Privacy Policy

• I only collect what you type into the contact form, plus the technical data every website receives.
• No analytics, no advertising trackers, no tracking pixels, no data sold or shared for marketing.
• Your inquiry is kept for 24 months, then deleted.
• You can ask me to see, correct or delete your data at any time: info@amrstudio.dev.

Information you give me through the contact form:

• your name and email address;
• the service you're asking about, your budget bracket, and your message;
• the language the Site was shown in, and the date and time you ticked the consent box.

Information you give me if you contact me directly by email or WhatsApp: whatever you choose to send, together with your email address or phone number.

Information collected automatically:

• Country (approximate location) derived from your IP address by my hosting provider. It is used once, on each request, to choose the Site's language and currency, and is not stored by me.
• Standard server logs kept by my hosting provider (IP address, browser type, pages requested, time), used to deliver the Site and keep it secure.

I do not collect payment details, government IDs, or any special category data through the Site. Please don't include sensitive information in your message.

• To reply to your inquiry and discuss a possible project. Basis: your consent (the box you tick on the form) and steps taken at your request before entering into a contract.
• To send you one automatic email confirming your inquiry arrived. Basis: the same.
• To show the Site in your language and currency. Basis: legitimate interest in presenting the Site usefully; no profile is built and nothing is stored beyond your preference cookie.
• To keep the Site and its admin area secure (e.g. limiting repeated failed logins). Basis: legitimate interest in security.
• To meet legal, tax and accounting duties if you become a client. Basis: legal obligation.

You can withdraw consent at any time by emailing me. This doesn't affect anything done before you withdrew it.

I don't sell or rent personal data. I share it only with the service providers that run the Site, each acting on my instructions:

• Supabase, Inc. stores contact form submissions in a database.
• Resend, Inc. delivers the confirmation email to you and the notification email to me.
• Vercel, Inc. hosts the Site and provides the country lookup and server logs described above.
• WhatsApp (Meta Platforms) handles any conversation you choose to start on WhatsApp, under its own privacy policy.

I may also disclose data if required by law, or to protect my rights in a dispute.

These providers may process data on servers outside your country, including in the United States and the European Union. Where required, transfers rely on the providers' data processing terms and the safeguards built into them (such as standard contractual clauses).

• Contact form inquiries: 24 months from submission, then deleted from the database.
• Inquiry emails in my inbox: up to 24 months, unless we start working together.
• If you become a client: proposals, contracts and invoices are kept for as long as tax and accounting law requires.
• Security logs of login attempts (admin area only): 30 days.
• Your language and currency cookies: 1 year, or until you clear them.

The Site uses only strictly necessary and preference storage. There are no analytics or advertising cookies, so no cookie banner is needed to opt out of them.

• lang (cookie, 1 year): remembers Arabic or English.
• currency (cookie, 1 year): remembers which currency to show budgets in.
• theme (local storage): remembers dark or light mode.
• amr_admin (cookie, 7 days, admin area only): keeps the site owner signed in. Visitors never receive it.

Fonts and images are served from the Site itself; your browser doesn't contact Google Fonts or other third parties to load them.

Data travels over HTTPS. The database can only be reached by the Site's server using a secret key; public access is blocked at the database level. Admin passwords are stored only as bcrypt hashes, and repeated failed logins are locked out. No system is perfectly secure, but I take reasonable steps to protect your data and will notify you and the relevant authority of a breach where the law requires it.

Depending on where you live (for example under Kuwait's Data Privacy Protection Regulation, Egypt's Personal Data Protection Law No. 151 of 2020, or the EU/UK GDPR), you may have the right to:

• access the personal data I hold about you and get a copy;
• have it corrected or completed;
• have it deleted;
• object to or restrict how it is used;
• receive it in a portable format;
• withdraw consent at any time.

To use any of these, email info@amrstudio.dev. I'll reply within 30 days and may need to confirm your identity first. You also have the right to complain to your local data protection authority.

The Site is a business service and isn't directed at anyone under 18. I don't knowingly collect data from children; if you believe a child has sent me data, contact me and I'll delete it.

If this policy changes, the new version will be posted here with a new date. Significant changes affecting data I already hold will be communicated directly where possible.

Amr Hassan, trading as Amr Studio, Salmiya, Kuwait.

Email: info@amrstudio.dev

WhatsApp: +20 150 771 0012