Privacy Policy

Effective date: 31 May 2026. Last updated: 19 September 2026.

BeginThings ("we", "us", "our") operates beginthings.com and the products listed on it. This policy explains what we collect, how we use it, your rights, and how to contact us. Because BeginThings offers five distinct categories of products, the data we handle differs by category. The table below shows the scope honestly so you know what to expect before you start.

1. The 5 product categories and what each one collects

Category	Examples	What is collected
1. Free Tools	QR Creator, Invoice Generator, UPI QR, the /free-tools/ catalog	The content you enter stays in your browser. Google Analytics page views and the limited campaign identifiers described below are processed only if you accept analytics. No login, signup or email is required.
2. Account-based Workspace	BeginRooms / Workspace 3D	When you sign in, we receive the account profile supplied by Google or the email-link flow. Rooms and boards saved to your account are transmitted over HTTPS and stored for account access and cross-device sync. We do not request Google Drive, Calendar or Gmail access.
3. Subscription and release-gated products	BeginRooms; FormulaMapper when released	For BeginRooms we store the verified account email, selected product and plan, trial and entitlement timestamps, transaction identifiers, and the billing profile described below. FormulaMapper downloads and new subscriptions are currently paused; a future compatible build may also store a machine identifier and hashed device token so a licence can be issued to the correct installation. Card and bank credentials are entered only in Razorpay.
4. Paid Digital Products	FollowUp Desk, templates, toolkits, workbooks and guides on /shop.html	We store the billing and delivery details you enter at checkout, the product, amount and transaction identifiers, and delivery status. We never see your card, UPI PIN or bank credentials.
5. Paid Services	Audits, conversion sprints, custom dev	The contact details and project information you provide directly via email or the lead-capture form. Used only to deliver the engagement.

2. Information you provide directly

Email address, if you subscribe to our newsletter, fill out a lead-capture form, or contact us at sourav@beginthings.com.
Google account profile (name, email, profile picture) if you sign in to Workspace 3D or any future Cat 2 product. Provided by Google after you authenticate. We do not request additional Google scopes such as Drive, Calendar, or Gmail.
Checkout and order details if you purchase any Cat 3, 4, or 5 product: full name, delivery email, one-line billing address including city, country, State or Union Territory (or state/province outside India), postal code, optional GSTIN, selected product and plan, amount, transaction identifiers, payment status and fulfilment status. The Indian GST state code is derived from the State or Union Territory you select; we do not ask you to type it.
Project details if you engage a Cat 5 service. Treated as confidential between you and BeginThings.

3. Information collected automatically

Google Analytics 4 (measurement ID G-7PBJMQL1LZ): page views, referrer, approximate location (city level), device type, browser, anonymized IP. Disabled by default until you accept the cookie banner.
Consented campaign attribution: if you accept analytics, the current tab may keep the first valid gclid, gbraid, wbraid, utm_source, utm_medium, utm_campaign, utm_content and utm_term values for up to 30 minutes. Unknown values, full landing URLs and form content are not included. Essential only or Global Privacy Control clears and suppresses this snapshot.
Retired first-party visitor counter: the former counter that hashed IP and browser data is retired and no longer records visits. Historical records remain stored. Current optional analytics use consent-gated Google Analytics as described above; Essential only or Global Privacy Control prevents that tracking.
Standard server logs from our host (Hostinger): request URLs, timestamps, IP address, user agent. Retained for hosting and security purposes.
Google AdSense (publisher ca-pub-8427756296560869), where enabled, may set advertising cookies after you consent. See Google's ads policy.

4. Product content and local processing

BeginRooms keeps a local browser copy for responsive editing and recovery. When you are signed in, saved room and board data is also sent over HTTPS to the BeginThings service for account access and cross-device sync. This content is account-protected but is not end-to-end encrypted; do not store secrets that require client-only encryption.
Free tools (PDF utilities, image converters, calculators, etc.) run entirely in your browser. Files you process never leave your device.
FollowUp Desk stores lead records, settings and edited templates in the browser profile where you open the downloaded file. Those records and any CSV or JSON backups are plaintext, not encrypted. They are not sent to BeginThings. Choosing “Open WhatsApp” creates a normal WhatsApp link containing the phone number and message you reviewed, which WhatsApp then handles under its own terms.
FormulaMapper downloads and new trial starts are paused while the account-linked build is in release verification. When released, working state remains on your computer while trial, device and paid-entitlement checks exchange only the minimum account, machine and entitlement identifiers needed with the BeginThings licensing service over HTTPS.

BeginNotes — free early-access notes

This subsection describes BeginNotes at /workspace/beginnotes/. Its storage choices are separate from the other products described above.

Guest notes: note content and selected images are stored only in this browser’s IndexedDB, not on our server. Local guest storage is not end-to-end encryption or a backup service. Clearing site data, removing the browser profile or losing the device may remove this copy. Export important notes before doing so.
Account sign-in: BeginNotes uses the existing BeginThings email magic-link authentication and account session. Creating an account through this flow also creates the existing account and trial records. BeginNotes early access remains free independently of any BeginRooms trial or paid plan; it does not require a paid subscription.
Account storage: signed-in notes and selected image attachments are sent over HTTPS to our existing hosting. They are stored in private per-user files outside the public web root, encrypted at rest using AES-GCM, with the encryption key outside the public web root. This is server-side encryption, not end-to-end encryption; the service can decrypt content to provide account access.
Browser memory and failed saves: signed-in cloud note content is held in browser memory without a persistent cloud-content browser cache. If a cloud save fails, the draft remains in memory while the page is open. Export it before closing or reloading to avoid losing unsaved changes. Account storage is not a promise of universal offline availability.
Limited attachments and storage: users may select up to two JPEG or PNG images per note, each at most 1 MiB after capture compression and at most 4 megapixels. The account limit is 200 notes and 20 MiB of encoded storage, including note and image data. Encoding may use more space than the original image files.
Content use: BeginNotes note content, including titles, text and image attachments, is not used for advertising or analytics. The public site’s consent-controlled measurement and hosting/security logs remain as described elsewhere in this policy. BeginNotes early access does not perform AI processing, OCR or microphone recording.
Device information: account device records show a browser/device label and its last successful contact with the service. This is not continuous location tracking, a live presence indicator or confirmation that all notes have reached every device.
Export and deletion: use the app’s text or JSON exports to keep a copy, and calendar-file export for dated items. Export formats differ; preserve original image files separately if an export does not include them. You can delete notes in the app. Guest deletion affects this browser; account deletion must be successfully saved to the service. Downloaded exports and original files are separate copies that you control. For account or data-deletion requests, email sourav@beginthings.com. Account content is kept until you delete it or request deletion, subject to applicable backup and security-retention windows; this does not promise immediate removal of separately retained backups.
Automation credentials: Optional capture credentials permit adding notes only, expire after 90 days and can be revoked in Settings. We retain hashed credential references, rule settings and bounded event receipts for duplicate protection (seven days). Connected workflows send only what their configured rules select. Any integration provider also processes the content under its own terms. Browser-extension pending captures and installable-app share drafts stay in that browser until sent or removed. A web app cannot read other apps’ phone notifications without a separately authorized native integration.
No automatic external-app access: BeginNotes receives only what you type, paste, import or select. Sign-in does not grant access to Apple Notes, Google Keep, WhatsApp, personal feeds, saved collections, your photo library or calendar. Imports are copies; calendar export does not create a live connection or automatically update another app. Deleting a BeginNotes copy does not delete its source.

Explore BeginNotes and its early-access limits.

5. How we use information

To operate and improve beginthings.com and the products listed on it.
To send emails you have requested, including newsletter updates and order confirmations.
To respond to messages you send to sourav@beginthings.com.
To analyze aggregate traffic patterns via Google Analytics.
To understand which consented campaign led to a checkout and, where the separately enabled order-attribution feature is active, attach that limited snapshot to the matching first-party order record. Campaign values never decide the product, price, payment status or fulfilment.
To show advertising where AdSense is enabled and you have consented.
To fulfill purchases and provide customer support.
To deliver Cat 5 services you have specifically engaged us for.

6. Third-party services we use

Google Analytics 4 for traffic analytics. Google Privacy Policy.
Google Identity Services for optional sign-in on Cat 2 products. Only basic profile scopes are requested.
Google AdSense for display advertising on selected pages.
Hostinger for web hosting.
Razorpay for secure payment processing on paid products (UPI, cards, netbanking, wallets).
Our own contact backend (api/contact.php, hosted on beginthings.com) handles the contact and audit-request forms. There is no third-party form processor: submissions are stored on our own server and emailed to us. Does not place cookies on you.
Cloudflare, cdnjs, Google Fonts, Bootstrap CDN for public asset delivery. May receive your IP as part of normal HTTP requests.

7. Cookies

We use essential browser storage (theme preference, consent choice, checkout security and short-lived order-recovery state), and—only after you choose “Accept analytics”—Google Analytics, advertising measurement storage and a 30-minute current-tab campaign snapshot. After an order is created, a separate first-party measurement request may attach that snapshot to the matching order record; it is not sent to Razorpay and is not automatically uploaded to an advertising platform. Full breakdown is on the Cookie Policy page.

Google AdSense & Advertising Cookies

We use Google AdSense (publisher ca-pub-8427756296560869) to serve display advertisements on selected pages across beginthings.com. In compliance with Google Publisher Policies:

Third-party vendors, including Google, use cookies to serve ads based on a user's prior visits to beginthings.com or other websites across the Internet.
Google's use of advertising cookies (such as the DoubleClick DART cookie and related identifiers) enables it and its partners to serve ads to users based on their visits to our site and/or other sites on the Internet.
Users may opt out of personalized advertising by visiting Google Ads Settings.
Alternatively, you can opt out of a third-party vendor's use of cookies for personalized advertising by visiting aboutads.info choices or the European Interactive Digital Advertising Alliance (EDAA).

8. Your rights

If you are in the EU, EEA, UK, India, California, or other regions with data-protection laws, you have the right to:

Access the personal data we hold about you.
Correct inaccurate data.
Request deletion of your data.
Object to or restrict certain processing.
Withdraw consent for analytics or advertising at any time.
Lodge a complaint with your local data-protection authority.

To exercise any of these rights email sourav@beginthings.com. We respond within 30 days.

India residents (DPDPA, 2023)

You additionally have the right to nominate another person to exercise rights on your behalf, grievance redressal within 30 days, and consent withdrawal at any time without affecting prior processing. Send DPDPA requests to sourav@beginthings.com with the subject line "DPDPA request".

California residents (CCPA / CPRA)

You have the right to know, delete, correct, limit use of, and opt out of any "sale" or "sharing" of your personal information for cross-context behavioral advertising. We do not sell personal information. When you accept analytics and we run paid campaigns, configured advertising-measurement cookies such as Google Ads cookies may qualify as "sharing" under CPRA. Opt out by choosing Essential only, enabling Global Privacy Control (we honor it), or emailing sourav@beginthings.com with subject "CCPA opt-out". See the Cookie Policy.

9. Data retention

Newsletter emails: until you unsubscribe or request deletion.
Google Analytics data: per Google defaults (currently 14 months for user-level data).
Consented browser campaign snapshot: up to 30 minutes in the current tab. If the optional server order-attribution feature is enabled, the allowlisted snapshot is retained with the order for up to 90 days and then cleared without deleting the order.
Server logs: 30 days, then aggregated or deleted.
Account profile, trial and subscription records: kept while the account or a legal/operational record remains active; you may request account deletion, subject to records we must retain.
Cat 3/4/5 order records: retained per Indian accounting law (7 financial years) for tax and audit purposes.
BeginRooms content: kept in the local browser copy and, when sync is enabled for the signed-in account, in the account service until you delete it or request account deletion, subject to backup and security-retention windows.

10. Children

BeginThings is not directed at children under 13. We do not knowingly collect personal information from children under 13. If we learn we have, we will delete it promptly.

11. International transfers

Our analytics provider (Google) processes data in the United States. Razorpay, our payment processor, processes payments in India and internationally where enabled. By using the site you consent to these transfers. Standard Contractual Clauses apply where required.

12. Changes to this policy

We may update this policy. The "Last updated" date at the top reflects the latest revision. Material changes will be highlighted on the homepage.

13. Contact

Questions? Email sourav@beginthings.com. Operator: Sourav Mahapatra, India.