Who is responsible
James Munluah, sole proprietor, trading as Yedid Studio. Under India’s Digital Personal Data Protection Act 2023 that makes us the data fiduciary for everything described below, which in plain terms means we decide what is collected and why, and we are the ones answerable for it.
The person answerable is James Munluah, reachable at privacy@yedidstudio.com. That is a real address read by a real person, not a form that goes nowhere.
There is no database
This is the single most useful thing to know about how the studio handles your data, so it goes near the top rather than buried in a clause. Nothing you submit through this site is written to a database. Every form sends an email and stops.
That means what really holds your information is an inbox, and the retention promise further down is a promise about a mailbox that a person keeps by hand. We would rather say that plainly than describe an automated deletion process we do not run.
What each form collects
The contact form
Collects your name, your email address, your organisation (optional), what the message is about, the message itself.
To read your message and reply to it.
It is emailed to the studio inbox and you get an automatic acknowledgement. It is not written to any database.
The project enquiry form
Collects your name, your email address, your company, what you want to achieve, the problem in your words, your budget range, your timeline.
To judge whether the studio is a fit for the work before either side spends an hour on a call finding out.
It is emailed to the studio inbox and you get an automatic acknowledgement. It is not written to any database.
The prayer request form
Collects your name, your email address, your phone number, the prayer request itself, the topics you tag it with, which include anxiety, grief, health, relationships and family, whether you would like someone to talk to you.
So the request can be prayed for, and so someone can contact you if you asked them to.
It is delivered by FormSubmit.co, a third-party form service, to the ministry inbox. It is not written to any database.
What is collected without you typing it
- A shortened version of your IP address and the time, included in the notification email so abuse of a form can be traced. The last part of the address is replaced with xxx before it is written anywhere. (The contact and project enquiry forms only)
- Your full IP address, held in the server’s memory for up to one hour purely to rate-limit the forms. It is never written to disk and is lost when the server instance recycles. (The contact and project enquiry forms only)
- Your IP address, sent to FormSubmit.co in full when you submit a prayer request, because your browser posts straight to them rather than through this site. Like most services they may log it. We never see it and it is not shortened, because the request does not pass through our server at all. (The prayer request form only)
- Aggregate page-view counts through Vercel Web Analytics, which sets no cookies and does not build a profile of you. (Every page on this site)
- The country your request came from, read from a header at the edge, used only to decide whether to show prices in rupees or dollars. (Every page on this site)
There is no advertising network on this site, no behavioural tracking, and nothing here is sold or shared for marketing.
Cookies, and why there is no banner
Every page the studio serves — this one, the home page, the services, the writing, the case studies — sets no cookies. Not one. There is no advertising pixel, no tag manager and no third-party script. Booking a call sends you to Cal.com’s own site rather than loading it inside this one.
Vercel Web Analytics counts page views without a cookie and without an identifier that follows you between visits, which is why there is nothing here to ask your permission for. A banner asking you to consent to tracking that does not happen would be a dark pattern, not compliance, so this page says the position instead.
The one thing stored on your device
Two of the interactive demos in the concepts library keep what you type in your own browser, using localStorage.
It is the feature. A budget tracker that forgets your budget when you refresh is not a budget tracker. It never leaves your device, it is never sent to us, and clearing your browser data removes it.
The exception, stated rather than glossed over
The concepts library holds standalone demo pages, built before the studio wrote this position down, and they are not as clean as the rest of the site. If you open one:
- Most of the demos, and the prayer request page, load their typefaces from Google Fonts rather than from this site. Your browser asks Google for the font file, which tells Google your IP address and which page you asked for. It does not tell Google what you typed.
- One demo, a restaurant concept, loads its photographs from Unsplash. The same effect, with Unsplash rather than Google.
- That same demo embeds a Google map of a fictional address. This is the one thing on this domain that can set a cookie, and it is Google’s cookie rather than ours. It loads only if you open that particular demo.
None of it is our tracking and none of it tells us anything. It is still a request your browser makes to a company that is not us, which is why it is written here rather than left inside the word “site”. Tidying those pages is on the studio’s own list.
