Privacy.Phace Two privacy policy: what we collect, and why

What we collect

What you send us. When you use the contact form we receive your name, a WhatsApp number or an email address (or both), what you need help with, a budget range if you pick one, and your message. We use the number's country code or the ending of the email address to guess which market you're in, so the right strategist replies. If you email or WhatsApp us, we receive whatever you include in those messages.

Where your visit came from. Your brief also names the page of this site you sent it from (its address only), so we know what you were reading. Your browser keeps where your visit started (the campaign tags in the link you arrived on, such as UTM parameters and ad click IDs, the website that referred you and the first page you landed on) in session storage only until you close the tab. None of that goes into your brief. We never use it to profile you.

Technical data. Like every website, our hosting provider keeps standard server logs (IP address, browser type, pages requested, time) for security and troubleshooting.

Analytics data. Only if you accept analytics cookies: how the site is used, and recordings of how pages are scrolled and clicked. See cookies and analytics below.

We don't ask for sensitive data. Please don't send passwords, payment card details, health records or government ID numbers through the form.

How we use it

• To reply to your enquiry, set up a discovery call and prepare a proposal.
• If we work together, to run the engagement: agreements, invoices and project communication.
• To keep the site secure and filter out spam and abuse.
• To understand, in aggregate, which pages are useful so we can improve them.

Under India's Digital Personal Data Protection Act, 2023 and the UAE Personal Data Protection Law, we process enquiry data, including where your visit came from, on the basis of the consent you give when you send it, and analytics data on the basis of the consent you give in our cookie banner. You can withdraw either consent at any time, as easily as you gave it. Security logs are processed for legitimate uses the law allows, and client data under our contract with you.

We don't sell or rent personal data, and we don't use it for automated decisions or advertising profiles.

How form submissions reach us

When you send the contact form, nothing you typed goes to our server. Your browser opens WhatsApp with your brief typed in, and it reaches us only when you press send there. WhatsApp (Meta) delivers that message under its own privacy policy (opens in a new tab), and shows us the number and profile name of the WhatsApp account you send it from. If you choose “Prefer email?” instead, your own email app opens with the same brief, addressed to hello@phacetwo.com, and it reaches us when you send it.

Once it arrives, your brief sits in our business WhatsApp or our inbox, which only the people handling new enquiries can access.

Lead register. We may also log each enquiry as one row in a lead register, with the details of your brief, so no enquiry slips through. The register is a spreadsheet in our own business account (for example Google Sheets) and follows the same access limits and retention as our WhatsApp and inbox.

Cookies and analytics

Essential. The site works without cookies. Fonts are served from our own domain, so your browser doesn't contact a font service when you visit. We remember your cookie choice in your browser so the banner doesn't ask again on every page, and keep the session's source details (above) in session storage for the contact form.

Analytics (only with your consent). We use two services, and neither loads until you choose “Accept” in our cookie banner. If you decline or ignore the banner, they don't load at all.

• Google Analytics 4 (Google LLC) counts visits, shows which pages are read and where visitors come from, and records when the contact form opens WhatsApp or a WhatsApp, call or email link is clicked. It sets cookies that don't identify you by name, and we don't use it for advertising profiles.
• Microsoft Clarity (Microsoft Corporation) shows heatmaps and session replays so we can fix what confuses people. Replays are anonymous recordings of how pages are scrolled and clicked. Text you type into forms is masked, so it is never recorded.

Changing your mind. Choose “Cookie settings” at the foot of any page to withdraw or give consent at any time; withdrawing stops the analytics from then on. The legal basis for analytics is your consent, under India's Digital Personal Data Protection Act, 2023 and the UAE Personal Data Protection Law. Google and Microsoft may process this data outside India and the UAE, including in the United States.

You can block or delete cookies in your browser settings at any time, and the site will keep working.

Who we share it with

We share personal data only with service providers who help us run the site and reply to you:

• our website hosting provider;
• WhatsApp (Meta), which carries the brief you send from the contact form;
• our business email provider, and our spreadsheet provider if the lead register is switched on;
• Google (Analytics 4) and Microsoft (Clarity), only if you accept analytics cookies.

Each receives only what it needs to do its job. We may also disclose data if the law requires it, or to protect our rights and the safety of others. Links to WhatsApp, Instagram, LinkedIn and Facebook take you to those services, which follow their own privacy policies.

How long we keep it

• Enquiries that don't become projects (including their source details and any lead register row): up to 24 months, so we have context if you come back. After that we delete them.
• Analytics: Google Analytics event data for no more than 14 months; Clarity recordings and heatmaps for the limited periods Microsoft sets for the service. We don't link either to your name or your enquiry.
• Client records: for the length of the engagement, and afterwards for as long as Indian tax and accounting law requires.
• Server logs and anti-spam data: short rolling periods. The in-memory IP list clears within an hour.

Your rights

In India, under the Digital Personal Data Protection Act, 2023, you can ask for a summary of the personal data we hold about you and how we use it, ask us to correct, complete, update or erase it, withdraw consent, have a grievance addressed, and nominate someone to exercise these rights for you if you can't. If you're not satisfied with how we handle a grievance, you can complain to the Data Protection Board of India.

In the UAE, under Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, you can ask to access your data, have it corrected or erased, restrict or object to its processing, receive it in a portable format, and withdraw consent.

Everywhere else, we honour the same requests.

To make a request, email hello@phacetwo.com with “Privacy request” in the subject. We may ask you to confirm your identity first, and we aim to respond within 30 days.

Keeping it safe

The site runs over HTTPS, and access to enquiries is limited to the people who need it. No system is perfectly secure, so if you think something is wrong, tell us at hello@phacetwo.com and we'll look into it straight away.

Children

This site is meant for businesses and isn't directed at anyone under 18. We don't knowingly collect personal data from children; if you believe a child has sent us their details, contact us and we'll delete them.

Changes to this policy

When we update this policy we change the date at the top of the page. If a change affects how we use data you've already given us, we'll say so clearly on this page before it takes effect.

Contact and grievances

Questions, requests and grievances about your personal data go to:

See also our terms of use.