Privacy Policy

This Privacy Policy explains how Huzaifa Web Studio (“we”, “us”, “our”) collects, uses, and protects your personal information when you visit our website or engage our services.

1. Information We Collect

1.1 Information You Provide

We collect information you voluntarily provide when you:

• Contact us via our form or email: name, email, phone, project details, and anything else you include.
• Engage our services: billing info, business details, project requirements, and communication records.
• Subscribe to communications: email address and preferences.

1.2 Information Collected Automatically

When you visit our website, we automatically collect:

• Usage data: pages visited, time spent, referring URLs, browser type, device type, OS.
• Analytics data: page views, interaction patterns, and aggregated usage metrics via Google Analytics (anonymized where possible).
• Cookies: session, analytics, and functional cookies (see Section 5 for details).

1.3 Information from Third Parties

We may receive information from platforms you use to interact with us, such as LinkedIn, GitHub, or X.

1.4 Data Sent to AI Providers

When we deliver AI-related services (AI Integration, AI Workflows & Automation, or AI features within other engagements), your project data, prompts, and business content may be transmitted to third-party AI providers as part of normal service delivery. This includes:

• Prompt content: Text, code, or data included in API calls to language models.
• Retrieval data: Documents or database content fed into retrieval pipelines (RAG).
• Generated output: Responses produced by AI models that may contain your business information.

We select providers that do not use API data for model training. Details are in Section 3.

2. How We Use Your Information

We use your information for:

We do not sell your personal information.

3. Data Sharing and Disclosure

We may share your information with:

3.1 Infrastructure and Operations

• Hosting and deployment: Cloudflare, Vercel
• Payment processing: Stripe, PayPal
• Email services: Brevo (transactional email)
• Code hosting: GitHub
• Design tools: Figma (UI/UX design deliverables)

3.2 AI Service Providers

When delivering AI-related services, data is transmitted to the following providers as required by the engagement:

• Large language model APIs: OpenAI, Anthropic, Google AI (Gemini), Azure OpenAI
• AI automation platforms: LangChain, custom agent infrastructure
• Vector databases: Pinecone, Weaviate, or similar (for RAG pipelines)

These providers process data under their respective data processing agreements. We use API tiers that exclude your data from model training. You remain responsible for any data you choose to include in prompts that we do not specifically request.

3.3 Analytics and Monitoring

• Website analytics: Google Analytics (for our own site)
• Client analytics implementation: GA4, server-side tracking pipelines (data routes through client infrastructure or our temporary staging environments during setup)
• Monitoring tools: Sentry, Datadog, or similar (for maintenance and DevOps services)
• Reporting: Looker Studio dashboards configured for clients

3.4 App Store Platforms

For mobile app development services:

• Apple App Store: App submissions, metadata, and binary uploads
• Google Play Store: App submissions, metadata, and binary uploads

You own the developer accounts. We submit on your behalf with your credentials.

3.5 Other Disclosures

• Professional networks: if you connect via social platforms, they may receive interaction data per their own privacy policies.
• Legal authorities: if required by law or government request.
• Business transfers: in the event of a merger, acquisition, or sale of assets, your data may be transferred to the acquiring entity.

4. Data Retention

We retain your personal information as long as necessary to:

• Fulfill the purposes described in this policy;
• Comply with legal, accounting, and reporting obligations (typically 3-7 years for financial records);
• Resolve disputes and enforce agreements.

When no longer needed, we securely delete or anonymize it.

5. Data Processing Roles

Depending on the context, Huzaifa Web Studio acts as either a data controller or a data processor:

5.1 As Data Controller

We are the controller for:

• Information you provide through our website contact form
• Analytics data collected on huzaifaweb.com
• Waitlist signup data
• Our own marketing communications

5.2 As Data Processor

We act as a processor when handling data on behalf of clients during service delivery:

• AI services: Prompts and data sent to AI providers during development and testing
• Analytics implementation: Setting up tracking on your systems; data belongs to you
• Security audits: Accessing your systems to identify vulnerabilities
• Maintenance: Monitoring and accessing your production systems under retainer
• DevOps: Infrastructure access for deployment and configuration

In these cases, you (the client) remain the data controller. We process data only as instructed through the statement of work and applicable agreements. We will notify you promptly if we receive a legal request for your data.

5.3 Sub-Processor Notification

We maintain a list of sub-processors (Section 3). Material changes to sub-processors are communicated via email to active clients at least 14 days before new processors are engaged, except in cases of emergency security patches.

6. Cookies and Tracking

6.1 Our Website

Our website uses these types of cookies:

Your cookie choices:

• You can disable cookies through your browser settings.
• You can opt out of Google Analytics using the Google Analytics Opt-Out Browser Add-on.
• Disabling certain cookies may affect website functionality.

6.2 Client Analytics Implementation

When we implement analytics for your product or website, we may set up server-side tracking that routes events through your own infrastructure or temporary staging environments during configuration. This data belongs to you and is subject to your own privacy policy and consent mechanisms. We do not retain client analytics data beyond the engagement period unless required for support under a maintenance retainer.

7. Data Security

We use industry-standard security measures to protect your data:

• SSL/TLS encryption for all data in transit;
• Encrypted storage for sensitive data at rest;
• Access controls limiting data access to authorized personnel only;
• Regular security assessments and updates.

No method of transmission or storage is 100% secure. We cannot guarantee absolute security but will notify you of any data breach affecting your information as required by law.

8. Your Rights

Depending on your jurisdiction, you may have these rights regarding your personal data:

8.1 GDPR Rights (European Residents)

• Right to access: request a copy of your data.
• Right to rectification: correct inaccurate data.
• Right to erasure (“Right to be Forgotten”): request deletion.
• Right to restrict processing: limit how we use your data.
• Right to data portability: receive your data in a structured format.
• Right to object: object to processing based on legitimate interests.

8.2 CCPA Rights (California Residents)

• Right to know: what personal information we collect, use, and share.
• Right to delete: request deletion of your personal information.
• Right to opt out: of the sale of personal information (we do not sell data).
• Right to non-discrimination: no retaliation for exercising your rights.

8.3 Exercising Your Rights

To exercise any of these rights, contact us at hi@huzaifaweb.com. We will respond within 30 days. We may need to verify your identity first.

9. International Data Transfers

Our website is hosted globally via Cloudflare’s edge network. If you are outside Pakistan, your data may be transferred to and processed in Pakistan or other countries where our service providers operate. We ensure appropriate safeguards for international transfers.

10. Third-Party Links

Our website may contain links to external sites (GitHub, LinkedIn, project URLs, etc.). We are not responsible for the privacy practices of those sites.

11. Children’s Privacy

Our services are not directed at individuals under 16. We do not knowingly collect personal information from children. If we become aware that a child has provided us with personal data, we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified via our website or email (if we have your address). The “Last updated” date at the top reflects the most recent revision.

13. Contact

For questions, concerns, or data requests:

• Email: hi@huzaifaweb.com
• Address: Shahdara, Lahore, Pakistan

Last updated: September 2, 2026