Privacy Policy
Last Updated: July 02, 2026
Effective Date: July 02, 2026
1. Introduction
Welcome to Incredible Virtual Assistant (“we,” “us,” or “our”). We are committed to protecting your personal data and your right to privacy. This Privacy Policy explains how we collect, use, disclose, retain, and protect information about you when you visit our website at incrediblevirtualassistant.com (the “Website”), use our services, or interact with us in any way.
Please read this Privacy Policy carefully. If you do not agree with its terms, please discontinue use of the Website. By accessing or using the Website, you acknowledge that you have read, understood, and agree to the practices described in this Privacy Policy.
This policy is designed to comply with, to the extent applicable:
- The Digital Personal Data Protection Act, 2023 of India (“DPDP Act”)
- The General Data Protection Regulation (EU) 2016/679 (“GDPR”) and the UK GDPR
- The California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (“CCPA/CPRA”)
- The CAN-SPAM Act of 2003
- Other applicable privacy and data protection laws
2. Who We Are
This Website is owned and operated by:
Shyam Nandikonda, trading as Incredible Virtual Assistant, a sole proprietorship registered in India under Nandikonda Matrix.
Registered Address: Road Number 3, Saraswati Nagar, Karimnagar, Telangana – 505001, India
Privacy Contact:
Email: privacy@incrediblevirtualassistant.com
Contact Form: https://incrediblevirtualassistant.com/contact/
For the purposes of the GDPR, we are the Data Controller. For the purposes of the India DPDP Act, we are the Data Fiduciary. For the purposes of the CCPA/CPRA, we are the Business.
3. Scope of This Policy
This Privacy Policy applies to:
- All visitors to the Website, regardless of location
- Individuals who submit inquiries through our contact form
- Individuals who book a free strategy session through our booking form
- Individuals who subscribe to our email communications
- Clients who engage our services and make payments
This Policy does not apply to third-party websites, applications, or services that may be linked to from our Website. We encourage you to review the privacy policies of any third-party services you access.
4. Definitions
For clarity throughout this policy:
- “Personal Data” / “Personal Information” means any information that identifies or could reasonably identify a natural person, directly or indirectly.
- “Processing” means any operation performed on personal data, including collection, storage, use, disclosure, or deletion.
- “Data Principal” / “Data Subject” means the natural person to whom personal data relates (i.e., you).
- “Consent” means a freely given, specific, informed, and unambiguous indication of your agreement to the processing of your personal data.
- “Legitimate Interests” means a processing purpose that is necessary for our genuine business needs, balanced against your rights and interests.
5. Information We Collect
We collect information in the following ways:
5.1 Information You Provide Directly
Contact Form When you submit our contact form, we collect:
- Full name
- Email address
- Phone number
- Business details (as provided by you)
Strategy Session Booking Form (via Calendly) When you book a free 15-minute strategy session, we collect:
- Full name
- Email address
- Phone number
- Business details (as provided by you)
- Shopify store monthly revenue range (selected from: Under $5,000 / $5,000–$10,000 / $10,000–$25,000 / Above $25,000)
Note on Revenue Range Data: The revenue range you provide is used solely to qualify session relevance and ensure the service is an appropriate fit for your business stage. It is not exact financial data, and we treat it with the same level of care and confidentiality as all other personal data.
