Privacy Policy.

This Privacy Policy explains how Huzaifa Web Studio (“we”, “us”, “our”) collects, uses, and protects your personal information when you visit our website or engage our services.

1. Information We Collect

1.1 Information You Provide

We collect information you voluntarily provide when you:

• Contact us via our form: name, email address, the services you are interested in, and any project details you choose to include. Submissions are stored in a database (see Section 1.2) as well as emailed, so they remain available even if an email delivery fails.
• Request a free website review during launch week: name, business email address, the website address you want reviewed, the challenge you select (if any), any additional details you choose to include, and your consent to be contacted about the review (see Section 1.2).
• Engage our services: billing info, business details, project requirements, and communication records.
• Subscribe to communications: email address and preferences.

1.2 Form Submission Storage

Contact form submissions are written to a database operated by Cloudflare (D1), our infrastructure provider. Each record contains:

We do not store your IP address or browser user agent string with your submission.

This record is the copy we rely on. Email is a notification channel layered on top of it: if an email fails to send, your submission is still recorded and we can still act on it.

Free website review requests are stored in a separate table in the same database. Each record contains:

We use the normalized email address and website address only to stop the same person submitting the same website twice. Free review requests are not added to any mailing list.

1.3 Information Collected Automatically

When you visit our website, we automatically collect:

• Usage data: pages visited, time spent, referring URLs, browser type, device type, OS.
• Analytics data: page views, interaction patterns, and aggregated usage metrics via Google Analytics (anonymized where possible).
• Cookies: session, analytics, and functional cookies (see Section 6 for details).

1.4 Information from Third Parties

We may receive information from platforms you use to interact with us, such as LinkedIn, GitHub, or X.

1.5 Bot Protection

Our contact form and our free website review form are protected by Cloudflare Turnstile. Turnstile assesses whether a submission is likely automated. It runs before your submission is stored and does not use tracking cookies, fingerprinting, or invasive CAPTCHAs. The verification result (action and hostname) is recorded with your submission as described in Section 1.2.

1.6 Data Sent to AI Providers

When we deliver AI-related services (AI Integration, AI Workflows & Automation, or AI features within other engagements), your project data, prompts, and business content may be transmitted to third-party AI providers as part of normal service delivery. This includes:

• Prompt content: Text, code, or data included in API calls to language models.
• Retrieval data: Documents or database content fed into retrieval pipelines (RAG).
• Generated output: Responses produced by AI models that may contain your business information.

We select providers that do not use API data for model training. Details are in Section 3.

2. How We Use Your Information

We use your information for:

We do not sell your personal information.

3. Data Sharing and Disclosure

We may share your information with:

3.1 Infrastructure and Operations

• Hosting and deployment: Cloudflare, Vercel
• Hosting and database storage: Cloudflare D1, which stores contact form submissions and free website review requests (Section 1.2)
• Bot protection: Cloudflare Turnstile, which assesses form submissions before they are stored (Section 1.5)
• Payment processing: Stripe, PayPal
• Email services: Brevo (transactional email)
• Code hosting: GitHub
• Design tools: Figma (UI/UX design deliverables)

3.2 AI Service Providers

When delivering AI-related services, data is transmitted to the following providers as required by the engagement:

• Large language model APIs: OpenAI, Anthropic, Google AI (Gemini), Azure OpenAI
• AI automation platforms: LangChain, custom agent infrastructure
• Vector databases: Pinecone, Weaviate, or similar (for RAG pipelines)

These providers process data under their respective data processing agreements. We use API tiers that exclude your data from model training. You remain responsible for any data you choose to include in prompts that we do not specifically request.

3.3 Analytics and Monitoring

• Website analytics: Google Analytics (for our own site)
• Session analytics: Microsoft Clarity (for our own site), used for session replay, heatmaps, and interaction analysis. Form field content is masked in recordings by default.
• Client analytics implementation: GA4, server-side tracking pipelines (data routes through client infrastructure or our temporary staging environments during setup)
• Monitoring tools: Sentry, Datadog, or similar (for maintenance and DevOps services)
• Reporting: Looker Studio dashboards configured for clients

3.4 App Store Platforms

For mobile app development services:

• Apple App Store: App submissions, metadata, and binary uploads
• Google Play Store: App submissions, metadata, and binary uploads

You own the developer accounts. We submit on your behalf with your credentials.

3.5 Other Disclosures

• Professional networks: if you connect via social platforms, they may receive interaction data per their own privacy policies.
• Legal authorities: if required by law or government request.
• Business transfers: in the event of a merger, acquisition, or sale of assets, your data may be transferred to the acquiring entity.

4. Data Retention

We retain your personal information as long as necessary to:

• Fulfill the purposes described in this policy;
• Comply with legal, accounting, and reporting obligations (typically 3-7 years for financial records);
• Resolve disputes and enforce agreements.

Contact form submissions and free website review requests are retained for 24 months from the date of submission. This period covers the time in which we contact you about your enquiry or review, and enough runway after an engagement begins to answer any question about the original request. After 24 months we delete the record.

