Legal · Privacy

Privacy Policy

Last updated:

The Yellow Labs (“we”, “us”) runs this website at theyellowlabs.com. This page explains what personal information we collect when you visit, why we collect it, who else sees it, and what rights you have. We've tried to keep it plain — if anything is unclear, write to us at hello@theyellowlabs.com and we'll explain.

1. Who we are

The Yellow Labs is a software studio based in India. For the purposes of this policy, we are the “Data Fiduciary” under India's Digital Personal Data Protection Act, 2023 (DPDP Act), and the “Data Controller” under the UK GDPR and EU GDPR for visitors from those regions. Contact: hello@theyellowlabs.com.

2. What we collect

We deliberately collect as little as possible.

  • Contact form submissions. When you fill in our contact form we collect your name, email, company name (optional), and the details of your inquiry. We do not store this in a database — the message is sent straight to our email inbox and lives there.
  • Newsletter signups. If you submit your email via the newsletter form in our footer we store your email address in our Resend audience to send occasional newsletter emails. We do not collect any other field. You can unsubscribe at any time using the link in any email we send.
  • Analytics. We use Google Analytics and PostHog to understand which pages are visited and how. Both drop cookies in your browser and process IP-derived data (approximate location, device, browser). We do not link analytics data to identifiable individuals.
  • Product analytics and session recording (PostHog). In addition to page-view counts, PostHog records the events that happen on the site — clicks, navigation, scroll depth, Core Web Vitals — and a sampled recording of how visitors move through pages. This helps us see which parts of the site work and which are confusing. Password and email input fields are masked in recordings; other text inputs (such as contact-form name and message fields) are visible. We never attach a name or email to recordings unless you submit them through the contact form.
  • Bot protection. We use Cloudflare Turnstile on the contact form to keep bots out. Cloudflare may briefly process your IP address and browser fingerprint to issue a challenge token. They do not see the contents of the form.
  • Server logs. Our hosting (Vercel) keeps short-lived request logs (IP, timestamp, URL, user agent) for operational and security purposes.

We do not use tracking pixels, advertising cookies, retargeting, fingerprinting, or third-party marketing tags beyond what is listed above.

3. Why we collect it

  • To reply to your inquiry. Contact-form data is used to discuss your project and (if it goes ahead) to set up the engagement. Legal basis under GDPR: taking pre-contractual steps at your request.
  • To send you the newsletter. If you sign up via the footer form, we use your email to send occasional newsletter emails. Legal basis under GDPR: consent (which you can withdraw at any time via the unsubscribe link).
  • To improve the site. Analytics tells us which content is read, which pages bounce, and which load slowly. Legal basis: legitimate interest in improving the site.
  • To keep the site safe. Turnstile and server logs protect us from automated abuse. Legal basis: legitimate interest in security.

4. Who else sees your data

We share data only with the third parties we depend on to run the site:

We do not sell, rent, or share your personal information with advertisers or data brokers. We will only disclose data to law enforcement if compelled by a valid legal order.

5. International transfers

We're based in India. If you contact us from the UK, EU, US, or anywhere else, your contact-form data will travel to and be processed in India (and, transiently, in the regions where the third parties above operate). Where required by UK or EU GDPR, we rely on the “necessary for the performance of a contract / pre-contractual steps” basis (Article 49(1)(b) GDPR) for these transfers.

6. How long we keep it

  • Contact-form messages stay in our email inbox indefinitely unless you ask us to delete them.
  • Analytics datais retained for Google's default period (14 months on the standard plan).
  • Server logs are kept by Vercel for a short operational window (typically days to a few weeks).

7. Your rights

Depending on where you live, you may have the right to:

  • Ask what data we hold about you
  • Ask us to correct or delete that data
  • Withdraw consent for analytics (by blocking cookies in your browser)
  • Object to specific processing
  • Complain to a data protection authority (e.g., the UK ICO, your EU national DPA, or India's Data Protection Board once operational)

To exercise any of these, email hello@theyellowlabs.com. We'll respond within 30 days.

8. Children

This site is aimed at businesses. We don't knowingly collect personal data from children under 13 (or under 16 in the EU/UK). If you think a child has submitted data through our form, email us and we'll delete it.

9. Changes to this policy

We may update this policy as the site evolves. The “Last updated” date at the top reflects when we last meaningfully changed it. Substantive changes will be highlighted in this section.

10. Contact us

Questions, complaints, or requests: hello@theyellowlabs.com.