Email Communications When you subscribe to or receive our email communications, we collect:
- Name
- Email address
- Communication preferences and engagement data (open rates, click rates — as managed by Brevo)
Client Engagement When you become a paying client, we additionally collect:
- Billing information (processed via PayPal — we do not store card details)
- Service-related business information necessary to deliver our services
5.2 Information Collected Automatically
When you visit the Website, certain information is collected automatically through cookies, pixels, and similar tracking technologies:
- IP address (which may indicate approximate geographic location)
- Browser type and version
- Device type and operating system
- Pages visited and time spent on each page
- Referring URLs (which website directed you to ours)
- Click and interaction data
- Session data and user behavior patterns
This information is collected through the following technologies:
Technology | Provider | Purpose |
Google Analytics 4 (GA4) | Google LLC | Website analytics and performance measurement |
Google Tag Manager (GTM) | Google LLC | Tag management and tracking coordination |
Google Search Console (GSC) | Google LLC | Search performance monitoring |
Meta Pixel | Meta Platforms, Inc. | Ad performance tracking and audience building |
Meta Conversions API (CAPI) | Meta Platforms, Inc. | Server-side event tracking for ad optimization |
ConsentMagic | PixelYourSite | Cookie consent management |
Google Fonts | Google LLC | Font rendering and display |
YouTube (embedded videos, if any) | Google LLC | Video content delivery |
5.3 Information from Third Parties
We may receive information about you from third parties, including:
- Meta Platforms (Facebook/Instagram): Audience match data when you interact with our ads
- Google: Audience and campaign data from Google Ads interactions
- Calendly: Booking confirmation and scheduling data
- Brevo: Email delivery and engagement statistics
6. How We Use Your Information
We use your personal data for the following purposes:
Purpose | Data Used | Legal Basis |
Responding to contact form inquiries | Name, email, phone, business details | Legitimate interests; pre-contractual steps |
Conducting free strategy sessions | Name, email, phone, business details, revenue range | Pre-contractual steps; legitimate interests |
Delivering our virtual assistant services to clients | All client data | Performance of contract |
Sending service-related and marketing emails | Name, email address | Consent (where required); legitimate interests |
Processing payments | Billing data via PayPal | Performance of contract; legal obligation |
Improving Website performance and user experience | Analytics data, cookies | Consent (for non-essential cookies); legitimate interests |
Running and optimizing paid advertising campaigns | Pixel data, CAPI data, anonymized audience data | Consent (for marketing cookies); legitimate interests |
Complying with legal obligations | All data as required | Legal obligation |
Protecting against fraud and unauthorized use | IP address, device data | Legitimate interests; legal obligation |
Retargeting and custom audience building for ads | Hashed contact data (via Meta CAPI / Google) | Consent |
We do not use your personal data to make automated decisions that produce legal or similarly significant effects about you without human involvement.
7. Legal Basis for Processing (GDPR / UK GDPR)
If you are located in the European Economic Area (EEA) or the United Kingdom, we process your personal data on the following legal bases under Article 6 of the GDPR:
- Contractual Necessity (Article 6(1)(b)): Processing necessary to enter into or perform a contract with you, including delivering our services and processing payments.
- Legitimate Interests (Article 6(1)(f)): Processing necessary for our legitimate business interests, including responding to inquiries, improving our website, and securing our systems, where such interests are not overridden by your rights.
- Consent (Article 6(1)(a)): Processing based on your freely given, specific, and informed consent, including for marketing emails, non-essential cookies, and advertising tracking. You may withdraw consent at any time without affecting the lawfulness of processing based on consent before withdrawal.
- Legal Obligation (Article 6(1)(c)): Processing necessary to comply with applicable laws and regulations.
8. How We Share Your Personal Data
We do not sell, rent, or trade your personal data to third parties for their own marketing purposes.
We share personal data only in the following limited circumstances:
8.1 Service Providers and Technology Partners
We share data with the following third-party service providers who process data on our behalf:
Service Provider | Data Shared | Purpose | Privacy Reference |
Brevo (Sendinblue) | Name, email address | Email marketing delivery | |
Calendly | Name, email, phone, business details, revenue range | Booking management | |
PayPal | Billing and payment data | Payment processing | |
Atlassian (Trello) | Client name, email, and service-related business information contained in task cards | Task and project management for service delivery | |
Google LLC (Google Workspace) | Client name, email, files, and service-related business information (Gmail, Google Drive, Google Sheets task tracker) | Client communication, file storage, and task tracking for service delivery | |
Hostinger | Website data, server logs | Website hosting | |
Google LLC | Analytics, ad, and search data | GA4, GTM, GSC, Google Ads | |
Meta Platforms, Inc. | Event and audience data | Meta Ads, Pixel, CAPI | |
Automattic (WordPress.com) | Website operational data | CMS platform | |
PixelYourSite (ConsentMagic) | Cookie consent records | Consent management |
8.2 Future Service Providers
We may in the future engage additional service providers, including but not limited to:
- Customer Relationship Management (CRM) tools such as Zoho CRM, HubSpot, or GoHighLevel
- Heatmap and session recording tools such as Hotjar or Microsoft Clarity
When such tools are introduced, this Privacy Policy will be updated accordingly. New tools that involve the processing of your personal data will be subject to appropriate data processing agreements.
8.3 Legal Requirements
We may disclose your personal data if required to do so by law, regulation, legal process, or governmental authority, or if we believe in good faith that such disclosure is necessary to protect our rights, your safety, or the safety of others.
8.4 Business Transfers
In the event of a business merger, acquisition, restructuring, or sale of assets, your personal data may be transferred as part of that transaction. We will notify you via the email address associated with your data or via a prominent notice on the Website before your data becomes subject to a different privacy policy.
9. International Data Transfers
Our business is based in India, and we primarily serve clients in the United States. Your personal data may be transferred to, stored in, and processed in countries other than your country of residence, including India, the United States, and other countries where our service providers operate.
For EEA/UK Residents: When transferring your personal data outside the EEA or UK, we rely on the following transfer mechanisms:
- Standard Contractual Clauses (SCCs) adopted by the European Commission, where applicable
- Transfers to countries with an adequacy decision by the European Commission
- Providers participating in recognized frameworks such as the EU-U.S. Data Privacy Framework
For All Users: By using the Website and submitting your information, you acknowledge that your data may be transferred internationally in accordance with this Privacy Policy.
10. Data Retention
We retain your personal data only for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by applicable law.
Our specific retention periods are:
Data Category | Retention Period |
Contact form inquiries and leads | 2 years from last interaction |
Strategy session booking data | 2 years from session date |
Active client data and communications | Duration of the contract + 3 years |
Email marketing subscriber data | Until unsubscription + 30 days for processing |
Website analytics data (GA4) | 14 months (per GA4 platform default) |
Ad audience data (Meta / Google) | 180 days (per platform policies) |
Payment records | As required by applicable Indian tax and financial laws (generally 7 years) |
Cookie consent records | As required for audit and compliance purposes |
When personal data is no longer needed for the stated purpose and no legal obligation requires retention, we securely delete or anonymize it.
11. Data Security
We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:
- SSL/TLS encryption on all Website communications (HTTPS)
- Two-factor authentication on all accounts and platforms that store personal data
- Access controls — personal data is accessible only to authorized personnel (currently limited to the sole proprietor)
- Secure third-party processors — all service providers are contractually obligated to maintain appropriate security standards
- Data minimization — we only collect personal data that is actually necessary for the stated purposes
Please be aware that no method of transmission over the Internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal data, we cannot guarantee absolute security.
If you believe your data has been compromised, please contact us immediately at privacy@incrediblevirtualassistant.com.
12. Children's Privacy
Our Website and services are not directed to individuals under the age of 18. We do not knowingly collect, use, or disclose personal data from anyone under 18 years of age. If we become aware that we have inadvertently collected personal data from a minor, we will take immediate steps to delete such information. If you believe we have collected data from a minor, please contact us at privacy@incrediblevirtualassistant.com.
13. Your Privacy Rights
Depending on your location, you may have specific rights regarding your personal data. We will respond to valid requests within the timeframes required by applicable law.
13.1 Rights for EEA and UK Residents (GDPR / UK GDPR)
If you are located in the European Economic Area or the United Kingdom, you have the following rights:
- Right of Access: You may request a copy of the personal data we hold about you.
- Right to Rectification: You may request correction of inaccurate or incomplete personal data.
- Right to Erasure (“Right to be Forgotten”): You may request deletion of your personal data where there is no legitimate reason for continued processing.
- Right to Restriction of Processing: You may request that we limit the processing of your personal data in certain circumstances.
