Privacy Policy
Last updated: 9 November 2026Airpop Media, a sole proprietorship of Mohd Wasif Ahmed ("Airpop Media", "we", "us", "our"), is an AI-first creative agency based in Noida, India. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website at airpopmedia.com, use our services, or interact with us in any way.
- Contact form submissions: name, email address, company name, project details, and budget preferences
- Brand audit requests: name, work email address, the website you want reviewed and anything you ask us to focus on
- Booking requests: name, email, and scheduling information via Cal.com
- Business inquiries: any information you share via email at connect@airpopmedia.com
- Airpop OS checkout: your name, email, phone number, business name, billing address, and GSTIN if supplied, together with your acceptance of the subscription terms
- Digital product purchases from our store: your name, email address, billing country and, in India, your state, plus a GSTIN, company name and address if you add them for a business invoice, together with your acceptance of the terms of sale. We use them to take the payment, issue your tax invoice and deliver your files
- Your purchases account at airpopmedia.com/account: the email address you sign in with. We email a one-time 6-digit code to it, only if that address has bought from us; the code works for 10 minutes and is stored only in a scrambled (hashed) form
- Standard web server access logs, which record your IP address, browser and operating system, the page requested, the site you arrived from, and the time of the request
- On our digital store pages, the country your IP address belongs to, so we can show prices in your currency. The lookup runs on our own server against a country database we hold; your IP address is not sent to anyone and not saved for it, and the result is used only to choose the currency. You can switch the currency yourself, and at checkout the billing country you choose is what counts. The country data is based on public registry data, including statistics from the NRO
- When you download a file you bought, the time of the download, so we can keep each purchase to a fair number of downloads a day. We do not record your IP address or browser with it
- The landing-page URL, referring URL and time of your first visit, together with any campaign and click identifiers in the link you arrived by (utm parameters, a Google gclid, a Meta fbclid or a LinkedIn li_fat_id), are kept in browser local storage for 30 days to identify the source of an enquiry or brand audit request if you submit one
- Anonymised usage statistics from Umami, an analytics tool that runs on our own server: the pages viewed, the site you arrived from, your country and device type, browser and screen size, and events such as sending an enquiry. It sets no cookies and stores no personal data. Visits are counted under a hash that changes every month and cannot be traced back to you, and it honours your browser's Do Not Track setting
- Analytics tags, only if you choose "Accept all" or "Analytics only" in the cookie banner: Google Analytics 4 (pages viewed, sessions, approximate location, device and browser, and the same events; Google LLC, United States) and Microsoft Clarity (heatmaps and session replays of scrolling, clicks and movement, with anything you type into a form masked before it is recorded; Microsoft Corporation, United States)
- Marketing tags, only if you choose "Accept all": Google Ads conversion measurement and remarketing (Google LLC), the Meta pixel for Facebook and Instagram ads (Meta Platforms, Inc.) and the LinkedIn Insight Tag (LinkedIn Corporation, a Microsoft company), all in the United States. They receive page views and the events enquiry, book_call, whatsapp_click, work_viewed, scroll_75, checkout_start and purchase, with the service, a random reference number for each enquiry so it is not counted twice, the page the link was on, the project viewed, that a page was read three quarters of the way down, and the amount and currency of a purchase, never your name, email address, phone number or anything you typed into a form. Nothing from Google, Meta, LinkedIn or Microsoft loads before you choose, and you can withdraw at any time through "Cookie preferences" in the footer
- With the Meta pixel, Meta’s own "Conversions API with Meta" service also passes the same events to Meta from Meta’s servers, so they are not lost to ad blockers or browser limits. It runs only after "Accept all", like the pixel, and receives nothing beyond what the pixel sends
- Booking details you enter into the Cal.com scheduling widget on our Hire Us page
- Anonymous play counts from the Vimeo players on our site, which run in Do Not Track mode and are not linked to you
- Payment and subscription references, payment status, billing-cycle information, and cancellation updates from Razorpay when you buy an Airpop OS subscription
- Payment references and payment status from Razorpay when you buy a digital product, including whether a payment was refunded
- To respond to your inquiries, process contact form submissions, and prepare and email a brand audit you have requested
- To schedule and manage discovery calls via Cal.com
- To deliver, maintain, and improve our website and services
- To send project updates, proposals, and invoices to existing clients
- To reply to enquiries faster: a new enquiry gets an automatic first reply after a spam check, first on our own server and then by Claude, an AI model from Anthropic, which reads the enquiry only to judge whether it is spam. Follow-ups are drafted with Claude and approved by a person before they are sent
- To process Airpop OS subscriptions, arrange white-label onboarding, manage renewals and cancellations, and provide billing support. Buying a subscription does not subscribe you to marketing emails
