Privacy Policy
Last updated: 12 October 2026. This policy explains what personal data ADG Advisory collects through this website, why, who sees it, how long we keep it, and how you can exercise your rights. It is written to meet India's Digital Personal Data Protection Act, 2023 (DPDP Act), the EU and UK GDPR, and similar laws where our visitors live.
1. Who we are
ADG Advisory is a GenAI-native Fractional CMO practice operated by Abhiraj Das Ghosh and based in Bangalore and Kolkata, India. We decide why and how the personal data described here is used: we are the “data fiduciary” under the DPDP Act and the “controller” under the GDPR and UK GDPR. The website adg-advisory.com is owned and run by ADG Advisory.
Who to contact. Abhiraj Das Ghosh, Founder, ADG Advisory, abhiraj@adg-advisory.com. This person answers privacy questions, handles your rights requests and is our grievance contact.
2. What we collect, why, and on what basis
We collect only what is needed for the purposes below. For visitors in India we rely on your consent, given by the action you take (submitting a form, ticking a box, accepting cookies). For visitors in the EU and UK we rely on the legal basis shown. This site is for business use by people aged 18 or over.
| What | Why | Basis (EU and UK) |
|---|---|---|
| Hexagram Diagnostic: your name, work email, company (optional), your twelve answers and the score they produce. | To score your answers, show and email your Gap Map, and follow up on your result if you ask us to. | Doing what you asked (Art. 6(1)(b)), and our legitimate interest in following up a business enquiry (Art. 6(1)(f)). |
| Enquiries: your name, email, company (optional) and message, sent through the contact form or by email. | To reply to you and, if we work together, to manage that relationship. | Legitimate interest in answering business enquiries (Art. 6(1)(f)). |
| Resource downloads: your email and first name, entered into the Google Form for a free resource. | To send you the resource you chose. | Doing what you asked (Art. 6(1)(b)). |
| Marketing emails: your email and name, only if you tick the optional box on a form. | To send occasional emails about marketing and AI, and the follow-ups to a resource you downloaded. | Your consent (Art. 6(1)(a)), which you can withdraw at any time. |
| Anonymous site activity: which pages are viewed, which calls to action are clicked, how far a visit gets through the Diagnostic, and the site or search engine that referred the visit. | To see what works and fix what does not. It identifies no one: see section 3. | Legitimate interest in improving the website (Art. 6(1)(f)). |
| Analytics and marketing measurement: Google Analytics 4 and the Meta Pixel, and a remembered first-visit source, only if you accept them. | To understand how visitors use the site and how our advertising performs. | Your consent (Art. 6(1)(a)). |
| Security: your IP address as it reaches our servers, kept as a keyed hash for up to 7 days, and the result of a Cloudflare Turnstile check on forms. | To stop spam and abuse and to keep the site secure. | Legitimate interest in security (Art. 6(1)(f)). |
We do not collect special categories of personal data (such as health, religion or biometric data) and ask you not to send them to us. We do not sell personal data.
3. Anonymous site activity
We keep a simple record of how the website is used, in our own database. It stores no name, email address, IP address, user agent or cookie, and nothing about it is written to your device. A random code held in your browser's memory links the steps of one visit and disappears when you close or reload the page. Page addresses are stored without any query string. It is switched off for browsers that send Global Privacy Control or Do Not Track. Records are deleted after 180 days.
4. How the Hexagram Diagnostic works
Your twelve answers are scored automatically by fixed rules in our own software, and the result is shown on screen and emailed to you. No AI model scores or interprets your answers. Abhiraj receives a notification of each submission and may follow up personally. The score is a self-assessment summary: it is not a decision about you with legal or similarly significant effect, and nothing is decided about you solely by automated means.
5. Who receives your data
We use a small number of service providers, who process data on our behalf and only for the purposes above. We do not sell your personal data or share it for advertising, except through the Meta Pixel if you accept marketing cookies.
| Provider | What it does for us |
|---|---|
| Vercel | Hosts the website and runs its server functions. Also collects anonymous page-speed measurements (Speed Insights) with no cookies. |
| Neon | Database for Diagnostic submissions and the anonymous site activity record. |
| Upstash | Redis store for rate limiting and for the follow-up email sequence you opt into. |
| Resend | Sends our emails and holds the mailing list of people who opted in. |
| Cloudflare | Turnstile, a privacy-focused check that a form is being filled in by a person. |
| Google Forms (resource downloads), Google Calendar appointment pages (booking a call), Google Search Console (search performance, aggregated), and Google Analytics 4 if you accept analytics. | |
| Meta | The Meta Pixel, only if you accept marketing cookies, and WhatsApp if you choose to message us there. |
| Razorpay | Takes payment for workshops on its own page. We receive confirmation of payment, not your card details. |
We may also disclose data where the law requires it, or to protect our rights. If the business is ever sold or reorganised, personal data may transfer to the new owner under this policy.
