Privacy Policy

This Privacy Policy applies to the processing of personal data by Techtik Studios (“Data Controller”, “we”, “us”, or “our”), having its primary engineering operations in Lahore, Pakistan, and delivering custom software, applied AI, and technical advisory services to enterprise clients globally.

This policy governs data collected through our public website (https://techtikstudios.com), the “Start a Project” scoping portal, pre-engagement discovery scheduling interfaces, and correspondence originating from such channels.

Important Scope Exclusion: This policy does not apply to client production systems, source code repositories, end-user database environments, or proprietary infrastructure deployed or maintained by Techtik Studios pursuant to an executed Master Services Agreement (“MSA”) or Statement of Work (“SOW”). Such engagements are governed strictly by the dedicated Data Processing Addendum (“DPA”) and confidentiality provisions established within the commercial agreement between the parties.

We collect information under four distinct categories depending on your interaction with our digital platforms:

A. Information Voluntarily Provided via Project Scoping Inquiries

When you submit a project brief via our contact interface, we collect the enterprise data points you voluntarily elect to provide, including:

• Contact Identifiers: Full legal name, corporate work email address, and company or organizational name.
• Project Architecture Parameters: Target service line (e.g., Web & Mobile Development, AI & Workflow Automation, MVP & Fast Product Launch), maturity stage (concept, MVP, scaling, refactoring), and high-level architectural requirements.
• Commercial Boundaries: Estimated capital allocation bracket, target delivery timeline, and mutual non-disclosure preferences.
• Unstructured Project Briefs: Qualitative textual descriptions and technical requirements submitted in the project summary field.

B. Discovery Consultation & Scheduling Telemetry

When you interact with our embedded discovery booking workflow (powered by Calendly and Google Meet), we collect appointment preferences, preferred timezones, selected meeting slots, attendee email addresses, and any preliminary agenda notes provided to structure the technical consultation.

C. Automated Technical Telemetry & Edge Delivery Logs

As with standard enterprise web services delivered over global Content Delivery Networks, our edge infrastructure automatically logs certain technical parameters upon each HTTP/HTTPS request, including:

• Internet Protocol (IP) address and coarse geographic region (country and city level);
• Browser user-agent, operating system version, and client device specifications;
• Referring URLs, requested resource paths, HTTP response status codes, and latency metrics;
• Automated security signals utilized by edge firewalls for threat mitigation and DDoS detection.

D. Client-Side Theme Storage

Our website uses a single first-party cookie and local storage key designated as techtik-theme. This technical token is deployed solely when you actively select a preferred visual appearance (light or dark mode) to persist that preference across subsequent page visits for up to twelve (12) months. This token contains zero personally identifiable data and is never used for cross-site behavioral tracking, fingerprinting, or targeted advertising.

Under the European Union General Data Protection Regulation (GDPR), the UK GDPR, and equivalent international data protection frameworks, we process personal data exclusively under the following recognized legal bases:

• Performance of Pre-Contractual Measures (Art. 6(1)(b) GDPR): Processing contact details and scoping specifications is necessary to take preparatory steps at your express request prior to entering into a commercial agreement, including assessing technical feasibility, estimating sprint budgets, preparing Statements of Work, and conducting architectural consultations.
• Legitimate Interests (Art. 6(1)(f) GDPR): We process edge network logs and security telemetry pursuant to our legitimate business interest in maintaining the operational integrity, availability, and security of our web infrastructure against malicious botnets, denial-of-service attempts, unauthorized penetration testing, and form spam.
• Compliance with Legal Obligations (Art. 6(1)(c) GDPR): Where required by statutory legislation, tax reporting, regulatory inquiries, anti-fraud audits, or enforceable judicial subpoenas.
• Consent (Art. 6(1)(a) GDPR): Where you have granted explicit consent for specific follow-up communications or disclosures that fall outside the scope of pre-contractual negotiations.

We do not sell, rent, lease, trade, or commercialize your personal information, project briefs, or technical ideas under any circumstance.Techtik Studios does not participate in programmatic advertising exchanges, data brokerage networks, or third-party behavioral profiling.

Information collected through our channels is utilized exclusively for the following legitimate business purposes:

• Evaluating prospective project feasibility, engineering capacity, and technology stack suitability;
• Responding directly to inquiries submitted by your organization and coordinating discovery discussions;
• Drafting and countersigning preliminary Mutual Non-Disclosure Agreements (“MNDAs”) where requested;
• Transmitting formal architectural proposals, technical scopes, and commercial quotes;
• Administering and optimizing website reliability, server performance, and security defenses.