- To sell digital products: take the payment, issue and email your tax invoice, deliver your files, and let you sign in to your purchases account to download them again. Buying a product does not subscribe you to marketing emails
- To comply with legal obligations and protect our rights
We do not sell your personal information. We may share your data with:
- Service providers: website and application hosting, database hosting (Neon), scheduling (Cal.com), video hosting (Vimeo), email delivery (Resend), AI processing (Claude by Anthropic, for the enquiry spam check, drafting follow-ups a person approves and our internal tools; OpenAI, used only on our own public website content, never on your information), error tracking (Sentry), encrypted backup storage (Backblaze), payments for Airpop OS subscriptions and digital products (Razorpay), website analytics (Google Analytics and Microsoft Clarity, only after you allow analytics in the cookie banner) and advertising measurement (Google Ads, Meta, LinkedIn, only after you choose "Accept all"), who assist in operating our business
- Razorpay receives checkout contact and payment information to process payments, authorise recurring charges, prevent fraud, and provide payment-related notifications. Payment credentials are entered directly in Razorpay Checkout; we do not store full card numbers, card security codes, or UPI PINs
- For a digital product, our server sends Razorpay only the amount, the currency and our order reference. Your name and email address reach Razorpay through its checkout, which fills them in from the form you completed
- Resend delivers the emails for a digital product purchase: your receipt with the tax invoice attached, and the sign-in codes for your purchases account
- Advertising measurement from our own records, only if you chose "Accept all" in the cookie banner: if your enquiry arrived through a link from a Facebook or Instagram ad (a Meta fbclid) or a Google ad (a gclid), we may report to Meta or Google Ads that the enquiry, a booked call or a won project happened, with that click identifier, the time and, for a won project, its value. Your choice is recorded with the enquiry; with "Analytics only", "Decline" or no choice, nothing is reported from our records. Never your name, email address, phone number, IP address or anything you wrote. This tells us which ads bring work; it does not identify you to us or to them beyond the click they already recorded
- Legal authorities: when required by law, subpoena, or to protect our rights
- Business transfers: in the event of a merger, acquisition, or sale of assets
Airpop Media sets no cookies of its own by default. Umami, our own analytics on our own server, runs for every visitor and sets no cookies. Everything else waits for your choice in the cookie banner: "Accept all" allows analytics and marketing tags, "Analytics only" allows only the analytics tags, and "Decline" allows neither. Nothing from Google, Meta, LinkedIn or Microsoft loads before you choose. The allowed tags load through one Google Tag Manager container (googletagmanager.com), which itself sets no cookies and is told your choice through Google Consent Mode. We use browser storage for the cart, checkout access, enquiry attribution, your cookie choice, and on the store your currency choice and purchases account sign-in. Embedded booking and payment providers may use their own cookies and storage.
- Umami runs on our own server and sets no cookies. It keeps anonymised page views, referrers, country and device type under a visitor hash that rotates monthly and cannot be traced back to you, and it honours Do Not Track. Nothing from it leaves our server
- Analytics (after "Accept all" or "Analytics only"): Google Analytics 4 sets _ga and _ga_<id> on airpopmedia.com for up to 2 years (Google LLC, United States). Microsoft Clarity records heatmaps and session replays with typed form fields masked, and sets _clck for 1 year and _clsk for 1 day on airpopmedia.com, plus Microsoft's own cookies on clarity.ms and bing.com (MUID, CLID, ANONCHK, SM, MR, SRM_B) (Microsoft Corporation, United States)
- Marketing (after "Accept all" only): Google Ads sets _gcl_au for 3 months, and other _gcl_ cookies for 3 months if you arrive from a Google ad (Google LLC). The Meta pixel sets _fbp for 3 months and, if you arrive from a Facebook or Instagram ad, _fbc for 3 months (Meta Platforms, Inc., United States); we do not use Meta's Advanced Matching. The LinkedIn Insight Tag sets li_sugr, bcookie, lidc, UserMatchHistory and AnalyticsSyncHistory on linkedin.com for up to 2 years and ln_or on airpopmedia.com for 1 day (LinkedIn Corporation, a Microsoft company, United States). These tags receive page views and the events enquiry, book_call, whatsapp_click, work_viewed, scroll_75, checkout_start and purchase, with no personal fields
- You can change your mind at any time through "Cookie preferences" in the footer. Choosing less than before stops the tags you refused and removes the cookies they set on airpopmedia.com; cookies set on a provider's own domain, such as linkedin.com, can be removed in your browser settings
- Your cookie choice (analytics yes or no, marketing yes or no, and when you chose) is kept in local storage (airpop.consent) for 180 days, after which we ask again. Choices made under our earlier analytics-only banner are not reused
- Your cart selection is kept in local storage until you remove it, complete checkout, or clear your browser data. It stores the product selection, not payment credentials
- Checkout and subscription access details are kept in session storage for the current browser session. Closing that session or clearing its data can remove your access to the subscription page; contact connect@airpopmedia.com with your payment or subscription reference for help
