We use browser storage, strictly for the Functional category, only if you opt in — to let our AI Pilot chat widget remember your conversation. Nothing else runs until you choose. See our Cookie Policy.
Legal
Security
The safeguards we use to protect personal data, and how we respond to an incident.
Effective Date: 25 October 2026Last Updated: 25 October 2026Version: 1.0
EntityWaves Web Studio — Sole Proprietorship
ProprietorTarun Valluri
GSTIN36BYQPT2686E1ZR
Udyam Registration No.UDYAM-TS-20-0221187
Registered AddressPlot no. 19, Venkatramana Colony Phase-1 Dammaiguda, Hyderabad, Telangana - 500083, India
Websitehttps://www.waveswebstudio.in
Grievance OfficerTarun Valluri, Proprietor
Grievance / Data Protection Contactprivacy@waveswebstudio.in · How to file a grievance
Our Approach
We apply reasonable security safeguards appropriate to the personal data we hold, as required by Rule 6 of the DPDP Rules, 2025 and Rule 8 of the SPDI Rules, 2011. This page describes the controls we actually have in place — we have not sought, and do not claim, any formal security certification (such as ISO 27001 or SOC 2) or independent penetration testing.
Encryption In Transit
This website and the AI Pilot chat widget are served over HTTPS (TLS) by default, through our hosting provider, Vercel. Data submitted through our forms (Formspree) and our chat widget's backend (Supabase) is likewise transmitted over encrypted connections.
Access Control
Access to our hosting, database, domain, and email accounts is limited to the proprietor. Multi-factor authentication (MFA) is enabled on all or substantially all of our administrative accounts — hosting, database, email, source control, and domain registrar.
Secrets Handling
API keys and credentials (for example, the key used to call the Google Gemini API, and our Supabase database keys) are stored as environment variables on our hosting platform, not committed to our source code.
Backups
The database behind the AI Pilot chat widget (Supabase) has automated backups enabled on our current plan.
Logging And Retention
Server and form-submission logs are retained for a minimum of 12 months, per Rule 8 of the DPDP Rules, 2025. Security-relevant logs are additionally retained for at least 180 days within India, per the CERT-In Directions, 2022.
Vendor Review
Before engaging a new sub-processor, we review its published privacy and security practices. Our current sub-processors are listed at /legal/sub-processors.
Incident Response
If we identify or are notified of a security incident involving personal data, we: — report it to CERT-In (https://www.cert-in.org.in) within 6 hours of noticing or being notified of it, where it qualifies as a cyber incident under the CERT-In Directions, 2022; — intimate affected individuals without delay; and — report it to the Data Protection Board of India within 72 hours, as required by Rule 7 of the DPDP Rules, 2025.
Reporting A Security Issue
If you believe you've found a security vulnerability affecting this website or the AI Pilot widget, email privacy@waveswebstudio.in with details. We will acknowledge within 48 hours.
Questions about this document, or want to exercise a right described in it? Contact our Grievance Officer, Tarun Valluri (Proprietor), at privacy@waveswebstudio.in. We acknowledge within 48 hours and resolve within 30 days. See Grievance Redressal.