When no longer needed, we securely delete or anonymize it. Deleting a submission record is permanent: we do not keep a shadow copy in an email inbox beyond your own correspondence.

To have a submission deleted before then, email hi@huzaifaweb.com with the address you used. We action erasure requests within 30 days, as described in Section 8.3.

5. Data Processing Roles

Depending on the context, Huzaifa Web Studio acts as either a data controller or a data processor:

5.1 As Data Controller

We are the controller for:

• Information you provide through our website contact form, including the database record described in Section 1.2
• Analytics data collected on huzaifaweb.com
• Our own marketing communications

5.2 As Data Processor

We act as a processor when handling data on behalf of clients during service delivery:

• AI services: Prompts and data sent to AI providers during development and testing
• Analytics implementation: Setting up tracking on your systems; data belongs to you
• Security audits: Accessing your systems to identify vulnerabilities
• Maintenance: Monitoring and accessing your production systems under retainer
• DevOps: Infrastructure access for deployment and configuration

In these cases, you (the client) remain the data controller. We process data only as instructed through the statement of work and applicable agreements. We will notify you promptly if we receive a legal request for your data.

5.3 Sub-Processor Notification

We maintain a list of sub-processors (Section 3). Material changes to sub-processors are communicated via email to active clients at least 14 days before new processors are engaged, except in cases of emergency security patches.

6. Cookies and Tracking

6.1 Our Website

Until you make a consent choice, no analytics or advertising cookies are set. Once you choose, our website uses these types of cookies:

IP addresses are anonymized by Google Analytics as a platform default. Microsoft Clarity masks form field content in session recordings by default, so typed text is not captured.

6.2 How We Ask for Consent

We do not set any analytics or advertising cookie until you make a choice. On your first visit, a small panel asks you to choose, and nothing is stored while you decide.

The panel offers three actions:

You can also set each category individually using the Analytics and Marketing switches before you confirm. Marketing is off by default even when you accept analytics, and it is only enabled if you turn it on yourself or choose Accept All.

Declining changes nothing about the website. Every page, service, and form works exactly the same. The only effect is that we receive less information about how the site is used.

6.3 Changing Your Choice

Your choice is stored in your browser for one year, so you are not asked again on every visit. To change it at any time, select Cookie Settings in the site footer. The panel reopens with your current selection and saving replaces your previous choice. You do not need to clear your cookies first.

6.4 Your cookie choices

• You can disable cookies through your browser settings.
• You can opt out of Google Analytics using the Google Analytics Opt-Out Browser Add-on.
• Disabling certain cookies may affect website functionality.

6.5 Client Analytics Implementation

When we implement analytics for your product or website, we may set up server-side tracking that routes events through your own infrastructure or temporary staging environments during configuration. This data belongs to you and is subject to your own privacy policy and consent mechanisms. We do not retain client analytics data beyond the engagement period unless required for support under a maintenance retainer.

7. Data Security

We use industry-standard security measures to protect your data:

• SSL/TLS encryption for all data in transit;
• Encrypted storage for sensitive data at rest;
• Access controls limiting data access to authorized personnel only;
• Regular security assessments and updates.

No method of transmission or storage is 100% secure. We cannot guarantee absolute security but will notify you of any data breach affecting your information as required by law.

8. Your Rights

Depending on your jurisdiction, you may have these rights regarding your personal data:

8.1 GDPR Rights (European Residents)

• Right to access: request a copy of your data.
• Right to rectification: correct inaccurate data.
• Right to erasure (“Right to be Forgotten”): request deletion.
• Right to restrict processing: limit how we use your data.
• Right to data portability: receive your data in a structured format.
• Right to object: object to processing based on legitimate interests.

8.2 CCPA Rights (California Residents)

• Right to know: what personal information we collect, use, and share.
• Right to delete: request deletion of your personal information.
• Right to opt out: of the sale of personal information (we do not sell data).
• Right to non-discrimination: no retaliation for exercising your rights.

8.3 Exercising Your Rights

To exercise any of these rights, contact us at hi@huzaifaweb.com. We will respond within 30 days. We may need to verify your identity first.

9. International Data Transfers

Our website is hosted globally via Cloudflare’s edge network, and form submissions are stored in Cloudflare D1, which replicates across multiple regions. If you are outside Pakistan, your data may be transferred to and processed in Pakistan or other countries where our service providers operate. We ensure appropriate safeguards for international transfers.

10. Third-Party Links

Our website may contain links to external sites (GitHub, LinkedIn, project URLs, etc.). We are not responsible for the privacy practices of those sites.

11. Children’s Privacy

Our services are not directed at individuals under 16. We do not knowingly collect personal information from children. If we become aware that a child has provided us with personal data, we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified via our website or email (if we have your address). The “Last updated” date at the top reflects the most recent revision.

13. Contact

For questions, concerns, or data requests:

• Email: hi@huzaifaweb.com
• Address: Shahdara, Lahore, Pakistan

Last updated: October 30, 2026