6. Transfers outside your country
Our providers operate internationally, and your data may be processed in the United States and other countries. If you are in India, the DPDP Act allows transfers except to countries the Government of India restricts. If you are in the EU or UK, we rely on the safeguards each provider offers, such as the EU-US Data Privacy Framework or standard contractual clauses with the UK addendum. Ask us at the address in section 1 for details.
7. How long we keep data
| Data | Kept for |
|---|---|
| Diagnostic submissions | 24 months after you submit, then deleted, unless you become a client, when it becomes part of the client record. |
| Enquiry emails | While we are in conversation and for up to 24 months after the last message. |
| Marketing email list | Until you unsubscribe or ask us to delete you. After you unsubscribe we keep a hashed record of that fact, and not your address, so we never email you again by mistake. |
| Follow-up sequence state | Up to 400 days, or until you unsubscribe. |
| Anonymous site activity | 180 days. |
| Security data | Up to 7 days. |
| Google Analytics | Under Google's settings for our account, which we set to the shortest available period. |
We delete or anonymise data sooner when you ask us to, subject to what the law requires us to keep.
8. Your rights
Everyone
You can ask us to tell you what personal data we hold about you and how we use it, to correct or update it, to delete it, and to stop sending you marketing email. You can withdraw any consent at any time, as easily as you gave it.
India (DPDP Act)
You have the right to a summary of your personal data and the processing we do, to correction, completion and updating, to erasure when it is no longer needed for the purpose it was collected for, to grievance redressal, and to nominate another person to exercise these rights for you if you die or become unable to. If we cannot resolve a grievance, you may complain to the Data Protection Board of India once it is operating.
EU and UK (GDPR and UK GDPR)
You also have the right to restrict processing, to receive your data in a portable format, and to object to processing based on our legitimate interests. You may complain to your local data protection authority: in the UK, the Information Commissioner's Office (ico.org.uk); in the EU, the authority in your country of residence.
United States and other regions
Residents of US states with privacy laws, including California, may ask to know, access, correct and delete their personal data and to opt out of its sale or sharing. We do not sell personal data. If you accept marketing cookies, the Meta Pixel may count as sharing for advertising: you can refuse it in our cookie settings, and we treat a Global Privacy Control signal as that refusal. We will not treat you worse for using these rights. Visitors in the UAE and elsewhere have the rights their local law gives them, and we will honour them in the same way.
How to use your rights
Email abhiraj@adg-advisory.com with what you want us to do. We may ask you to confirm who you are before we act. We aim to reply within 30 days and will tell you if we need longer and why. There is no charge unless a request is plainly excessive. To stop marketing email you can also use the unsubscribe link in any email we send.
9. Cookies and similar technologies
Nothing in the optional categories runs until you choose. You can choose when you first visit, and change your mind at any time with “Cookie settings” in the footer. Choosing neither costs you nothing on this site. Withdrawing consent switches the tool off immediately and deletes its cookies.
| Name | Category | What it does | Lasts |
|---|---|---|---|
| adg_consent (local storage) | Necessary | Remembers your cookie choice. | Until you clear it or change your choice. |
| Cloudflare Turnstile | Necessary | Checks that a form is filled in by a person. May hold a short-lived token. | Short-lived. |
| adg_first_touch (local storage) | Analytics | Remembers which source first brought you here, so a later Diagnostic can be attributed to it. | Until you withdraw consent or clear it. |
| _ga, _ga_<id> | Analytics | Google Analytics 4: counts visits and shows how pages are used. | Up to 2 years. |
| _fbp | Marketing | The Meta Pixel: measures the performance of our advertising. | Up to 90 days. |
10. Children
This website is for business use and is not directed at anyone under 18. We do not knowingly collect personal data from children, and we do not track or advertise to them. If you think a child has given us personal data, email us and we will delete it.
11. Security and data breaches
We protect personal data with encryption in transit, access limited to the people who need it, rate limiting and bot checks on forms, and providers that maintain their own security programmes. If a breach is likely to harm you, we will tell you and the authorities as the law requires, including the Data Protection Board of India and, for EU and UK data, the relevant authority within 72 hours.
12. Marketing emails
We send marketing email only to people who ticked the optional box on a form. Every marketing email has an unsubscribe link and a postal address for us, and unsubscribing takes one click. Completing the Diagnostic, sending an enquiry or downloading a resource does not by itself put you on a marketing list.
13. Changes to this policy
We will update this policy when the website, our tools or the law changes, and show the date at the top. If a change needs your consent again, we will ask. This is version 2026-10-12.