- Right to Data Portability: You may request to receive your personal data in a structured, commonly used, machine-readable format.
- Right to Object: You may object to processing based on legitimate interests or for direct marketing purposes.
- Right to Withdraw Consent: Where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
- Right to Lodge a Complaint: You have the right to lodge a complaint with your local data protection supervisory authority. For EU residents, this is your national Data Protection Authority. For UK residents, this is the Information Commissioner’s Office (ICO) at ico.org.uk.
Response Time: We will respond to GDPR requests within 30 days of receipt (extendable to 90 days for complex requests, with notice).
13.2 Rights for California Residents (CCPA/CPRA)
If you are a California resident, you have the following rights under the CCPA/CPRA:
- Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected about you, the categories of sources, our business or commercial purposes for collection, and the categories of third parties with whom we share it.
- Right to Delete: You may request deletion of personal information we have collected from you, subject to certain exceptions.
- Right to Correct: You may request correction of inaccurate personal information we maintain about you.
- Right to Opt-Out of Sale or Sharing: We do not sell or share your personal information for cross-context behavioral advertising to third parties for their independent use. However, our use of Meta Pixel, CAPI, and Google Ads tracking may constitute “sharing” under the CCPA/CPRA. You may opt out of this by managing your cookie preferences through our Cookie Consent Manager on the Website.
- Right to Limit Use of Sensitive Personal Information: To the extent we process sensitive personal information (such as financial revenue range data), you have the right to limit its use to necessary purposes.
- Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights.
How to Submit a California Request: You may submit a verifiable consumer request by:
- Emailing: privacy@incrediblevirtualassistant.com
- Using our contact form: https://incrediblevirtualassistant.com/contact/
We will respond to verifiable requests within 45 days (extendable to 90 days with notice).
Authorized Agent: California residents may designate an authorized agent to make requests on their behalf, subject to verification of the agent’s authority.
13.3 Rights for Indian Residents (Digital Personal Data Protection Act, 2023)
If you are a resident of India, you have the following rights as a Data Principal under the DPDP Act, 2023:
- Right to Access Information: You may request a summary of the personal data we process about you and the processing activities undertaken.
- Right to Correction and Erasure: You may request correction of inaccurate or outdated personal data, and erasure of personal data no longer needed for the stated purpose.
- Right to Grievance Redressal: You may seek grievance redressal regarding the processing of your personal data.
- Right to Nominate: You may nominate another individual to exercise your rights in the event of your death or incapacity.
Grievance Officer (as required under the DPDP Act): Shyam Nandikonda
Email: privacy@incrediblevirtualassistant.com
Address: Road Number 3, Saraswati Nagar, Karimnagar, Telangana – 505001, India
We will acknowledge your grievance within 48 hours and aim to resolve it within 30 days.
14. Email Communications and CAN-SPAM Compliance
We may send you commercial emails in connection with our services or marketing activities. In compliance with the CAN-SPAM Act of 2003:
- All commercial emails will clearly identify themselves as commercial communications
- All commercial emails will include our physical mailing address
- All commercial emails will include a clear and conspicuous unsubscribe mechanism
- We will honor all opt-out/unsubscribe requests within 10 business days
- We will not use deceptive subject lines or misleading “From” names
To unsubscribe from our marketing emails, click the “Unsubscribe” link in any email we send you, or contact us at privacy@incrediblevirtualassistant.com.
15. Cookie Policy
This section explains how we use cookies and similar tracking technologies on our Website, in accordance with applicable laws. This Cookie Policy is embedded within and forms an integral part of this Privacy Policy.
15.1 What Are Cookies?
Cookies are small text files placed on your device by websites you visit. They are widely used to make websites work more efficiently, provide better user experiences, and give website operators analytical and marketing information. Similar technologies include web beacons, pixels, tags, and scripts.
15.2 Cookie Consent
When you first visit our Website, you will be presented with a Cookie Consent Notice managed through ConsentMagic by PixelYourSite. You can choose to accept, reject, or customize which categories of cookies you allow.
