Privacy Policy

This Privacy Policy applies to WordLord Media (“WordLord Media”, “we”, “us”, or “our”), an independent creative marketing and digital studio based in Ludhiana, Punjab, India. This document governs personal data collected through:

• The primary marketing website at wordlordmedia.com.
• Our client operations and project management portal at admin.wordlordmedia.com.
• Direct business communications via email, telephone, and WhatsApp.
• Contracted branding, content production, search engine optimization, and marketing engagements.

Under India's Digital Personal Data Protection Act, 2023 (DPDP Act), WordLord Media acts as a Data Fiduciary for information gathered directly from website visitors, prospective clients, and portal users. When we process audience or campaign data supplied directly by a business client for marketing execution, we act as a Data Processor under the specific terms of our commercial agreement with that client.

We restrict data collection to information directly necessary for legitimate business operations:

• Direct Inquiries: Your full name, professional email address, WhatsApp or phone number, company name, project requirements, and any notes submitted through our contact forms or direct messages.
• Account Credentials: Name, work email address, assigned organizational role, and encrypted session identifiers for users authorized to log into admin.wordlordmedia.com.
• Client Deliverable Assets: Brand guidelines, logos, footage, product photographs, and project copy provided by clients for project execution.
• Server Telemetry: Standard web server logs containing IP addresses, operating system, browser type, referring URLs, and timestamped page requests, used strictly for system administration and server security.

We do not solicit or intentionally store sensitive personal data, including financial passwords, payment card numbers, government identification cards, medical records, or biometric information.

WordLord Media offers Google Sign-In as an authentication option on our internal operations platform at admin.wordlordmedia.com for registered staff and invited clients.

Clients who connect their Instagram Business or Creator accounts to our analytics dashboard do so via Facebook Login for Business through official Meta Graph API endpoints.

• Authorized Scopes: instagram_basic (account identifier, username, profile photo), instagram_manage_insights (read-only follower count, reach, and engagement totals), pages_show_list, and pages_read_engagement (identifying linked Facebook Pages).
• Strictly Read-Only Access: We use this integration exclusively to display historical performance charts and post engagement summaries for the authorized business. We do not publish posts, modify account settings, or access private direct messages.
• Decoupled Token Encryption: All Meta OAuth tokens are encrypted at rest using AES-GCM with 256-bit keys. Encryption keys are stored separately from application databases. Tokens are decrypted only in secure server-side routines and are never exposed to browser code.

Under Meta Platform Terms, Google API Policies, and the India DPDP Act, you have the right to request deletion of any stored personal data, platform tokens, or connected account records.

We process collected information solely for clear, defined operational needs:

• To review project briefs and prepare commercial proposals for marketing or branding engagements.
• To execute contracted creative deliverables, content production, and analytics reporting.
• To authenticate authorized clients and staff on our operations management platform.
• To issue invoices, process payments, and fulfill statutory tax reporting under Indian law.
• To safeguard our web servers and APIs against unauthorized access, automated attacks, and security vulnerabilities.

We process personal data under recognized statutory grounds:

• Consent: Given freely when you submit an online form, email us an inquiry, or authorize an OAuth connection.
• Contract Performance: When processing is necessary to execute a Statement of Work or service agreement.
• Legitimate Business Interests: When necessary to protect system security, detect fraudulent requests, or maintain network stability.
• Legal Obligation: When required to comply with binding statutory mandates, including tax record retention under Indian law.

We maintain a minimal cookie footprint. We do not use third-party advertising tracking cookies or cross-site data sharing pixels.

• Session Cookies: Temporary, encrypted cookies required to maintain authenticated sessions on admin.wordlordmedia.com.
• Local Storage: If you use our website accessibility settings (such as high-contrast display or font scaling), your selections are saved locally in your browser's localStorage. This data stays on your device and is never sent to our servers.

WordLord Media does not sell, rent, or lease personal data. We disclose personal information only to:

• Vetted Service Providers: Reliable cloud hosting, managed database, and transactional email infrastructure providers bound by strict data processing and confidentiality agreements.
• Statutory and Legal Authorities: Law enforcement or judicial bodies only when compelled by a valid, binding court order or legal requirement under applicable law.
• Corporate Restructuring: An acquiring or successor entity in the event of a merger, acquisition, or asset transfer, subject to this same privacy policy.

While WordLord Media is based in India, we work with clients in the United States, Canada, the United Kingdom, and the UAE. Certain cloud infrastructure partners maintain servers in multiple secure regions.

When personal data is transferred across international borders, we ensure adequate protection through encrypted transmission protocols (TLS 1.3) and standardized contractual data protection clauses.

We maintain comprehensive technical and operational safeguards to protect your personal data:

• Transport Security: Strict HTTPS with TLS 1.3 across all domains, backed by automated SSL certificate rotation.
• Storage Security: Database backups and third-party integration tokens are encrypted at rest using AES-GCM-256.
• Access Controls: Administrative portal access requires multi-factor authentication (MFA) and is restricted to authorized personnel.
• Input Sanitization: Web forms and API endpoints utilize strict input validation to prevent SQL injection, cross-site scripting, and unauthorized access.

We retain personal information only for as long as necessary to satisfy the purpose for which it was gathered:

• General Inquiries: Contact information from prospective clients who do not engage our services is purged after 180 days.
• Active Client Records: Client account details, project assets, and communication history are retained for the duration of the commercial engagement.
• Financial and Tax Records: Invoices, payment confirmations, and contracts are retained for 7 years to comply with statutory requirements under Section 36 of the Central Goods and Services Tax Act, 2017.
• Connected Social Tokens: OAuth tokens and cached metrics are purged within 48 hours of user disconnect or written deletion request.

Under the India DPDP Act, EU GDPR, and applicable privacy regulations, you have explicit rights regarding your personal data:

• Right to Access: Request a summary of the personal data we hold about you and how it is processed.
• Right to Correction: Request prompt updating or correction of incomplete or inaccurate data.
• Right to Erasure: Request deletion of your personal records where ongoing processing is not required by law.
• Right to Withdraw Consent: Revoke consent for marketing or third-party integrations at any time.
• Right to Nominate: Under Section 14 of the DPDP Act, nominate another individual to manage your data rights in the event of death or incapacity.
• Right of Grievance Redressal: Submit inquiries to our Grievance Officer and receive a formal response within statutory timelines.

We send informational updates or proposals only where you have explicitly opted in or initiated an inquiry. You can stop marketing messages at any time:

• Email: Click the “Unsubscribe” link in the footer of any marketing email.
• WhatsApp: Reply STOP to any broadcast message to immediately halt future automated updates.

Our website and creative services are directed exclusively at commercial businesses and adults aged 18 and older. We do not knowingly collect personal information from minors. If you believe a minor has submitted personal information to us, please contact our Grievance Officer and we will delete the data immediately.

We may update this Privacy Policy from time to time to reflect operational, legal, or regulatory changes. Any updates will be published on this page with an updated “Last Updated” date at the top. Material changes will be communicated directly to active clients.

In accordance with Section 8(10) of the Digital Personal Data Protection Act, 2023, WordLord Media has appointed a dedicated Grievance Officer to address questions, data access requests, or privacy concerns.

Response Timeline: Inquiries are formally acknowledged within 48 hours, and substantive resolution is provided within 30 days as mandated by the DPDP Act.