To maintain high-availability edge delivery, reliable inquiry routing, and seamless consultation scheduling, Techtik Studios partners with select enterprise service providers (“Subprocessors”). Each provider is contractually bound by rigorous confidentiality and data processing agreements:

We periodically review the compliance, security certifications, and privacy practices of all third-party vendors. We do not authorize any subprocessor to access, use, or retain data for their own independent advertising or commercial purposes.

We retain personal data only for as long as strictly necessary to fulfill the specific purposes articulated in this policy:

• Project Inquiries & Scoping Briefs: Retained for a maximum period of twenty-four (24) months following receipt to accommodate enterprise scoping cycles, seasonal procurement budgets, and delayed project commencements. If an inquiry does not result in an active engagement, data is permanently purged or irreversibly anonymized at the conclusion of this cycle.
• Executed Client Engagements: Where an inquiry progresses into an executed Master Services Agreement (MSA), client records are retained for the duration of the commercial relationship plus the statutory limitation period required by applicable tax, commercial, and corporate recordkeeping laws (typically 6 to 10 years).
• Server Logs & Edge Security Telemetry: Network logs processed by Cloudflare are retained on rolling cycles of thirty (30) to ninety (90) days for forensic anomaly inspection and threat mitigation, after which they are systematically overwritten.

Techtik Studios implements defense-in-depth security measures designed to safeguard all collected data against unauthorized access, alteration, disclosure, or accidental destruction:

• Transport Layer Security: All data transmitted to and from our website is encrypted using industry-standard TLS 1.3 protocol with modern cryptographic cipher suites.
• Strict Access Governance: Access to inbound project briefs and contact submissions is strictly restricted to designated technical directors and principals under Role-Based Access Control (RBAC).
• Multi-Factor Authentication (MFA): All internal communication, notification, and hosting environments enforce mandatory hardware-token or authenticator-based MFA.
• Infrastructure Hardening: Form endpoints incorporate rate limiting, edge-level bot screening, and cryptographic request verification to neutralize automated spam and penetration attempts.

Depending on your country of residence and applicable data protection statutes (including GDPR, UK GDPR, and CCPA/CPRA), you are entitled to exercise specific statutory rights regarding your personal information:

• Right of Access (Art. 15 GDPR): You have the right to request a formal copy of the personal data we hold about you.
• Right to Rectification (Art. 16 GDPR): You have the right to require the correction of inaccurate or incomplete corporate contact data.
• Right to Erasure (“Right to be Forgotten”) (Art. 17 GDPR): You may request the permanent deletion of your inquiry records, subject to legal retention duties.
• Right to Restriction of Processing (Art. 18 GDPR): You may request that we temporarily suspend the processing of your data while a dispute or verification is pending.
• Right to Data Portability (Art. 20 GDPR): You have the right to receive your voluntarily provided project data in a structured, commonly used, machine-readable format.
• Right to Object (Art. 21 GDPR): You have the absolute right to object at any time to the processing of your data based on legitimate interests.
• Right to Lodge a Complaint: You maintain the statutory right to lodge a formal complaint with your national supervisory data protection authority.

To exercise any of these rights, please submit a formal request via email to [email protected]. To safeguard confidentiality, requests must originate from the enterprise email domain utilized in your original submission. We verify identity and respond within thirty (30) calendar days without fee.

Techtik Studios operates globally, serving clients across North America, the European Union, the United Kingdom, the Middle East, and the Asia-Pacific region. Consequently, information collected through this website may be transferred to, stored, and processed in jurisdictions outside your home country.

Where data originating in the European Economic Area (EEA) or the United Kingdom is transferred to third countries lacking an adequacy decision, we ensure that appropriate safeguards are instituted in accordance with Article 46 of the GDPR, primarily through the execution of standard contractual clauses (“SCCs”) adopted by the European Commission.

Our website, architectural consulting, and engineering services are exclusively directed at commercial enterprises, founders, and business professionals. We do not knowingly market to, solicit information from, or collect personal data from individuals under eighteen (18) years of age. If you become aware that a minor has submitted information through our channels, please notify us immediately at [email protected], and we will expeditiously expunge such records from our systems.

We reserve the right to amend, update, or revise this Privacy Policy at our discretion to reflect evolving operational practices, statutory updates, or technological advancements. Any material revision will be published on this page with an updated “Last Revised” timestamp at the top of the document. We encourage prospective and current clients to review this policy periodically.

If you have any questions, compliance inquiries, or requests regarding this Privacy Policy or our data governance practices, please direct your communication to: