Privacy

What we collect, and what we do with it.

Last updated 16 August 2026. Written to be read rather than to be legally impenetrable. If anything here is unclear, email [email protected] and we’ll answer in plain language.

Who we are

OneWave operates the website at onewave.in. We are the data controller for the information described below. Contact for any privacy question, including deletion: [email protected]. Our registered business details and postal address are available on request to the same address.

What the diagnostic collects

When you complete the six-question diagnostic and submit the form, we store:

• What you told us: your name, email address, and — only if you chose to give them — your phone number and business name.
• Your six answers, and the result our scoring produced from them.
• How you arrived: the campaign, source and medium parameters in the link you clicked (utm_source, utm_medium, utm_campaign, utm_term, utm_content), a Google or Meta click identifier if one was present, the page you landed on, and the referring website.
• Technical details: the date and time, a random session identifier for that visit, your browser’s user-agent string, and a one-way cryptographic hash of your IP address. We do not store your IP address itself. The hash exists so we can stop one connection from submitting the form hundreds of times; it cannot be reversed back into an address.

We do not ask for and do not want financial information, health information, government identifiers, or any information about your customers.

Why we need it before showing your result

The result is a specific read on your business, and we send you a copy in writing. That requires an address to send it to. It also means a person here reads your answers before anyone contacts you, rather than a form dumping into an automated sequence. If you would rather not give us an email address, don’t complete the last step — nothing you answered is stored until you press the final button.

Where it goes

• Our database. A MySQL database on our hosting at Hostinger. This is the copy we own and control.
• Our CRM. A copy of your contact details, result and answers is sent to GoHighLevel, which we use to manage conversations and follow-up.
• Our email. We are notified by email on every completed diagnostic, and you receive a copy of your own result.

Both Hostinger and GoHighLevel process data on our behalf under their own terms. We do not sell your information, we do not share it with advertisers, and we do not trade or rent contact lists.

The emails

If you leave the consent box ticked, we may send you occasional notes about the five leaks and how businesses close them. Every one of those emails has a working one-click unsubscribe. Unticking the box means you get your result and nothing else. Replying “stop” to any email from us works too, and reaches a human.

Cookies and tracking

This site sets no cookies of its own and runs no analytics, advertising pixels or trackers. We do not build a profile of you and we do not sell or share data with advertisers.

Two things do reach other companies simply because you loaded this page, and it would be dishonest not to name them. The site is hosted on GoHighLevel, so their servers see the normal request information any web host sees. The two typefaces are served by Google Fonts, which means your browser makes a request to Google to fetch them; Google states it does not use those requests for advertising or set cookies for them. Neither is optional while the site is hosted where it is, and if that changes — we self-host the fonts, or move the site — this page changes with it.

The only browser storage we use is sessionStorage, holding the campaign parameters from your link for the length of your visit; it is discarded when you close the tab.

How long we keep it

Diagnostic records are kept for 24 months, then deleted. If you become a client, your records are kept for as long as we work together and for seven years afterwards where tax or contractual obligations require it.

Your rights

You can ask us to show you everything we hold about you, correct it, delete it, or stop emailing you. Email [email protected] and we will action it within 30 days — usually the same week. We will not ask you why, and asking will never affect how we deal with you.

If you are in California, this includes the rights to know, delete, correct, and opt out of sale or sharing under the CCPA/CPRA. We do not sell or share personal information as those terms are defined. If you are in the UK or EU, our lawful basis is your consent for marketing email, and legitimate interest for responding to a diagnostic you chose to submit.

Security

The site is served over HTTPS. Credentials are held in a configuration file outside the public web directory. Submissions are validated and stored using parameterised queries. No system is perfect; if you believe you have found a vulnerability, email [email protected] and we will take it seriously and credit you.

Changes

If this policy changes materially, the date at the top changes and we email anyone whose details we hold. We will not quietly widen what we do with your information.