Privacy Policy

Version 1.6 · Last updated 28 October 2026

This policy explains the limited personal data used to present The Detail Department, respond to business enquiries and hold relevant one-to-one conversations with prospective clients.

1. Who we are

THE DETAIL DEPARTMENT PRIVATE LIMITED is an Indian company limited by shares, based in Bengaluru, Karnataka. Its mailing address recorded on the Certificate of Incorporation is No. 271, 6th Main Road, HAL 2nd Stage, Indiranagar, Bengaluru, Karnataka 560038, India.

For the website and enquiry processing described in this policy, THE DETAIL DEPARTMENT PRIVATE LIMITED is the data controller. Leon Houlier is the privacy contact. Privacy enquiries may be sent to leon@detail-department.com.

No data protection officer, EU representative or UK representative has been appointed.

2. Scope of this policy

This policy applies when you visit the public website, submit its contact form, email us, reply to an individual business-development message, or otherwise discuss a possible engagement.

This notice covers the public website and business enquiries. Processing carried out for a client engagement is governed by the relevant contract and data-processing terms, including the agreed systems, access, transfers and retention. This notice does not describe or authorise access to a client’s advertising accounts.

3. What we collect and why

Website visitors

The website is published on Firebase Hosting, a Google Cloud service. As the hosting provider, Google creates standard access and security logs containing an IP address, browser or device information, requested URL, timestamp and error information. These logs are used only to deliver, secure and maintain the website.

Optional website measurement

On marketing pages, “Accept all optional cookies” permits Google Analytics 4, PostHog and advertising measurement. “Choose cookies” lets you enable either category independently, including analytics only. “Reject optional cookies” keeps both off. Public recruitment and missing pages offer “Accept analytics” and keep advertising off. Google Tag Manager is not loaded until you allow at least one category; Analytics is not loaded without an analytics grant.

When accepted, Google Analytics receives the page path, approximate location derived from the IP address, browser and device characteristics, and event timing. We also measure which sections are reached, foreground reading time, detail pages opened, receipt pages viewed and contact actions. Contact-form events distinguish an attempt, an error and a confirmed receipt. An email-link click does not tell us whether you sent an email.

These events contain fixed page and section names, coarse time and scroll measurements, and success or error states. They do not contain your name, email address, message, other form answers, URL query strings or the referring page. Google’s automatic enhanced measurement and Google Signals are disabled. With analytics accepted, public recruitment pages also record role visits, reading progress and application-link clicks. Advertising remains off on recruitment pages. Job applications have their own privacy notice and separate optional measurement choice; website tags never run inside the application. Missing pages are reported only as /404, without the failed address.

Your choices are stored in your browser's local storage as tdd.measurementConsent.v2 and tdd.advertisingConsent.v1. Each contains only “granted” or “denied”. An earlier analytics choice never grants advertising permission. Because this version adds PostHog, a previous analytics acceptance needs a fresh choice; previous rejections are still respected. You can change either choice at any time through Cookie settings in the footer. Withdrawing a category clears its accessible first-party measurement cookies and reloads the page with that category disabled. It stops new measurement; it does not erase information previously received by a provider or cookies on another provider's domain.

PostHog website analytics

After you accept analytics, PostHog receives page views and fixed events for contact links, visits to the careers listing from marketing pages, form starts, submission attempts and confirmed success or error states. It runs only on the homepage, approach, contact, privacy and AI Media Index pages. It does not run on recruitment pages, applications, the private presentation, archived pages or private previews.

We send the canonical page path and a fixed referral label, such as Google, ChatGPT or direct-or-unknown, when the browser supplies a recognisable referring domain. We do not send the referring URL, query strings, fragments, form values or contact details. Session replay, automatic click capture and person profiles are not used. Geolocation enrichment is disabled and the project removes IP addresses from stored events. PostHog still receives the network request needed to deliver an event.

A random identifier in session storage (tdd.posthogSession.v1) connects events within a tab. It expires after 30 minutes without a measured event, when the tab closes, or when analytics consent is withdrawn. No PostHog tracking cookie or persistent browser identifier is created. Withdrawing consent stops new requests and removes this identifier; it does not delete events already received.

The dedicated website project uses PostHog Cloud EU. Its current plan provides a seven-year window for querying events. That window controls which events appear in reports; deletion uses separate provider controls. Withdrawing consent stops new measurement without deleting earlier events. Contact the privacy address above for questions or deletion requests. See PostHog's event-retention explanation and privacy policy.

Optional advertising measurement

Advertising has its own consent choice. When enabled, advertising tags are limited to measuring website visits and confirmed business enquiries for our campaigns on Meta, Google Ads, LinkedIn and X. They do not receive contact-form answers, candidate information or uploaded files. These providers may process browser and device information, network addresses and advertising identifiers under their own privacy policies. Accepting analytics alone never permits these tags.

After advertising consent, the website may store a random browser identifier and the click identifiers supplied by those platforms. These help connect a visit or confirmed enquiry to the campaign that brought you here. They are not derived from your contact details. The first-party tdd_ad_clicks, _fbp and _fbc cookies used by this implementation expire after 30 days from the latest consented visit and are cleared when you withdraw advertising consent. A configured first-party measurement server receives only the event name, page path, a random event identifier, your consent states and these allowlisted advertising identifiers; it may use the request's network address and browser information for platform matching.