You can change your cookie preferences at any time by clicking the “Cookie Settings” link in the footer of our Website or through your browser settings.
Please note: Disabling certain cookies may affect the functionality and performance of the Website.
15.3 Categories of Cookies We Use
🔒 Category 1: Necessary Cookies
Always Active — Cannot Be Disabled
These cookies are essential for the Website to function properly. They enable core functionality such as page navigation, form submissions, privacy preference management, and security features. These cookies do not store any personally identifiable information.
Cookie / Technology | Provider | Purpose |
Session cookies | WordPress / Hostinger | Enable website functionality and form processing |
Security cookies | WordPress | Protect against CSRF and unauthorized form submissions |
Cookie consent record | ConsentMagic | Store your cookie consent preferences |
📊 Category 2: Analytics Cookies
Require Consent
These cookies allow us to count visits and traffic sources so we can measure and improve the performance of our Website. They help us understand which pages are most and least popular and how visitors move around the site. All information collected by these cookies is aggregated and therefore anonymous. If you do not allow these cookies, we will not know when you have visited our site.
Cookie / Technology | Provider | Purpose | Privacy Policy |
Google Analytics 4 (_ga, _gid, ga*) | Google LLC | Website usage analytics | |
Google Tag Manager | Google LLC | Manages and deploys analytics and marketing tags |
Note: GA4 is configured with IP anonymization enabled and a data retention period of 14 months.
🎬 Category 3: Embedded Video Cookies
Require Consent
These cookies may be set through our Website by external video hosting services such as YouTube (a Google service). They may be used to deliver video content on our Website. The video provider may build a profile of your interests based on your video viewing behavior and show you relevant advertisements on this or other websites. They do not store directly personal information but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, embedded video content may not function as expected.
Cookie / Technology | Provider | Purpose | Privacy Policy |
YouTube / Google Video | Google LLC | Embedded video playback |
🔤 Category 4: Google Fonts
Functional — Minimal Data
Google Fonts is a font embedding service library. Google Fonts are stored on Google’s CDN. The Google Fonts API is designed to limit the collection, storage, and use of end-user data to only what is needed to serve fonts efficiently. Requests to the Google Fonts API are made to resource-specific domains such as fonts.googleapis.com or fonts.gstatic.com, and are separate from any authenticated Google services.
Technology | Provider | Data Collected |
Google Fonts API | Google LLC | IP address (for CDN routing); no cookies set |
📣 Category 5: Marketing and Retargeting Cookies
Require Consent
These cookies and scripts may be set through our Website by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant advertisements on other websites and platforms. They do not store directly personal information but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising.
Cookie / Technology | Provider | Purpose | Privacy Policy |
Google Ads (_gcl_au, gads) | Google LLC | Ad conversion tracking and remarketing | |
YouTube Ads | Google LLC | Video ad performance tracking |
👤 Category 6: Facebook Advanced Matching
Require Consent
Facebook Advanced Matching allows us to send hashed (one-way encrypted) personal data — such as your email address or phone number — to Meta Platforms to improve the accuracy of ad conversion tracking. This helps us understand whether users who interact with our website and ads are the same users who later take actions, without Meta being able to reverse-engineer your original information.
Technology | Provider | Data Transmitted | Privacy Policy |
Meta Advanced Matching | Meta Platforms, Inc. | Hashed email, hashed phone (SHA-256) |
⚡ Category 7: Facebook Conversions API (CAPI)
Require Consent
The Facebook Conversions API (CAPI) is a server-side tracking technology that sends website event data directly from our web server to Meta, independent of your browser. It functions alongside (or in some cases instead of) the browser-based Meta Pixel. CAPI may transmit hashed personal data including IP address, user agent, hashed email, and hashed phone number to help us measure the effectiveness of our Facebook and Instagram advertising. This data is used solely for ad measurement and optimization purposes and is transmitted in a privacy-safe, hashed format.