If any of this changes — if the studio adds a tracker, an embed or anything that stores an identifier on your machine — this section changes first and you will be asked properly where the law requires it. That is enforced by an automated test rather than by anyone remembering.
Why we are allowed to hold it
You typed it into a form and pressed send, for a purpose stated on that form. Under the Act that is your consent, and for an enquiry it is also the voluntary provision of your own data for a purpose you approached us about. We use it for that purpose and not for another one.
If we ever wanted to use what you sent for something else, we would ask you first. We have no marketing list, so submitting a form does not subscribe you to anything.
How long it is kept
If your enquiry became an engagement, we keep the correspondence for 24 months after the work ends, because a live business relationship is a real reason to hold it.
If it did not, we delete it within 12 months.
You do not have to wait for either. Ask and it goes sooner.
Who else touches it
Running a website means other companies handle your data on our behalf. This is the complete list, and each one is named for what it actually does rather than described in a category.
- Vercel — Hosts the site and runs the code that receives the forms. (All pages and forms)
- Resend — Delivers the notification and acknowledgement emails. (Contact and project enquiry forms)
- Google Workspace — Hosts the inbox where submissions arrive and rest. (All studio email)
- Cal.com — Takes the booking when you schedule a diagnostic call. (Booking a call)
- FormSubmit.co — Delivers the prayer request to the ministry inbox. (Prayer request form only)
- Supabase — Stores the research papers the site publishes. It holds no visitor data. (The research library)
Several of these are based outside India and store data on servers outside India. The Act permits that except to countries the government specifically restricts, and none of these are in that position as at the date on this page.
The prayer requests, specifically
The prayer form on prayer.yedidstudio.com is a ministry, not a service the studio sells, but it collects the most personal thing on any of these pages and so it gets its own section rather than being folded into a list.
A prayer request often carries illness, family difficulty, or money trouble. It is delivered by FormSubmit.co, a third-party form service outside India, and it arrives in an inbox read by the person who prays for it. It is not published, not shared, and not used for any studio purpose. Your phone number is used only if you asked to be contacted.
Two smaller things about that page specifically, since it is the most sensitive one here. It loads its typefaces from Google Fonts, so opening it tells Google your IP address, though never what you wrote. And because the form posts straight from your browser to FormSubmit.co, your full IP address goes to them and is not shortened the way it is on the studio’s own forms.
If you would rather it were not handled by a third-party form service, email the request to privacy@yedidstudio.com instead and it will reach the same place.
Children
None of these forms is aimed at anyone under 18, and the studio does no profiling or targeted advertising at all, so none of it can be directed at a child. If you are under 18, ask a parent or guardian before sending a prayer request. If you believe a child has sent us something, tell us and we will delete it.
What you can ask us to do
All of these go to privacy@yedidstudio.com. We aim to answer within 30 days; that is our own commitment, not a figure taken from the Act.
Ask what is held on you
Email the grievance officer and you get a summary of what the studio holds, what it has been used for, and who else has touched it.
Correct or complete it
If something is wrong, say so and it is corrected.
Have it erased
Ask and it is deleted, unless there is a legal or contractual reason to keep it, in which case you are told what that reason is.
Withdraw your consent
Email the grievance officer. Withdrawing is deliberately no harder than sending the form was.
Nominate someone
You can name a person to exercise these rights for you if you die or cannot act for yourself.
Complain
Raise it with the grievance officer first. If the answer does not satisfy you, you can take it to the Data Protection Board of India.
If something goes wrong
If your data is exposed in a way it should not have been, we will tell you and we will tell the Data Protection Board. We will not sit on it while deciding how bad it looks.
Changes, and what this page is not
If what we do changes, this page changes with it and the date at the top moves. This notice describes what the studio actually does today. It is not legal advice, and it is not a claim to have been certified by anyone.
The DPDP Rules were still being finalised when this was written, so some mechanics the law will eventually prescribe are not settled yet. Where that is true we have described our own practice rather than assert a standard that does not exist.
The commercial terms live separately. Read the terms.