Privacy Policy

1. Who we are

Freaking Minds is a creative and digital marketing agency based in Bhopal, Madhya Pradesh, India. This policy explains what personal data we collect through this website, our portals, FM Academy, the CreativeMinds talent network and our WhatsApp number, what we do with it, and the choices you have.

For the purposes of India’s Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000, we decide how and why your data is used, so we are responsible for it. You can reach us at freakingmindsdigital@gmail.com.

2. What we collect

We only collect what you give us, plus a small amount of technical information your browser sends.

When you contact us or ask for a proposal

• The contact form and the get-started form ask for your name, email address, company, what you need, your budget and timeline, and optionally your phone number, website and job title.
• We also store the consent wording shown under the form when you sent it, so we have a record of what you agreed to.

When you take the marketing scorecard

• Your name, email address, and optionally your company and phone number, together with your answers and the score we calculate from them.

When you apply to CreativeMinds

• Your name, email address, phone number and location (city, state, country), a short bio, languages, your professional category, skills, tools and experience, your rates, your availability, and links to your portfolio, website, work samples and social profiles.
• We don’t ask you to upload files. Your work stays wherever you host it, and we look at it through the links you give us.

When you enrol in FM Academy

• Your name and email address, and optionally your phone number, company and a message to us.
• The order and payment reference numbers and payment status that Razorpay sends back to us. We never see or store your card, UPI or bank details — Razorpay handles those directly.

When you message us on WhatsApp

• Your phone number, the name on your WhatsApp profile, and the messages you send us. If you type an email address into the chat, we may add it to your enquiry.

When you book a call

• Bookings are made through Cal.com. It sends us your name, email address, the time you chose and anything you write in the booking form.

When you reply to one of our ads

• If you fill in a lead form inside a Facebook or Instagram ad (Meta) or a Google ad, the platform passes us the details you entered, usually your name, email address and phone number.

When you use a portal

• Clients, approved talent and our own team can sign in to private portals. We keep your account details and what you do there: messages, support tickets, approvals, documents you upload and similar project records.

Technical and attribution data

• When you submit any of the public forms above, we record your IP address and your browser’s user-agent string. We use these to tell genuine submissions from spam and bots.
• We remember how you first arrived on the site (the referring page, the landing page and any campaign tags in the link, such as UTM parameters or Google and Meta click IDs) and attach it to your enquiry if you send one. This is kept in your browser until then.
• Our hosting provider keeps standard server logs, which include IP addresses.

3. How we use it

We use your data to:

• reply to your enquiry, prepare proposals and deliver the work you hire us for;
• email you the scorecard report you asked for;
• review CreativeMinds applications and, if you are accepted, match you with projects;
• take payment for Academy seats, confirm your place and send you the joining details;
• run the client, talent and team portals;
• keep the site and our forms secure, and filter out spam;
• understand which pages and campaigns bring people to us, so we can improve them;
• keep the records the law requires, such as payment and tax records.

We rely on your consent, which you give when you send us a form or message, and on the uses the law allows without separate consent, such as keeping records we are legally required to keep. You can withdraw your consent at any time (see section 11). Withdrawing it doesn’t affect anything we did before you withdrew.

Some of this work is automated. We score new enquiries so we know which to answer first, and we use an AI model provider to draft internal summaries of enquiries and suggested replies for our team, and to help draft content for our clients. The score only changes the order in which we respond; it doesn’t decide whether you get a reply.

We don’t sell your personal data.

4. Follow-up emails and WhatsApp

If you send us an enquiry, we may reply by email, phone or WhatsApp, and we may send you a short series of follow-up emails about it. We only send these to people who contacted us or agreed to hear from us, and never to anyone on our do-not-contact list.

• Every follow-up email has an unsubscribe link, and supports one-click unsubscribe in email apps that offer it. You can also reply with “unsubscribe” in the subject line.
• On WhatsApp, reply “STOP” (or tap the opt-out button on a marketing message) and we won’t message you again.
• Once you opt out, we add your email address or phone number to our do-not-contact list, which we check before every message we send.

Emails about something you have already started, such as your scorecard report, an Academy payment receipt, or a single reminder if you started an Academy checkout but didn’t finish paying, are part of the service you asked for.

5. Cookies and local storage

The site itself uses very little. What it stores in your browser:

• fm-consent (local storage): your answer to the cookie banner, so we don’t ask again and so your choice applies before any analytics load.
• fm-site-theme (local storage): whether you chose the light or dark theme.
• fm_first_touch (local storage): how you first arrived on the site, as described in section 2.
• Sign-in cookies for the portals: fm_client_session and fm_talent_session (each lasts up to 7 days), and fm-admin-session and fm-admin-user for our team (up to 24 hours). They are only set when you sign in and are needed for the portals to work.
• Analytics cookies set by Google Analytics, only where analytics are allowed (see section 6).

The third-party tools listed in section 7 may also set their own cookies or storage when they load. You can clear or block cookies and local storage in your browser settings at any time. Clearing fm-consent brings the cookie banner back so you can choose again.

