Privacy Policy
Meta ads, lead forms & this website · Last updated 11 October 2026
1. The short version
If you fill in one of our forms on Facebook, Instagram or this website, we get the details you typed in and use them to get back to you about your project. That's it. We don't sell your data, we don't rent it out, and we won't add you to a mailing list you didn't ask for.
Want it deleted? Email info@nexonalabs.com with the subject “Delete my data”. Details in section 8.
2. Who we are
Nexona (“we”, “us”) builds custom software, ERPs, CRMs and AI automation, based in Mumbai, Maharashtra, India. We decide what happens to the personal data described here, so for the purposes of India's Digital Personal Data Protection Act 2023, and the GDPR where it applies, we are the data fiduciary / controller. You can reach us at info@nexonalabs.com or +91 90822 07416.
3. What we collect
From Meta lead forms (Instant Forms)
When you submit a lead form inside a Facebook or Instagram ad, Meta passes us what's on that form, usually your name, email, phone number and your answers to any questions we asked (what you want built, company size, that sort of thing). Meta pre-fills some fields from your profile. You can edit them before you hit submit, and nothing reaches us until you do.
From forms on this website
Name, email, phone number and the requirement you describe. Along with the form, the site sends some context about your visit: the pages you looked at in this session and roughly how long on each, the page you landed on, the site that referred you, campaign tags in the link (UTM parameters and click IDs such as fbclid), and basic device information (device type, screen size, language, time zone, browser user agent). That journey is held in your browser's memory only, never written to your device, and it's sent only if you submit the form.
From the Meta Pixel and Conversions API
We use the Meta Pixel on this website and Meta's Conversions API on our server to measure whether our ads work. They tell Meta things like “someone who clicked the ad viewed this page” or “submitted a contact form”. The Pixel may set Meta cookies (_fbp, _fbc) and send Meta your IP address, browser details and the page URL. When we send a conversion, contact details such as email or phone are hashed (scrambled one-way with SHA-256) before they leave our systems, so Meta can match them to an account without us handing over the raw values.
From Google
The site loads Google Tag Manager, which may run Google Analytics. It records aggregated usage, pages viewed, rough location, device type, using Google cookies.
We don't ask for, and don't want, sensitive data like health, financial account or ID numbers.
4. How we use it
- To call, email or WhatsApp you about the enquiry you sent: scoping, a proposal, a follow-up call.
- To work out which ads and pages actually bring in enquiries, so we stop paying for the ones that don't.
- To show our ads to people similar to those who've enquired, and not keep showing them to you once you have.
- To keep records we're legally required to keep, and to protect against spam and abuse of our forms.
5. Why we're allowed to
Your consent, given when you submit a form. You can withdraw it whenever you like, and withdrawing doesn't undo anything we did lawfully before. For measurement through the Pixel, we rely on consent where the law requires it (for example, visitors in the EU or UK) and on our legitimate interest in measuring our own advertising elsewhere.
7. How long we keep it
Lead details from an enquiry that doesn't turn into a project: up to 24 months, then deleted. If you become a client, for as long as we work together, plus whatever tax and contract law requires after that, which in India is usually 8 years for invoices. Lead data stored inside Meta Ads Manager is cleared on Meta's own 90-day download window; we keep our copy under the rules above.
8. Deleting your data
Email info@nexonalabs.com with the subject “Delete my data” and include the email or phone number you used on the form. We'll:
- Confirm we got your request within 3 working days.
- Delete your details from our inbox, CRM, spreadsheets and Meta lead exports within 30 days.
- Reply to confirm it's done, or explain what we have to keep by law and why.
To stop Meta using your activity for ads, go to Facebook Ad Preferences and Your activity off Meta technologies, where you can disconnect this website. Clearing or blocking cookies in your browser stops the Pixel too.
9. Your rights
You can ask us what we hold about you, have it corrected, have it deleted, withdraw consent, or nominate someone to act for you. If you're in the EU or UK you can also object to processing, ask for a portable copy, and complain to your local data protection authority. In India, if we don't sort out a complaint, you can go to the Data Protection Board of India. Start with us, though. Most things get fixed in one email.
10. Security and where it's stored
Access is limited to the people at Nexona who respond to enquiries, accounts are protected with two-factor authentication, and the site runs over HTTPS. Meta and Google may process data on servers outside India, including the US. They use their own safeguards (such as standard contractual clauses) for those transfers. No system is perfectly secure. If we ever have a breach that affects you, we'll tell you and the relevant authority as the law requires.
11. Children
Our ads and forms are for businesses. They're not aimed at anyone under 18, and we don't knowingly collect their data. If you think a minor has sent us something, tell us and we'll delete it.
12. Contact and grievances
Questions, complaints, deletion requests: info@nexonalabs.com, or call +91 90822 07416. This is also our grievance contact under the DPDP Act. If we change this policy we'll update the date at the top, and if the change is significant we'll say so on the page for at least 30 days.
