Weblytics Digital / privacy
Privacy Policy
Effective: 17 October 2026
This policy explains how Weblytics Digital handles personal information when you visit this website, contact the studio, or request a consultation.
Who is responsible for your information?
Weblytics Digital is a business name registered in Kenya and owned and operated by Warren Makhotsa. Weblytics Digital provides website development, software development, digital design, and related professional services. For privacy questions or requests, contact weblyticsdigitalkenya@gmail.com.
Information collected
When you contact the studio or submit a consultation request, we may collect your name, email address, optional phone number and company information, selected service, project requirements and discovery answers, requested consultation date and time, timezone, meeting preference, booking reference, and meeting details. The booking form does not ask for sensitive personal information; please do not include it in project notes. The website and its hosting and security providers may process technical information such as IP address, request time, requested path, browser or device details, and security events.
How information is used
We use inquiry and project information to respond to you, assess prospective work, arrange and manage consultations, send booking confirmations and meeting details, maintain appropriate business records, and operate and secure the website. Information is processed to respond to a request you make before entering a project agreement, to provide the consultation you request, for the legitimate interests of operating and securing the studio and its booking service, and where necessary to meet legal obligations. We use consent where it is the appropriate basis for a particular optional activity.
Booking system and Google Calendar
When the booking integrations are configured and available, the booking service uses an owner-authorized Google Calendar connection to check availability, identify scheduling conflicts, create consultation events, and request Google Meet details when that meeting type is selected and supported. Availability checks use free/busy intervals; the service does not display event titles or descriptions to visitors. Calendar events contain the consultation time, service, attendee contact details, project answers supplied in the form, and a private booking identifier. Events are sent to Google Calendar and may generate Google Calendar invitations to the attendee.
Google Sheets booking records
When the Google connection and spreadsheet are configured, the booking service records a booking in the Weblytics booking spreadsheet. The record includes a booking identifier, status, service, meeting type, start and end times, timezone, contact details, project summary, and creation time. A separate event log records email delivery status and limited operational details. A Settings tab is used for configuration records, including an encrypted Google refresh token during owner setup. These records support appointment administration, duplicate prevention, email delivery tracking, and business records.
Google API data and permissions
The Google connection is authorized by the Weblytics Digital proprietor for the business booking service. Website visitors are not asked to sign in to Google or authorize access to their Google accounts. The application requests the Google OAuth scopes https://www.googleapis.com/auth/calendar and https://www.googleapis.com/auth/spreadsheets. Google describes these scopes as allowing the application to see, edit, share, and permanently delete all calendars available to the authorizing account, and to see, edit, create, and delete all spreadsheets available to that account. The application’s configured purpose is narrower: it queries free/busy information and creates or checks booking events in the configured calendar, and reads or writes booking-related ranges in the configured Weblytics spreadsheet. The actual scope permissions are broader than those configured resources; a least-privilege scope review remains planned.
Google data use, storage, sharing, and revocation
Information received from Google Workspace APIs is used only to provide the booking features described here: checking availability in the configured business calendar and recording or managing consultation bookings in the configured Weblytics spreadsheet. It is not sold, used for advertising, or used to train generalized machine-learning models. Access and use are limited to these user-facing booking purposes, with transfers only where needed to operate the requested booking, protect the service, or meet legal requirements. Our use is subject to the Google API Services User Data Policy and Google Workspace Limited Use requirements. Calendar availability responses are used to calculate available consultation times. Booking event information and booking rows are stored in the Google services described above and remain there until manually deleted; the application has no automatic Google Calendar or Sheets deletion schedule. Booking confirmation and owner notification messages are sent through Resend when email delivery is configured; those messages contain booking details, but the service does not send unrelated calendar contents to Resend. The encrypted OAuth refresh token is protected by the application using AES-256-GCM before it is written to the Settings tab; the encrypted value is also intended for storage in Vercel environment configuration. The proprietor can revoke the application’s Google access from the Google Account connections page. Revoking access stops future API access but does not itself delete data already stored in Calendar, Sheets, email, or provider logs. For deletion requests, contact us using the address below.
Service providers and international processing
The booking system uses Google Calendar and Google Sheets for the configured booking functions, Resend to send customer and owner notification emails, and Vercel to host the website and its API functions. The website also requests the Manrope typeface from Google Fonts; a browser request to that service can disclose ordinary connection information such as an IP address and request metadata. These providers may process information in countries outside Kenya according to their service infrastructure and settings. The exact region and any provider-specific transfer safeguards depend on the applicable account configuration and provider terms; Weblytics does not claim a particular storage location or safeguard where it has not been verified.
Retention and deletion requests
The booking system does not automatically delete Calendar events, Sheets booking rows, or booking-event log rows. Weblytics retains these business-controlled records until they are no longer needed for the consultation and related business records, or until a valid deletion request is completed, subject to any legal requirement to retain them. To request access, correction, or deletion, email weblyticsdigitalkenya@gmail.com with enough detail to identify the relevant booking. The proprietor will review the request and, where deletion is appropriate, manually remove the relevant event in Google Calendar and corresponding rows in the Bookings and BookingEvents tabs of the Weblytics spreadsheet. A deletion request can also be made for email records; messages already delivered to the recipient’s mailbox cannot be removed by Weblytics. Resend delivery records and Vercel technical or security logs are governed by the providers’ retention controls and may not be directly editable or removable by Weblytics. There is no automated erasure workflow.
Security
The booking service keeps Google credentials on the server rather than in the visitor’s browser. During owner authorization it uses OAuth state validation and PKCE; the stored refresh token is encrypted with AES-256-GCM using a key supplied through server configuration. Booking requests are validated and rate-limited, and owner-only routes require a separate authorization secret. These measures reduce risk but cannot guarantee that any online service is completely secure.
Cookies and browser storage
If you save or reject cookie preferences, the website stores weblytics_cookie_preferences_v1 in this browser’s localStorage containing category choices, policy version, and save time. Google Analytics 4, provided by Google, loads only after you explicitly allow Analytics. It measures public page visits and limited booking interactions to help improve the website. Google may process connection information, browser/device information and cookie-based identifiers. We do not send booking contact details, company names, project notes, booking references or meeting links to Analytics. Advertising consent remains denied, and Google signals and ad personalization are disabled. You can reject Analytics or withdraw consent in Cookie Settings; withdrawal disables collection and removes accessible first-party Analytics cookies. After a consented booking confirmation, a one-way digest of its reference is kept only in this tab’s sessionStorage to prevent duplicate conversion counts; it is never sent to Google and expires when the tab session ends. See the Cookie Policy for the storage inventory and settings.
Your privacy rights
Under Kenya’s data protection framework, you may have rights to be informed, access your personal information, object to processing, request correction of inaccurate or misleading information, and request deletion where the law permits. Other rights may apply depending on the circumstances and any other law that applies to you. Contact weblyticsdigitalkenya@gmail.com to make a request. You may also contact the Office of the Data Protection Commissioner in Kenya. We may need to verify a request and may retain information where the law requires or permits it.
Children
This website and the studio’s services are intended for businesses and adults, not children. If you believe a child has provided personal information, contact us so we can review the request and take appropriate steps.
Changes to this policy
We may update this policy when the website, booking system, service providers, or applicable requirements change. The effective date above shows when this version took effect.
Questions about this page? Contact Weblytics Digital