Website Forms Policy

Last updated 6 September 2026  ·  Varnan Digital (OPC) Private Limited  ·  CIN U62090KL2025OPC096808

Every form on varnandigital.com is documented here: the exact fields it captures, where the submission travels, who reads it, how long it survives, and how to get it deleted. If a form is not on this page, it is not on this site.

1. The forms on this site

There is currently one public form: the strategy call request on the Contact page. Some pages also link to a Calendly scheduling page, which is operated by Calendly and covered in section 6.

2. What the contact form captures

Alongside what you type, the submission records the date and time and the page you submitted from. Nothing else is added. We do not fingerprint your device, enrich your record from third-party data brokers, or attach a tracking profile to the submission.

3. Where a submission goes

When you press submit, the form sends the data to two places and nowhere else:

1. Email to [email protected], delivered over an authenticated Gmail SMTP connection. This is what we actually read.
2. A private Google Sheet, via a Google Apps Script endpoint, so enquiries are not lost in an inbox. The sheet is restricted to Varnan accounts.

Both destinations sit inside Google Workspace. No copy is sent to an advertising platform, a CRM enrichment service or any AI model. Submitting the form does not subscribe you to anything.

4. Who reads it

Amal Jandheer and the Varnan team members working on new business. That is the whole list. We do not forward enquiries to partners or resell them.

5. Spam protection and security

• The form is protected by a WordPress nonce, a single-use token that blocks automated submissions from other origins. A submission without a valid token is rejected outright.
• Server-side validation sanitises every field before it is stored or emailed.
• The page is served over HTTPS, so the submission is encrypted in transit.
• The Wordfence firewall filters malicious traffic, which means blocked submissions and their IP addresses appear in security logs.

We deliberately do not use reCAPTCHA or a similar challenge on this form, because those services profile visitors across the web. The nonce and server-side validation do the job without that trade-off.

6. Calendly bookings

If you book a slot through Calendly, the booking is made on Calendly’s own pages under their terms and privacy notice. Calendly passes us your name, email, chosen time and any answers you gave, and writes the event into Google Calendar. The Calendly scheduler is treated as a functional cookie category on this site, so any embedded version stays blocked until you allow it.

7. How long we keep submissions

8. Getting your submission deleted

Email [email protected] with the subject “Delete my enquiry” from the address you used, or tell us which address to look for. We remove the row from the sheet and delete the email thread within 30 days, and confirm when it is done. There is no charge and we will not ask you to justify the request.

9. What we ask of you

Please do not send passwords, API keys, bank details, identity documents, health information or anything else genuinely sensitive through a web form. If we need something confidential during an engagement, we will set up a secure channel for it. A message you send us is treated as confidential business information, but a web form is not the right place for secrets.

10. Future forms

If we add a newsletter signup, a lead magnet, an application form or a client portal, this page is updated before it goes live, with the same level of detail. Any marketing opt-in will be a separate, unticked checkbox rather than a condition of using the form.