Privacy Policy

The short version: nothing is collected about you unless you type it into a form, or open a report link we sent you. This site loads no analytics, no advertising and no third-party trackers. Questions or requests go to hello@gaash.ai.

1. What this policy covers

This page describes what gaash.ai collects when you use this website, why it is held, how long it is kept, who else sees it, and how to have it corrected or removed. It covers the public site at gaash.ai and the report pages served under it.

This is a plain description of how the site works, not a legal certification. If something here is unclear or looks wrong, write to hello@gaash.ai and you will get a straight answer.

2. Who is responsible

gaash, the company behind gaash.ai, runs this website and decides what happens to the information described below. It is reachable here:

gaash
3R78+8J5, Jawahar Nagar
Srinagar 190008
Jammu and Kashmir, India
Email: hello@gaash.ai

Every request in this policy — a copy of what is held, a correction, a deletion, withdrawing a consent you gave earlier — goes to that address and is read by a person.

3. What you send us through a form

The forms on this site — the contact form, the visibility check, the question form on a report, the signup page you reach from a button to buy the audit, and the forms on the free-tool pages — all land in the same table in the database behind this site.

What is stored is what you typed: your name, email address, company, phone number, website, and your message. Only the email address is required, because without it there is no way to reply. Everything else is optional, and a field you leave blank is stored empty. The signup pages (gaash.ai/c/signup, and the buy page when you buy and sign up in one go) also ask you to choose a password for your login. Supabase, the service that runs our logins, keeps it only as a one-way hash, which means nobody can read it back, and we never ask you for it by email.

Two technical values your browser sends with any request are stored alongside it: the referring page, which says which page of the site you submitted from, and your browser's user-agent string. A separate row records that a submission happened and includes the IP address the request came from. That IP is there to separate real enquiries from automated form spam and to enforce a simple submission rate limit. It is not used to identify or locate you.

If you buy the audit with a card, the payment page belongs to Razorpay, our payment processor, and your card details go to Razorpay, never to this site. Before the payment page, the signup page asks for your website, your email address and your phone number: the website is what the audit is of, and Razorpay needs the email and phone before it opens a payment page in US dollars. We keep those three as a record of your signup whether or not you finish paying, so that a person can send you an invoice instead or answer a question, and we pass the email and phone to Razorpay with the payment. Razorpay then tells us what we need to do the work: your name, email address and phone number, the amount, and, when you bought from a report or from your own engagement page, the website it is for. Razorpay's own privacy policy governs what it holds; ours governs that record.

4. Why it is held, and who else sees it

It is held for one purpose: to answer you, and to keep track of the conversation that follows. It is not sold, rented, traded, or added to a mailing list you did not ask for, and it is not used to build a profile of you.

Two services touch it. The database sits with the provider that hosts this site. When a submission arrives, a notification email goes out through Resend, the service used to deliver mail, to our own inbox — that message repeats what you typed so a person can reply to you directly. Nobody else receives it. If you make a login, a third service holds the login itself: Supabase keeps your email address, your password as a one-way hash, and when you signed in, and sends the emails that confirm your address or reset your password. Everything else about you stays in our own database.

When you send a form you get one short confirmation by email — what we received and when a person replies. Then we reply to you by email, and we may follow up on a conversation you started. If you would rather we stopped, say so and we stop.

5. Report links

Some people receive a link to a report prepared for their business, at an address of the form gaash.ai/report/ followed by the business's name. Opening such a page writes a single row recording which report it was, the time it was opened, and a shortened copy of your browser's user-agent string. If you press a button that starts a purchase or a booking — on a report, on the price list, on the audit page, on the contact page, on your dashboard — one more row records which button and when. That is the entire record — no page-by-page tracking, no scroll logging, no identifier beyond the report itself, and nothing stored in your browser.

It exists so we know whether a report that was sent has actually been read, which decides whether following up is worth anyone's time. Requests that look like crawlers, link previews or uptime monitors are not counted.

These pages are kept out of search engines through robots.txt and are not linked from anywhere public, but the address is the business's name, so anyone who types it can open the page. Everything on it comes from public websites and from the assistants' answers. If you want a report taken down, ask at hello@gaash.ai and it will be revoked. An email from us about a report carries a one-click unsubscribe link (gaash.ai/u/ followed by a code only that email carries); using it puts the business on our suppression list, permanently and across every channel, and stores nothing else.

6. Server logs

Like any website, this one runs on a hosting provider that keeps standard request logs: the address requested, the time, the response status, and the technical details every browser sends when it asks for a page, including the IP address. They exist so the site can be kept running and so abuse can be investigated.

They are not joined to form submissions, and they are retained and rotated on the hosting provider's own schedule.

7. What this site does not do

There is no analytics on this site. No Google Analytics, no privacy-friendly alternative, no self-hosted visit counter — nothing that measures your visit is loaded at all.

• No advertising pixels, and no conversion or retargeting tags.
• No social media embeds, session recording, heatmaps or chat widgets.
• Typefaces are served from this site itself, not fetched from a font network while you browse, so no third party is handed a record of your visit as a side effect of a page loading.
• Nothing you do here is shared with an advertising network or a data broker, and no cross-site profile of you is created or bought.

8. How long things are kept

Form submissions and the event row that goes with them are kept while a conversation is open, and afterwards, so that if you pick up a thread months later the earlier context is still there. There is no automatic purge and no fixed schedule to point to — which is the honest answer rather than a number invented for this page.

Report-open rows are kept for as long as the report they belong to is live; revoking a report link ends both. Server logs belong to the hosting provider and are rotated on its schedule. Anything held about you is deleted on request, as described next.

A copy of the database is kept off the hosting provider's machines so that everything can be restored if that provider loses it. Those copies are held on a controlled device, never handed to anyone else, and rotated: the most recent few, then one a month for a year, then deleted. A copy cannot be edited, so when you ask for your data to be deleted the copies made before your request are destroyed along with the live record.

9. Access, correction, deletion, and withdrawing consent

Write to hello@gaash.ai. You can ask for a copy of what is held about you, ask for something inaccurate to be corrected, ask for it to be deleted, or ask that we stop contacting you. A consent you gave earlier can be withdrawn the same way. You do not have to give a reason for any of it.

Please write from the email address you used on the form, or say which address to look under. That is how the right record is found, and how we avoid handing your details to someone else who claims to be asking on your behalf.

Requests are handled as quickly as they can be, and the reply says what was actually done rather than only acknowledging that the message arrived. If some part of a request cannot be met, the reply says which part and why.

10. If you buy something

If you buy the audit, approve an optimization quote, or start monitoring, our payment processor passes us your name, your email address and phone number, the amount, and the website it is for when the purchase started from a report or from your own page (for monitoring, also the subscription reference, so a renewal or a cancellation reaches the right record). That becomes a record of the engagement — what was bought, when it is due, when it was delivered — which you can see on a private page at an address of the form gaash.ai/c/ followed by a token. The link is in the email we send after payment, and gaash.ai/c sends it again to the address you paid with.

That page stores what you do on it: that it was opened (with the time and a shortened copy of your browser's user-agent string), the answers you give to our intake questions, the questions you send us and our answers to them, the calls booked, and which files you downloaded. We put files there for you — the audit and anything else we deliver — and you can send us files from the same page; those are stored the same way and read only by the person doing the work. You reach that page by the link in our email, or by logging in. Logging in sets Supabase's session cookie, sb-…-auth-token, which keeps you logged in until you log out; it says nothing about you, and scripts on the page cannot read it. Beside it, a cookie named gaash_in holds only the number 1, so the menu at the top of every page can offer your dashboard instead of the way to log in; the page's own script reads it, and it goes when you log out. While you sign in with Google, or follow a link from one of our emails, a third cookie holds a one-time code for the few minutes that takes. Nothing else is stored in your browser. Your dashboard also keeps the website you name on it and records which free checks you ask for from it. The link keeps working beside the login, and we replace it if you ask. If you choose to continue with Google, you are sent to Google's own sign-in page and back through Supabase: Google tells Supabase your email address, that it is verified, your name and your profile picture, under Google's privacy policy, and nothing of Google's loads on this site. To close your login, email hello@gaash.ai from its address.

If you book a call with us, the booking itself is handled by Cal.com, our scheduling provider, and what you type there — your name, your email address and your time zone — goes to Cal.com under their privacy policy. They tell us when the call is, the link to join it, and the time zone you booked in, so the call appears on your page at the time you chose rather than ours. That is what we keep: the time, the link, and whether the call happened. If we book a call for you instead, we record the same thing by hand and no third party is involved.

We email you about the engagement — a welcome with the link, updates when there is something to say, the answer to any question you send us, the delivery, and the link again if you lose it. Those messages go through Resend, the same service that carries our own notifications. They are about the work you paid for, not marketing, and there is no list to unsubscribe from because there is no list.

The record is kept while the engagement is open and afterwards, because the work refers back to it — a re-check compares against the first measurement. Ask at hello@gaash.ai and it is deleted, files included; the payment record itself stays with our payment processor for as long as its rules require.

11. Changes to this page

This page describes how the site works today. If the site changes, this page changes with it.

No analytics tool, tracker or third-party embed will be added while this page still says there are none. If anything is added that collects more than what is described above, this page will describe it too.