Privacy

Last updated: 28 September 2026

This policy explains how we handle personal data when you visit the X to Drupal website at x-to-drupal.qed42.com. The short version: measurement that sets no cookies is always on, cookie-based analytics stays off unless you accept it, and the only personal data we ever hold is what you deliberately type into one of the work email forms described below.

Who we are

QED42 Engineering Pvt. Ltd. ("QED42", "we", "us", "our") operates this website and is the data controller for the limited data described here. If you have a question about this policy, email us at business@qed42.com.

What data flows when you visit

Browsing the site requires nothing from you. There is no account system and no comments. These kinds of data flow while you read:

• Cookieless analytics, always on. We use Vercel Analytics and Vercel Speed Insights to measure visits, page performance, and Core Web Vitals. These send first-party beacons proxied through our own domain, store no cookies or persistent identifiers on your device, and do not track you across sites.
• Interaction events, always on and cookieless. Through the same Vercel measurement we record which parts of the page you used: how far down a page you scrolled, which sections came into view, which buttons and links you pressed, which example site shape you looked at, and which questions you opened. These describe actions on a page, not a person, and they carry no identifier for you.
• Cookie-based analytics, only if you accept. If you accept in the cookie banner, we additionally load Google Analytics 4 and Microsoft Clarity. Google Analytics reports aggregate audience and traffic data. Microsoft Clarity records how the page was used in your session, which can be replayed as a session recording and aggregated into heatmaps; it masks text you type into form fields by default, so your email address is not captured in a recording. Both set cookies and both stay entirely off until you accept, and you can withdraw acceptance at any time through "Cookie preferences" in the footer. Google LLC and Microsoft Corporation process this data on our behalf. If you reject, neither is loaded and only the cookieless measurement above runs.
• Server logs. Vercel Inc., which hosts the site, processes standard request data such as your IP address, browser type, and the pages you request in order to serve the site and keep it secure.

If you give us your email address

Two forms on the site ask for a work email, both on the home page: one near the top and one at the foot. Both are optional. You can read every page without giving us an address.

Whichever form you use, the same thing happens. We record the address as a contact in HubSpot, our customer relationship platform, and use it to send you occasional updates about X to Drupal and to reply to you. We submit it from our own server, so your browser never talks to HubSpot directly. Along with the address we pass your IP address, the web address of the page you submitted from, the page that linked you to this site if your browser reports it, and any campaign parameters in the link you arrived through, so we can tell which channel a signup came from. HubSpot Inc. processes all of this on our behalf. Every message we send carries an unsubscribe link, and unsubscribing ends it.

We ask for a work address and reject mainstream consumer and throwaway providers. Every one of these forms is rate limited by IP address and carries a hidden field that only automated submissions fill in; we keep those counters in memory for a few minutes to block abuse, and they identify no one.

If you would rather not use a form, write to the address under "Who we are" above instead. A message you send that way is ordinary business correspondence and goes nowhere near the contact list.

International transfers and retention

Where you accept analytics cookies, Google LLC and Microsoft Corporation process that data on our instructions, which involves transfer to the United States. Those transfers rely on the providers' standard contractual clauses and their participation in the EU-US Data Privacy Framework. HubSpot Inc. processes contact details you submit, on the same basis.

How long each holds it: Google Analytics event data is retained for 14 months and then deleted. Microsoft Clarity keeps recordings and heatmap data for up to 30 days. Contact details stay in HubSpot until you unsubscribe or ask us to erase them. We sell nothing, run no advertising or remarketing, and never request advertising cookies even from a visitor who accepts everything.

Cookies

Every cookie this site can set is listed individually, with its purpose and duration, on the cookie policy page. The essentials follow.

This site sets no cookies of its own, and none at all until you choose to accept. The banner you see on your first visit governs one thing: whether Google Analytics 4 and Microsoft Clarity may load and set their cookies. Until you accept, they are not loaded, so no analytics or marketing cookie is written. Reject and nothing changes about what you can read or do here.

Your choice is remembered in your browser's local storage under the key "xtd-consent", with the date you gave it and the version of the cookie policy it applied to. That value stays on your device and is never sent to us. It lapses after twelve months, and changing the cookie policy re-asks you, because consent to one set of cookies is not consent to a larger one. You can change it at any time through "Cookie preferences" in the footer; choosing "Reject" after having accepted stops any further collection by those two tools. If your browser sends a Global Privacy Control or Do Not Track signal we treat that as a refusal and do not ask at all.

Measurement that needs no cookies runs either way, as described above. If you already carry a HubSpot cookie from another QED42 site, submitting any of the email forms passes it on so HubSpot can join the signup to that existing session; we do not create one.

Legal basis

Cookieless analytics, interaction events and server logs are processed under our legitimate interest in operating a fast, stable, secure website and understanding, in aggregate, how it is used. Google Analytics 4 and Microsoft Clarity are processed on the basis of your consent, given in the cookie banner and withdrawable at any time through "Cookie preferences" in the footer. Where you submit an email address, we process it on the basis of your consent, given by submitting the form, and you can withdraw it at any time by unsubscribing or writing to us. We keep news contacts until you unsubscribe, and enquiry correspondence for as long as the business relationship needs it.

Your rights

Depending on where you live, you may have rights over your personal data. You can:

• Access: ask for a copy of any personal data we hold about you.
• Rectification: ask us to correct data that is wrong or incomplete.
• Erasure: ask us to delete your data in certain circumstances.
• Restriction: ask us to limit how we use your data in certain circumstances.
• Objection: object to processing we base on legitimate interest.
• Complain: lodge a complaint with the data protection supervisory authority where you live or work.

In practice, unless you have given us your email address, we hold nothing that can be linked to you: no cookies, and no identifiers beyond transient hosting logs. To exercise any of these rights, email us at business@qed42.com.

Changes to this policy

If we add anything to the site that changes how data is handled, such as a form or a new analytics tool, we will update this policy and the "Last updated" date at the top of this page first.