Where the GDPR applies, optional measurement is based on consent. Google may process measurement information on global infrastructure under its own privacy and transfer safeguards. Google Analytics event- and user-level data are retained for up to two months under the current property controls; aggregate reports may persist after detailed data expires. We will review these settings before collecting any additional event or user-level data.

Country suggestion on the contact form

When the contact page opens, your browser makes one request to api.country.is, a free lookup service that returns a two-letter country code for the network address the request came from. The suggestion only pre-selects the optional Country field so you do not have to search a long list. You can change it or clear it before sending, and the enquiry is sent with whatever the field shows.

This is a form convenience, not measurement. It happens whether or not you accept analytics, and it is not affected by the measurement choice. The request is sent without cookies, credentials or a referrer. We do not receive, log or store your IP address from it; the response is read for the country code only, nothing is written to your browser storage, and no record of the lookup is kept unless you choose to send the enquiry. If the request fails, is blocked or does not answer within two seconds, it is abandoned and the field simply stays blank.

Where the GDPR applies, this brief processing is based on our legitimate interest in a contact form that is quick to complete. The service is operated by country.is and processes the request under its own terms.

Website fonts, illustrations and films are served from our own website. Viewing them does not make a request to Google Fonts or to the image and film generation services.

People who contact us

If you use the contact form, we receive your name, work email address, company or brand, the type of support requested and the information you choose to include in your message. Your role, country and timing are optional. If you contact us another way, we may also receive a telephone number or other details you choose to provide. We use this information to respond, understand whether the proposed work is relevant and continue the conversation you requested.

The form is sent through a Google Apps Script mail relay owned by leon@detail-department.com. The relay validates the submission and sends it to that Google Workspace mailbox. It does not create a separate lead database. Basic anti-abuse controls temporarily retain a one-way content fingerprint for up to ten minutes so a retry does not send the same enquiry twice; the fingerprint cannot be used to read the enquiry.

Where the GDPR applies, this processing is based on our legitimate interest in responding to relevant business enquiries and, where appropriate, taking steps at your request before a possible contract.

Individual business-development contacts

We may use limited professional information from company websites, professional networks, conference material or other publicly accessible business sources to identify and contact a small number of relevant media professionals. This may include a name, employer, role, professional contact details, source and a short record of the conversation.

Messages are intended to be individual and relevant, not mass consumer marketing. You may object at any time. If you do, we will stop the outreach and may retain only the minimum information needed to respect that request.

4. What we do not do

• We do not sell personal data.
• We do not make decisions about people using automated profiling.
• We do not currently collect campaign credentials, media plans, audience files or client performance data through this website.

5. Where data is processed

The business is based in Bengaluru, India, where website and enquiry information may be accessed to respond to requests. Contact-form and email enquiries are handled in Google Workspace, the email service for detail-department.com. The form relay runs on Google Apps Script. Google processes and stores the resulting mail and related service metadata on its own global infrastructure and applies its own terms and transfer safeguards to it.

The website is published on Firebase Hosting, a Google Cloud service, and is served from Google's global content delivery network. Access and security logs are created and held by Google as part of that service.

If analytics is accepted, Google processes measurement requests on its global infrastructure. The public website itself does not create a profile database or combine Analytics data with contact enquiries.

Client campaign systems and data access are covered separately by each engagement’s agreed scope and data-processing terms.

6. Current service providers and recipients

We may also disclose information where required by law, to protect legal rights, or with your clear instruction. We do not share sales enquiries with data brokers or unrelated advertisers.

7. Retention

The enquiry and outreach periods are maximum retention periods. Provider reporting windows describe data availability and do not by themselves guarantee deletion. Information may be deleted earlier when it is no longer useful or when a valid deletion request applies.

8. Your rights

Depending on the law that applies to you, you may ask whether we process your personal data and request access, correction, deletion, restriction or portability. You may also object to processing based on legitimate interests and withdraw consent where consent is the basis used.

Write to leon@detail-department.com. Please identify the information concerned and the right you wish to exercise. We normally respond within 30 days and may request proportionate information to verify identity.

You may raise a privacy concern with us using the contact address above, and complain to the competent data-protection authority where applicable.

9. Security

Access to enquiry information is limited to Leon Houlier. Current protections include individual accounts, multi-factor authentication where supported, encrypted connections, device access controls, software updates and the security controls provided by the email service.

The more extensive client-access, evidence-storage, segregation, audit and incident controls described in our operating model are planned controls. They are not represented here as active controls for client work before they have been implemented and verified.

10. External links

The website may link to advertising platforms, professional networks or other third-party websites. Those organisations are responsible for their own websites and processing practices. Their privacy notices apply when you visit them.

11. Children

This is a business-to-business website directed at media and marketing professionals. It is not intended for children, and we do not knowingly collect personal data from children.

12. Changes and mandatory review points

Changes will be published here with a new version number and effective date.

This version reflects the company’s incorporation on 14 October 2026, operations in India, Firebase Hosting, the branded Google Workspace account, the contact form through Google Apps Script, its country suggestion, locally hosted media, consent-gated Google Analytics reading and contact events, and the limited PostHog implementation described above. This policy must still be reviewed before any of the following occurs: a change of hosting, form, country-lookup or measurement provider; collection of additional analytics events; changes to advertising features or international access; material changes to the company details; or processing of campaign or advertising-account data outside the scope described here.