Privacy Policy

Last updated: 5 October 2026

Draft for legal review. TODOs below identify details that still need confirmation before this policy is published.

1. Who operates OnFrontBase

OnFrontBase is operated by ONFRONTBASE (OPC) PRIVATE LIMITED. Dhruv Rana is the founder and runs the practice from India.

TODO: Add the verified company CIN before publishing this draft.

Registered office: PLOT NO 30 KH.NO. 48/3, 4, 5, 8 & KILLA NO-13 GROUND FLOOR BLOCK BLK-B MANDIR MOHALLA VILLAGE SAMAIPUR DELHI 110042, India

Contact: dhruv@onfrontbase.com

I build AI systems and assistants inside the tools a business already uses. This policy covers website visitors, prospective clients, business contacts reached through B2B outreach, and information handled while delivering client projects.

2. Controller and processor roles

The company is the controller for information used to run this website, handle enquiries and bookings, administer client relationships, and conduct B2B outreach.

For a client deployment, the client decides why personal information is processed and which workflows are permitted. Where the company processes that information on the client's behalf, it follows the client's documented instructions and the project's data processing agreement.

TODO: Confirm the controller and processor roles, access permissions, and any joint-controller arrangements for each deployment in the signed project documents.

3. Information handled

• Enquiries and bookings: name, business contact details, booking answers, meeting details, and correspondence.
• Business contacts: name, role, company, business email address, source of the contact details, and outreach or opt-out history.
• Website use: hosting and security logs, browser and device information, and any data collected by configured measurement tags.
• Client administration: contact details, project records, invoices, and billing information.
• Client deployments: the documents, messages, reports, task updates, calendar entries, and lead information needed for the agreed workflow. Voice deployments also handle call recordings and transcripts.

Do not submit payment card details, government identifiers, or sensitive information in a website enquiry or booking answer.

4. Purposes and legal bases

Information is used to answer enquiries, arrange calls, deliver agreed projects, maintain business records, secure the service, and send relevant business outreach where permitted.

For UK and EU contacts, the intended bases are contract or steps requested before a contract, legal obligations, and legitimate interests where appropriate. Consent is used where it is required, including for non-essential tracking or communications where applicable.

TODO: Have counsel confirm the basis for each purpose under GDPR, UK GDPR, India's Digital Personal Data Protection Act, 2023, and the Digital Personal Data Protection Rules, 2025, taking account of their phased commencement. A UK/EU legitimate-interests basis is not automatically a basis under Indian law.

5. B2B outreach

Business contact details may come from company websites, professional directories, or data providers. I use those details to contact people about services relevant to their business role. Smartlead is used to manage B2B email outreach.

For UK/EU contacts, the intended basis is legitimate interests in relevant business outreach, subject to a documented assessment and the applicable electronic marketing rules. That basis does not remove a requirement to obtain consent where the rules require it, including restrictions affecting sole traders and some partnerships.

You can opt out by replying to an outreach email or contacting dhruv@onfrontbase.com. A minimal suppression record is kept to avoid contacting you again for marketing.

TODO: Confirm the data providers used, document the legitimate-interests assessment, and verify the opt-out process, suppression retention, and country-specific marketing rules before sending outreach. See the ICO's B2B marketing guidance.

6. Website and business service providers

The website also contains optional Google Analytics 4, Google Ads, and LinkedIn Insight integrations that load only when their public environment IDs are configured.

The published GTM script was checked on 5 October 2026 and contained Google Analytics 4 and LinkedIn Insight tags. No Google Ads tag was present in that container at the time of the check.

TODO: Recheck the production environment and any changed GTM configuration before publishing. Confirm each tag's data fields, cookie lifetimes, retention, consent settings, provider contracts, and processing locations; do not infer locations from a provider's headquarters.

Client deployments: the project's provider list, account ownership, data processing agreement, and approved integrations are documented for that project. TODO: Confirm the current client-deployment providers before adding a generic sub-processor list.

7. Client deployments

Speed-to-lead and voice assistants

Texts go only to people who opted in. The voice assistant says it is an AI. Calls are recorded, transcribed, and reviewable by the client's authorised team. The client sets qualifying questions, booking rules, human handoffs, daily review, and a way to pause the assistant.

TODO: Confirm recording notices and any required consent for the locations of the client and callers, approved texting registration, recording retention, and provider settings in each project. Disclosure alone must not be treated as valid consent in every jurisdiction.

Instagram content engine

The engine uses Meta's official tools only. A person approves every post. Access is limited to the connected accounts and assets agreed for the project.

AI manager

It tracks tasks, not people. It does not create performance scores and reads only the check-in replies and meeting notes the client chooses to connect. A person owns priorities and people decisions.

8. Health data

I don't build systems that process health data. Do not connect health records, clinical information, or workflows that require health data processing.

TODO: Document how accidentally received sensitive data will be restricted, removed, and reported to the relevant client.

9. Access, security, and AI use

Projects are scoped around the access needed for the agreed workflow. Client accounts and human review are part of the delivery approach. AI output can be wrong and must be reviewed within the agreed supervision rules.

I do not use client data to train AI models. TODO: Verify each provider's retention and training terms, security settings, access controls, and incident-response responsibilities in the project agreement. This policy makes no certification or compliance claim.

10. International transfers and retention

The practice operates from India. Providers may process information in other countries. TODO: Confirm each provider's processing locations and any required transfer safeguards, including EU standard contractual clauses and UK transfer documentation where applicable; do not claim these agreements are in place until verified.

TODO: Set and document retention periods for enquiries, bookings, outreach records, suppression records, security logs, invoices, and client deployments. The signed project documents should state how client data is returned or deleted at handover or termination. No unverified automatic-deletion schedule is promised in this draft.

11. Cookies and measurement

Google Tag Manager loads on this website. Depending on its published configuration and the optional integrations enabled, measurement or advertising tags may use cookies or similar technologies. The booking calendar may also use storage required for its features. The site uses session storage to carry booking attribution and avoid duplicate booking conversion events.

TODO: Audit the production tags, cookies, and storage, and document their purposes and lifetimes. No website consent notice was found in the current code. Review the consent requirements for UK/EU visitors before publishing; this draft does not state that all tracking is strictly necessary or consent-free.

12. Your rights and complaints

Rights depend on the law that applies. Under GDPR and UK GDPR, these may include access, correction, deletion, restriction, portability, objection to direct marketing, and withdrawal of consent. India's Digital Personal Data Protection Act, 2023 provides rights and grievance procedures subject to the provisions in force and applicable rules.

Contact dhruv@onfrontbase.com to make a request. If your information is in a client deployment, contact that business as the controller; I can help route a request to it.

You may also contact the relevant regulator, including the UK's ICO or the supervisory authority in your EU country. TODO: Confirm the applicable Indian grievance and escalation process and response deadlines under the provisions in force before publishing.

13. Children

This business website is intended for business decision-makers. TODO: Confirm the appropriate age restrictions and procedures for any client workflow that may receive children's information under the laws that apply. Do not deploy such a workflow until its requirements are agreed.

14. Changes and contact

The date above identifies this draft's latest revision. Material client changes are addressed through the signed project documents.

ONFRONTBASE (OPC) PRIVATE LIMITED

TODO: Add the verified company CIN before publishing this draft.

Registered office: PLOT NO 30 KH.NO. 48/3, 4, 5, 8 & KILLA NO-13 GROUND FLOOR BLOCK BLK-B MANDIR MOHALLA VILLAGE SAMAIPUR DELHI 110042, India

Contact: dhruv@onfrontbase.com