6. Analytics and consent

We use Google Tag Manager to load Google Analytics 4, which tells us how the site is used: which pages people visit, where they came from, and actions such as sending a form, booking a call or paying for a seat.

We use Google Consent Mode, and it works differently depending on where you are:

• In the European Economic Area, the United Kingdom and Switzerland, analytics and advertising storage are off until you press Accept on the cookie banner. Until then Google Analytics sets no cookies and receives only cookieless signals.
• Everywhere else, including India, analytics are on by default, and pressing Decline switches them off.

The same choice controls our other third-party tools: the AgentWorks chat assistant, the Cal.com booking window and a small Observatory monitoring script that measures page views, speed and errors. In the European Economic Area, the United Kingdom and Switzerland they load only after you press Accept; everywhere else they load unless you press Decline. If they’re off, you can still book a call: the booking page opens on Cal.com instead.

Your choice is saved in your browser and applied before any of these load on every later visit.

7. Who we share it with

We share personal data only with the people and services that need it to do the jobs described above. The services we use are:

• Supabase: our database and file storage, where form submissions, enrolments and portal data are kept.
• Vercel: hosts the website and runs its server code.
• Razorpay: takes Academy payments. Your payment details go to Razorpay, not to us.
• Resend: sends our emails, and tells us when one bounces or is marked as spam.
• Inngest: runs our background jobs, such as sending emails and notifications after a form is submitted.
• Google: Google Tag Manager and Google Analytics 4 (see section 6), and Google Drive, where documents shared through the client portal are stored. If you reply to a Google ad lead form, Google passes us your details.
• Meta: the WhatsApp Business Platform, which carries our WhatsApp conversations, and Meta lead ads, if you reply to one.
• Cal.com: our booking calendar.
• AgentWorks: runs the chat assistant on our public pages. What you type into it is processed by AgentWorks.
• Observatory: the site monitoring script described in section 6.
• An AI model provider: receives enquiry details when we draft internal summaries and replies, and client material when we draft content for a client.

These providers process data on our behalf and under their own terms and privacy policies. Within our team, access to enquiries and portal data is limited to the people who need it.

If you are an approved CreativeMinds member, your profile page (name, bio, location, contact details, skills, rates, availability and portfolio links) can be seen by anyone who has its link, and we may share it with clients when proposing you for a project. You can edit these details from your talent portal.

We may also disclose data where the law requires it, for example to a court or a government authority with the power to ask for it.

8. Where your data is processed

Several of the services above are run by companies based outside India, so your data may be stored or processed in other countries. Where that happens, we rely on the provider’s own contractual and security commitments, and we do not transfer data to any country the Government of India has restricted.

9. Security

We protect your data with encrypted connections (HTTPS), restricted access to our database and admin tools, portal session cookies that scripts in the page can’t read, verified signatures on incoming payment and platform webhooks, and rate limits and spam filters on our public forms. No system is perfectly secure, though, so we can’t promise that data will never be accessed without permission. If a breach affects your personal data, we will tell you and the authorities as the law requires.

10. How long we keep it

We keep personal data only for as long as we need it for the purpose we collected it for, or for as long as the law requires. In practice:

• enquiries, scorecard submissions and talent applications are kept while they are useful to our conversation with you, and deleted when you ask us to;
• client and project records are kept for the length of our work together and afterwards for as long as we need them for legal, tax and accounting purposes;
• Academy enrolment and payment records are kept as long as tax and accounting law requires;
• if you opt out of our messages, we keep your email address or phone number on our do-not-contact list, because that is the only way to make sure we don’t contact you again;
• portal sign-in cookies expire after the periods listed in section 5;
• we set Google Analytics to keep event data for 14 months.

11. Your rights

Under India’s Digital Personal Data Protection Act, 2023, you have the right to:

• ask what personal data we hold about you and how we use it, and who we have shared it with;
• have inaccurate or incomplete data corrected or updated;
• have your data erased when it is no longer needed, unless the law requires us to keep it;
• withdraw your consent at any time, as easily as you gave it;
• have a grievance about how we handle your data dealt with (see section 14);
• nominate someone to exercise these rights for you if you die or become unable to.

If you are in the European Economic Area or the United Kingdom, you have similar rights under the GDPR and UK GDPR, including the right to object to how we use your data and to ask for a copy of it in a portable format, and you can complain to your local data protection authority.

To use any of these rights, email freakingmindsdigital@gmail.com. We may need to confirm who you are before we act on a request.

12. Children

This site isn’t aimed at children and we don’t knowingly collect data from anyone under 18 without a parent’s or guardian’s consent. If you are under 18, please ask a parent or guardian to contact us before you enrol in an Academy programme or send us your details. If you think a child has sent us personal data, email us and we will delete it.

13. Changes to this policy

We will update this policy when what we do with your data changes, and change the “Last updated” date at the top. If a change is significant, we will make it clear on the site, or tell you directly if we have a way to reach you.

14. Contact and grievances

For questions about this policy, to use your rights, or to raise a grievance about how we handle your data, contact our grievance officer:

We will acknowledge your grievance and respond as quickly as we can. If you are not satisfied with our answer, you can complain to the Data Protection Board of India.