Technology | Provider | Data Transmitted | Privacy Policy |
Meta Conversions API | Meta Platforms, Inc. | Hashed email, hashed phone, IP address (hashed), user agent, event data |
15.4 How to Manage and Control Cookies
You have several options for controlling cookies:
- Our Cookie Consent Manager Use the Cookie Consent Notice that appears when you first visit the Website, or click “Cookie Settings” in our Website footer, to accept, reject, or customize cookie categories.
- Browser Settings Most web browsers allow you to control cookies through browser settings. You can set your browser to:
- Block all cookies
- Block third-party cookies
- Alert you when cookies are being set
- Delete cookies after each browsing session
Instructions for popular browsers:
- Opt-Out Tools Provided by Third Parties
- Google Analytics Opt-Out: tools.google.com/dlpage/gaoptout
- Google Ads Personalization: myaccount.google.com/data-and-privacy
- Meta Ad Preferences: facebook.com/adpreferences
- Digital Advertising Alliance (US): optout.aboutads.info
- Network Advertising Initiative: optout.networkadvertising.org
- Your Online Choices (EU/UK): youronlinechoices.eu
16. Do Not Track
Some browsers include a “Do Not Track” (DNT) feature that signals to websites that you do not want your online activity tracked. At this time, there is no universally accepted standard for how websites should respond to DNT signals. We currently do not respond to DNT signals. However, you can control tracking through our Cookie Consent Manager and the opt-out tools described in Section 15.4.
California residents may also opt out of sharing for cross-context behavioral advertising through our Cookie Consent Manager.
17. Third-Party Links
Our Website may contain links to third-party websites, including but not limited to social media platforms (LinkedIn, Facebook, Instagram, YouTube), tools, and resources. This Privacy Policy applies solely to our Website. We are not responsible for the privacy practices or content of third-party websites and encourage you to read their respective privacy policies before providing any personal data.
18. Future Updates to Technology and Services
We may in the future integrate additional technologies and service providers, including CRM platforms (such as Zoho CRM, HubSpot, or GoHighLevel), heatmap and session recording tools (such as Hotjar or Microsoft Clarity), and other analytics or marketing technologies. Any such additions that involve the processing of personal data will be disclosed in an updated version of this Privacy Policy prior to their activation on the Website. We encourage you to review this Policy periodically.
19. Changes to This Privacy Policy
We reserve the right to update or modify this Privacy Policy at any time. When we make material changes, we will:
- Update the “Last Updated” date at the top of this page
- Post the revised Privacy Policy on this page with immediate effect
For significant changes that materially affect how we process your personal data, we will make reasonable efforts to notify you via email (if we have your email address) or via a prominent notice on the Website.
Your continued use of the Website after any changes to this Privacy Policy constitutes your acceptance of those changes. We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.
20. How to Exercise Your Rights and Contact Us
For any privacy-related questions, requests to exercise your rights, concerns, or complaints, please contact our designated privacy contact:
Privacy Contact
Shyam Nandikonda
Incredible Virtual Assistant (Nandikonda Matrix)
📧 Email: privacy@incrediblevirtualassistant.com
📝 Contact Form: https://incrediblevirtualassistant.com/contact/
📮 Postal Address: Road Number 3, Saraswati Nagar, Karimnagar, Telangana – 505001, India
We will acknowledge your request promptly and respond within the timeframes required by applicable law (30 days for GDPR requests; 45 days for CCPA/CPRA requests; 30 days for DPDP Act grievances).
If you are not satisfied with our response, you have the right to lodge a complaint with the relevant data protection authority in your jurisdiction:
- EU Residents: Your national Data Protection Authority
- UK Residents: Information Commissioner’s Office (ICO) — ico.org.uk
- Indian Residents: Data Protection Board of India (once fully operational under the DPDP Act, 2023)
- California Residents: California Attorney General — oag.ca.gov/privacy
This Privacy Policy was last reviewed and updated on July 02, 2026. Previous versions are available upon request.
© 2026 Incredible Virtual Assistant | Nandikonda Matrix. All rights reserved.