Privacy Policy

1. Who we are

whichbutton is operated by Fazal Kadivar, an individual based in India. For this policy we are the data controller (or "data fiduciary" under India's Digital Personal Data Protection Act, 2023). Contact for anything privacy related, including grievances: Fazal Kadivar, hello@whichbutton.xyz.

2. What we collect

Account data

Your name, email address, and sign-in details, collected through our authentication provider when you create an account (including basic profile details from a social login provider, if you use one).

Project content

The website URLs and design images you add, the marks and notes you draw, and context we record with each note: page path, viewport size, scroll position, the responsive view you used, and, when we can read the page, a description of the page element under your mark. To show previews and render screenshots, our servers load the pages at the URLs you add.

API keys

When you create an API key we store only a one-way hash and a short prefix so you can recognise it. We can't read your full key.

Billing data

Dodo Payments processes your payment. We receive your name, email, country, plan, payment status, and transaction IDs. We never receive or store your full card number.

Technical data

Like any web service, our servers and providers log IP addresses, browser type, and request times to operate and secure the service. The marketing site sets no cookies and runs no analytics.

3. How we use it, and our legal bases

Where Indian law applies, we process your data on the basis of the consent you give when you sign up and for the legitimate uses the law allows. We do not sell personal data, share it for advertising, or use your project content to train AI models.

4. Who we share it with

• Service providers that run parts of whichbutton for us, listed on our Subprocessors page. They may only use data to provide their service to us.
• The coding agent you connect. When you give an agent an API key, it receives your notes, screenshots, and page details. That agent's provider handles the data under its own terms and privacy policy.
• Legal reasons. If required by law, or to protect people, the service, or our rights.
• Business transfer. If whichbutton is sold or reorganised, under this policy or one at least as protective.

5. International transfers

We are based in India, and our providers may process data in other countries, including the United States. Where the law requires, we rely on appropriate safeguards such as standard contractual clauses offered by those providers.

6. How long we keep it

• Account and project data: while your account is open.
• Deleting a project deletes its notes right away. Uploaded design images are deleted when you close your account, or sooner if you ask.
• When you close your account, we delete your account and project data within 30 days, except what we must keep.
• Billing records: as long as tax and accounting law requires.
• Server logs: for a limited period for security, then deleted.

7. Your rights

Depending on where you live (for example under the GDPR, UK GDPR, India's DPDP Act, or US state laws such as the CCPA), you may have the right to:

• access the personal data we hold about you and get a copy
• correct inaccurate data
• delete your data and close your account
• object to or restrict some processing
• withdraw consent at any time, without affecting earlier processing
• nominate someone to exercise your rights if you can't
• complain to your data protection authority, or in India to the Data Protection Board of India

Email hello@whichbutton.xyz from your account address to use any of these. We reply within 30 days and won't treat you differently for asking. We don't sell or "share" personal information as the CCPA defines those terms.

8. Security

We use encrypted connections, hashed API keys, and providers with strong security practices. No system is perfectly secure, so if we learn of a breach that affects your data we will notify you and the authorities as the law requires. More on our Security page.

9. Cookies

We only use cookies that are strictly necessary, mainly to keep you signed in to the app. See the Cookie Policy.

10. Children

whichbutton is for people aged 18 and over. We don't knowingly collect data from children. If you think a child has signed up, contact us and we will delete the account.

11. Changes

We will update this page when our practices change and revise the date at the top. For material changes we will tell you by email or in the app.