Privacy
What we collect, and what we do with it.
Last updated 16 August 2026. Written to be read rather than to be legally impenetrable. If anything here is unclear, email [email protected] and we’ll answer in plain language.
Who we are
OneWave operates the website at onewave.in. We are the data controller for the information described below. Contact for any privacy question, including deletion: [email protected]. Our registered business details and postal address are available on request to the same address.
What the diagnostic collects
When you complete the six-question diagnostic and submit the form, we store:
- What you told us: your name, email address, and — only if you chose to give them — your phone number and business name.
- Your six answers, and the result our scoring produced from them.
- How you arrived: the campaign, source and medium parameters in the link you clicked (utm_source, utm_medium, utm_campaign, utm_term, utm_content), a Google or Meta click identifier if one was present, the page you landed on, and the referring website.
- Technical details: the date and time, a random session identifier for that visit, your browser’s user-agent string, and a one-way cryptographic hash of your IP address. We do not store your IP address itself. The hash exists so we can stop one connection from submitting the form hundreds of times; it cannot be reversed back into an address.
We do not ask for and do not want financial information, health information, government identifiers, or any information about your customers.
Why we need it before showing your result
The result is a specific read on your business, and we send you a copy in writing. That requires an address to send it to. It also means a person here reads your answers before anyone contacts you, rather than a form dumping into an automated sequence. If you would rather not give us an email address, don’t complete the last step — nothing you answered is stored until you press the final button.
Where it goes
- Our database. A MySQL database on our hosting at Hostinger. This is the copy we own and control.
- Our CRM. A copy of your contact details, result and answers is sent to GoHighLevel, which we use to manage conversations and follow-up.
- Our email. We are notified by email on every completed diagnostic, and you receive a copy of your own result.
Both Hostinger and GoHighLevel process data on our behalf under their own terms. We do not sell your information, we do not share it with advertisers, and we do not trade or rent contact lists.
The emails
If you leave the consent box ticked, we may send you occasional notes about the five leaks and how businesses close them. Every one of those emails has a working one-click unsubscribe. Unticking the box means you get your result and nothing else. Replying “stop” to any email from us works too, and reaches a human.
Cookies and tracking
This site sets no cookies and runs no third-party analytics, advertising pixels or trackers.
Fonts, styles and scripts are served from our own domain, so nothing about your visit is sent
to Google, Meta or a CDN by loading this page. The only browser storage we use is
sessionStorage, holding the campaign parameters from your link for the length of
your visit; it is discarded when you close the tab.
How long we keep it
Diagnostic records are kept for 24 months, then deleted. If you become a client, your records are kept for as long as we work together and for seven years afterwards where tax or contractual obligations require it.
Your rights
You can ask us to show you everything we hold about you, correct it, delete it, or stop emailing you. Email [email protected] and we will action it within 30 days — usually the same week. We will not ask you why, and asking will never affect how we deal with you.
If you are in California, this includes the rights to know, delete, correct, and opt out of sale or sharing under the CCPA/CPRA. We do not sell or share personal information as those terms are defined. If you are in the UK or EU, our lawful basis is your consent for marketing email, and legitimate interest for responding to a diagnostic you chose to submit.
Security
The site is served over HTTPS. Credentials are held in a configuration file outside the public web directory. Submissions are validated and stored using parameterised queries. No system is perfect; if you believe you have found a vulnerability, email [email protected] and we will take it seriously and credit you.
Changes
If this policy changes materially, the date at the top changes and we email anyone whose details we hold. We will not quietly widen what we do with your information.