product studio led by founder Avinash Singh. We design and engineer bespoke web applications, SaaS platforms, AI solutions, and workflow automation systems for commercial clients.
This policy applies exclusively to data collected through this website, our project enquiry form, email correspondence, and associated edge infrastructure. Software platforms, client codebases, and digital products engineered by IDEA & WORKS for our clients are deployed onto separate client-controlled infrastructure and are governed by our clients' respective privacy policies and contractual agreements.
Information We Collect
We collect personal information only when you voluntarily provide it to us, or automatically through standard web protocols necessary to deliver and safeguard the site:
A. Information Submitted via the Project Enquiry Form
When you submit an enquiry through our /contact page, we collect the following structured information:
- Full Name (2–100 characters)
- Business Email Address
- Phone Number (7–15 digits)
- Company / Organization Name (optional)
- Project Category (Websites, SaaS, AI, etc.)
- Project Stage & Target Timeline
- Project Description (15–5,000 characters)
- Referral Source (optional)
B. Technical Telemetry & Anti-Abuse Processing
When you access our web pages or submit forms, automated technical data is processed to ensure site security and availability:
- •Cryptographic Rate Limiting: To prevent distributed denial-of-service (DDoS) and bot submission abuse, incoming IP addresses are processed in volatile server memory using a salted cryptographic hash (SHA-256). We do not record or retain raw IP addresses in our persistent database.
- •Cloudflare Turnstile Verification: We integrate Cloudflare Turnstile on our contact form. Turnstile verifies visitor legitimacy through non-intrusive browser challenges without serving interactive puzzles, storing third-party tracking cookies, or tracking users across the web.
- •Server & Network Headers: Standard web server logs may temporarily capture browser user agent, operating system, timestamp, and requested URL paths to manage network routing and SSL/TLS termination.
Analytics & Cookie Usage
We use Google Analytics 4 (GA4) (Measurement ID: G-Q1Y0SZCTFJ) loaded via Next.js Script with strategy="afterInteractive".
Google Analytics sets first-party cookies (such as _ga and _ga_Q1Y0SZCTFJ) to measure aggregated, anonymized metrics including page views, session duration, general geographic region, and device categories. This data helps us understand which studio case studies and service descriptions are most valuable to visitors.
We do not use Google Tag Manager, retargeting pixels (e.g. Meta Pixel or LinkedIn Insight Tag), or cross-site commercial trackers. We do not sell or monetize visitor behavior.
You can prevent Google Analytics cookies by enabling "Do Not Track" in your browser, adjusting your cookie preferences, or installing the official Google Analytics Opt-out Browser Add-on.
Error Monitoring & Telemetry
To maintain uptime and detect application bugs, we use Sentry (via @sentry/nextjs). When an unhandled error occurs during browser rendering or server execution, Sentry receives diagnostic telemetry including:
- JavaScript runtime error message and stack trace
- Request URL and timestamp of the error
- Browser environment, device type, and operating system version
Sentry telemetry is configured strictly for software stability and debugging. Sensitive user input, form passwords, or payment credentials are never transmitted to error logs.
Purposes & Lawful Bases for Processing
Under international data protection regulations (including the EU and UK General Data Protection Regulation / GDPR), we process information under the following lawful bases:
Evaluating Inquiries & Scoping
Reviewing your project brief, assessing technical constraints, preparing milestone estimates, and scheduling discovery calls at your express request.
Security, Uptime & Operations
Safeguarding infrastructure against DDoS attacks and form spam, monitoring runtime stability, and analyzing aggregated website usage patterns.
Service Delivery & Milestone Handover
Delivering contracted software codebases, managing staging deployments, and communicating project updates once a project agreement is signed.
Statutory Accounting & Records
Fulfilling mandatory tax, accounting, audit, and commercial retention duties under applicable corporate law.
Third-Party Service Providers
We do not sell, rent, or trade your personal information. We transfer information only to verified third-party infrastructure and technology providers who assist in operating our services:
Data Retention
We retain personal data only for as long as necessary to fulfill the specific purposes for which it was collected:
- Project Inquiries: Retained for the duration of scoping discussions and active client relationships. Inquiries that do not proceed to a contracted engagement are archived or deleted after 24 months of inactivity.
- Rate-Limiting Hashes: Salted IP hashes are maintained exclusively in volatile memory caches and expire automatically within 10 to 60 minutes.
- Error Telemetry: Diagnostic error reports sent to Sentry are automatically purged after 90 days.
- Client Contracts & Invoices: Financial transaction records and signed Statements of Work are retained for statutory periods required by applicable corporate and tax laws (typically 6 to 7 years).
Security Safeguards
We employ technical and organizational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, or unauthorized access:
End-to-End Encryption
TLS 1.3 encryption across all public web and API endpoints, enforced with strict HSTS headers.
Scoped API Secrets
All CRM and database secrets are stored strictly on server environments; zero secrets are bundled into client code.
Zero-Cache Headers
API responses carry strict `no-store` headers to ensure form submissions are never cached on intermediary proxies.
User Privacy Rights
Depending on your location and applicable privacy legislation (e.g. GDPR in the European Union and United Kingdom, or CCPA/CPRA in California), you have specific statutory rights regarding your personal information:
- →Right of Access: Request a copy of the personal data we hold about you.
- →Right to Rectification: Request correction of inaccurate or incomplete information.
- →Right to Erasure: Request deletion of your data when retention is no longer required.
- →Right to Restrict: Request limitation of data processing under certain circumstances.
- →Right to Portability: Receive your data in a structured, commonly used machine-readable format.
- →Right to Object: Object to processing conducted under our legitimate interests.
To exercise any of these rights, please email us directly at hello@ideaandworks.com with the subject line "Privacy Request". We respond to all verified requests within 30 days without charge.
Protection of Minors
Our website and studio services are directed exclusively at commercial entities and adults aged 18 and older. We do not knowingly solicit or collect personal data from individuals under 18. If we discover that a minor has submitted personal information, we promptly delete that information from our records.
Policy Revisions
We may periodically update this policy to reflect changes in our service offerings, website architecture, or evolving international privacy regulations. When updates are published, the "Last updated" date at the top of this document will be revised accordingly. Continued use of our website after changes are posted constitutes acknowledgement of the updated terms.
Contact Information
For questions regarding this Privacy Policy, data governance practices, or to submit a privacy request, please contact our team: