Privacy Policy

For the purposes of the EU General Data Protection Regulation (GDPR), the UK GDPR, the California Consumer Privacy Act (CCPA/CPRA) and India's Digital Personal Data Protection Act, 2023 (DPDP Act), the data controller responsible for this website and the personal data you provide through it is:

Sufyaan Studio
Operating as a sole proprietorship registered in India
Remote-First / Global
Mumbai, MH 400001
IN
Email: dev.sufyaan@gmail.com
Phone: +91 9318441197

If we act as a processor on behalf of a client (e.g. hosting, development, or analytics work performed under a written engagement), our respective roles are governed by the executed Data Processing Addendum (DPA) and the underlying services agreement. The DPA is available at /dpa.

This Privacy Policy applies to personal data collected through:

• This website (https://sufyaanstudio.vercel.app) and all of its sub-pages.
• Direct communications with Sufyaan Studio (email, WhatsApp, phone, video calls).
• Forms, calendars and scheduling tools (Cal.com) used to request a proposal, book a consultation, or request a free audit.
• Project-engagement communications with active and past clients.

It does not apply to third-party sites we link to, including but not limited to GitHub, LinkedIn, WhatsApp, Cal.com, Stripe, Shopify, Vercel, and any other platform we integrate with. We encourage you to read the privacy notices of those services.

We collect the minimum personal data needed to respond to your inquiry or deliver the services you have engaged us for. The categories are:

• Identity & contact data: name, email, phone number, company name, role/title, country, city.
• Project data: project briefs, current website URL(s), competitor URLs, project type, budget range, timeline, goals, and the free-form description you provide in forms.
• Communications data: emails, call notes, recorded calls (only with your explicit consent), WhatsApp messages, and form submissions.
• Engagement data: proposals, signed agreements, invoices, payment confirmations, project deliverables and source code repositories shared with you.
• Technical & usage data: IP address, device type, browser, pages viewed, referrer, time on page, scroll depth, and Core Web Vitals, collected via Google Analytics 4 and Vercel Web Analytics. We do not use advertising cookies.

• Directly from you: when you fill out a contact, project-intake or free-audit form, book a call, send an email, or message us on WhatsApp.
• Automatically: via cookies, server logs, and analytics when you browse this website. See Section 9 (Cookies) for detail.
• From public sources: LinkedIn, GitHub, Crunchbase, your company website, and similar sources, where strictly necessary to qualify a lead or verify information you have provided.

We process your personal data only for specified, explicit and legitimate purposes, and only on the legal bases permitted under GDPR Art. 6 and equivalent law:

• Responding to inquiries and delivering proposals (legal basis: pre-contractual / contract performance).
• Performing the services you have engaged us for (legal basis: contract performance).
• Invoicing, tax and accounting (legal basis: legal obligation).
• Maintaining a record of project deliverables and warranties (legal basis: legitimate interest; warranty periods of up to 90 days post-launch).
• Operating, securing, and improving this website (legal basis: legitimate interest; aggregated analytics only).
• Sending operational communications such as project updates, invoices, and follow-up (legal basis: contract performance or legitimate interest).
• Sending marketing communications such as a monthly newsletter or product updates (legal basis: consent, which you can withdraw at any time using the unsubscribe link in any email or by emailing us).

We do not sell, rent, or trade your personal data. We do not engage in automated decision-making or profiling that produces legal or similarly significant effects on you.

We share personal data only with vetted sub-processors who process it on our documented instructions and under written data-processing agreements. Current sub-processors:

• Vercel Inc. — website hosting, edge functions, analytics (Ireland + US regions).
• FormSubmit Co. — serverless email delivery for form submissions.
• Cal.com Inc. — scheduling and calendar bookings.
• Google LLC — Google Analytics 4 and Google Search Console. Analytics IP anonymisation is enabled.
• Cloudflare, Inc. — DNS, CDN, and DDoS protection.
• WhatsApp (Meta Platforms, Inc.) — for messages you initiate.
• Stripe, Inc. and / or Wise — for payment processing. We never store full payment card details.
• GitHub, Inc. — for source-code collaboration.

Where sub-processors are located outside the EEA, UK, or India, we rely on the European Commission's Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum, or other approved safeguards for international transfers.

We may also disclose personal data where required by law, valid subpoena, or to protect our legal rights, your vital interests, or the safety of others.

Some of our sub-processors are located in the United States and other jurisdictions outside the EEA, UK, and India. Where personal data is transferred internationally, we rely on the EU Commission's Standard Contractual Clauses (Decision 2021/914), the UK Addendum to the SCCs, or other lawful safeguards, and conduct transfer impact assessments where required. By engaging with us, you acknowledge that your data may be transferred to and processed in the countries where our sub-processors operate.

We retain personal data only for as long as necessary for the purposes set out in this policy, after which it is securely deleted or anonymised. Indicative retention periods:

• Unsuccessful inquiries: 24 months from the last contact, for re-engagement and audit.
• Client engagement records: 7 years from project completion, in line with tax, accounting, and warranty obligations (extended to 10 years for EEA clients where local law requires).
• Source code, design files, and project deliverables: retained for the warranty period (30–90 days) plus a 12-month handover window, after which repositories are archived and access credentials rotated.
• Analytics data: GA4 retains user-level data for 14 months by default; we have configured the shortest available retention.

This website uses a small number of first-party cookies and similar local-storage technologies. We categorise them as:

• Strictly necessary: session and security cookies required for the site to function. These cannot be disabled.
• Functional: preference cookies (e.g. theme, language) that remember your choices.
• Analytics: Google Analytics 4 and Vercel Web Analytics cookies, used to measure aggregated site performance and usage. GA4 is loaded only after the user has not opted out via their browser's Do Not Track or Global Privacy Control signals.

We do not use advertising cookies, third-party retargeting pixels, or cross-site tracking. You can clear or block cookies in your browser at any time; doing so will not prevent you from accessing the site but may degrade some functionality.

Subject to your jurisdiction, you have the right to:

• Request access to the personal data we hold about you.
• Request correction of inaccurate or incomplete data.
• Request erasure of your data ("right to be forgotten").
• Object to or restrict processing based on legitimate interest.
• Request portability of your data in a machine-readable format.
• Withdraw consent at any time, where processing is based on consent.
• Lodge a complaint with your local supervisory authority (e.g. the ICO in the UK, a CNIL in France, the DPC in Ireland, the California Attorney General, or the Data Protection Board of India).

For California residents, the CCPA/CPRA additionally grants the rights to opt out of the sale or sharing of personal information and to limit the use of sensitive personal information. We do not sell or share personal information for cross-context behavioural advertising, so these opt-outs are not required for use of this site.

To exercise any of these rights, email dev.sufyaan@gmail.com with the subject "Data request". We will respond within 30 days (15 days under the India DPDP Act). Identity verification will be required before we action any request.

We employ technical and organisational measures appropriate to the risk, including HTTPS/HSTS, strict Content Security Policy, scoped API keys, principle-of-least-privilege access, daily off-site backups, two-factor authentication on all production systems, and 30-day audit logs. No system is 100% secure; in the event of a personal-data breach we will notify affected users and the relevant supervisory authority within 72 hours where required by GDPR Art. 33.

This website and our services are not directed at children under 16 (or such higher age as your jurisdiction requires for valid consent). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please email us and we will delete it.

We may update this Privacy Policy from time to time. The "Last updated" date below reflects when changes were made. Material changes will be notified by a banner on the site or, where required, by email. Continued use of the site after a change constitutes acceptance of the updated policy.

For any privacy-related question, request, or complaint, contact:

Sufyaan Studio — Privacy
Email: dev.sufyaan@gmail.com
Subject line: "Privacy request"

If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority. We will cooperate fully with any such proceeding.