- On the digital store: the currency you choose is kept in local storage (airpop-store-currency-v1) until you clear it, and contains no personal data. The orders you place in a tab are kept in session storage (airpop-store-orders-v1: the order reference and a private access token, so the confirmation page can show your downloads; airpop-store-attempt-v1: a scrambled fingerprint of the checkout form, never the details themselves, with its checkout reference and access token, so pressing Pay again does not create a second order). When you sign in to your purchases account, its session token is kept in local storage (airpop-store-account-v1) for up to 30 days and removed when you sign out. These are needed for the store to work, so we do not ask for consent for them
- Enquiry attribution is kept in local storage (airpop_first_touch) for 30 days: the landing page, the referrer and the campaign and click identifiers from the link you arrived by. The first visit wins; a later visit replaces it only once those 30 days have passed. When local storage is unavailable, session storage holds it for the current browser session instead. If you submit an enquiry or a brand audit request, that source information is sent with it
- The Cal.com booking widget on our Hire Us page sets its own third-party cookies. The calendar loads as soon as that page opens
- Razorpay Checkout loads when you choose to pay. Razorpay may use cookies and browser storage for checkout, security, and its own services under its privacy policy
- The Vimeo players embedded on our site run in Do Not Track mode and do not record your viewing for advertising or profiling. They still set Cloudflare security cookies on vimeo.com (__cf_bm, cf_clearance and __cf_ob) that help Vimeo tell visitors from bots.
- You can block or clear cookies and browser storage using your browser settings. This can clear the cart and checkout access or prevent the booking calendar and payment checkout from working
We retain your personal information only for as long as necessary to fulfill the purposes outlined in this policy. Enquiries sent through our contact form are kept for as long as they remain relevant: while we are in conversation with you, and afterwards as a record of it should you come back to us. We do not delete them on a fixed schedule. You can ask us to delete your enquiry using the contact details on this page. Server access logs are retained for about two weeks. They rotate daily and the last 14 days are kept, after which they are deleted automatically. Client project data is retained for the duration of the engagement plus 3 years. Subscription, payment, consent, and tax records are retained as needed for the subscription, billing support, disputes, and applicable legal and accounting obligations; these obligations may limit deletion. Digital product orders and their tax invoices are kept for as long as Indian tax and accounting law requires, which also limits deletion, and your purchases stay available in your account. Sign-in codes are deleted after a day, and account sessions end after 30 days or when you sign out. Encrypted backups are kept for up to about 13 months and then deleted, so deleted information can remain in a backup until that backup expires.
Depending on your jurisdiction, you may have the right to:
- Access the personal data we hold about you
- Request correction of inaccurate or incomplete data
- Request deletion of your personal data
- Object to or restrict processing of your data
- Withdraw consent at any time where processing is based on consent
- Data portability: receive your data in a structured, machine-readable format
To exercise any of these rights, contact us at connect@airpopmedia.com. We will respond within 30 days.
We implement appropriate technical and organizational measures to protect your personal information, including encrypted connections (HTTPS/TLS), secure hosting infrastructure, access controls, and regular security reviews. However, no method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security.
Our offices are in Noida. Our database is hosted in Singapore, and some of the other service providers we rely on, such as our scheduling, video hosting, email delivery, AI, error tracking, and backup storage providers, and Google, Microsoft, Meta and LinkedIn for the analytics and marketing tags you allow in the cookie banner, operate servers outside India, including in the European Union and the United States, so your information may be transferred to and processed in those countries. We rely on each provider's published terms and security commitments for these transfers, and we share only what each one needs to do its job.
Our services are not directed to individuals under the age of 16. We do not knowingly collect personal information from children. If you believe we have collected data from a minor, please contact us immediately and we will delete it.
Our website may contain links to third-party sites such as Instagram, LinkedIn, Behance, and Vimeo. We are not responsible for the privacy practices of these external sites. We encourage you to review their privacy policies before providing any personal information.
We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. Continued use of our website after changes constitutes acceptance of the revised policy.
If you have any questions about this Privacy Policy or our data practices, please contact us:
- Email: connect@airpopmedia.com
- Website: airpopmedia.com
- Entity: Airpop Media, a sole proprietorship of Mohd Wasif Ahmed
- Registered office: FN 701, Plot no 661, Shalimar Garden Extension 1, Sahibabad, Ghaziabad, Uttar Pradesh 201005