Privacy policy, in plain words

This policy explains how Criza Studio ("Criza", "we", "us") handles personal data when you use this website or contact us about our services. We decide why and how this data is used, so we are responsible for it.

If you become a client, your project agreement may add further terms about data we handle on your behalf.

We only hold what you give us, along with the limited technical data needed to run a website.

• Contact form: your name, email address, the kind of work you need, a budget range and your message, including any brief you add.
• Direct contact: whatever you include when you email, call or message us on WhatsApp, along with your email address or phone number.
• Client work: the business and billing details needed to prepare proposals, agreements and invoices.
• Technical data: your IP address, browser details and the pages requested, which are processed when your device connects to the site.

Please do not send us passwords, payment card details, health records or other sensitive information through the contact form.

Some features work entirely on your device, and we never receive what you enter unless you choose to send it.

• The assistant gives scripted replies written in advance. Your questions are not sent to us or to any AI service.
• The project brief builder keeps your answers in your browser. If you choose to send your brief, it is carried to our contact form through the page address, and we receive it only when you submit that form.
• The website launch checklist saves your progress in your browser's local storage. You can clear it with the button on that page or through your browser settings.
• The live measurements on our page about this website are calculated in your browser and are not sent to us.

• To read and reply to your enquiry, and to prepare a proposal if you ask for one.
• To carry out, invoice and support the work we agree.
• To keep the site secure and working, including limiting repeated form submissions and investigating errors.
• To meet our legal, tax and accounting duties, and to establish or defend legal claims.

We rely on your consent when you choose to send us information, which you can withdraw at any time, and on the other lawful grounds that apply, such as carrying out what you asked for or meeting a legal duty. We do not add you to a mailing list or use your details for marketing.

We do not set advertising or analytics cookies, and we do not use tracking pixels, which is why you do not see a cookie banner here.

Our hosting provider may set a strictly necessary cookie to protect the site from automated attacks. As described above, the launch checklist also uses your browser's local storage. If we ever add analytics, we will update this policy first and ask for consent where the law requires it.

We use a small number of providers to run the site and handle your messages. They process data for these purposes, under their own security and privacy commitments.

• Cloudflare hosts and protects this website, and so processes technical data such as your IP address. We can view recent request and error logs through it.
• Resend delivers contact form submissions to us by email, and so processes the contents of your message.
• Google provides the email inbox where we receive and keep enquiries.
• WhatsApp (Meta) handles any message you choose to send us there, under its own terms and privacy policy.

These providers may store or process data in other countries, including the United States and the European Economic Area. By using these services, you understand your data may be processed outside India. We will follow any restrictions the Government of India notifies on such transfers.

We do not sell, rent or trade your personal data. Apart from the providers above, we share it only:

• when you ask us to, or the work requires it, such as with a hosting or payment provider for your project;
• with professional advisers, such as accountants and lawyers, who owe us a duty of confidentiality;
• when the law, a court or a government authority validly requires it, or to protect rights, safety or the security of the site;
• if our business is reorganised or transferred, in which case this policy continues to protect your data.

The site is served over encrypted HTTPS connections, access to enquiries is limited to the people who need it to do their work, the email key is stored as a protected secret rather than in the code, and the contact form limits repeated submissions.

No website or email system can be guaranteed to be completely secure. If a personal data breach occurs, we will act to contain it and notify affected people and the authorities as the law requires.

• Enquiries that do not lead to work: up to 24 months after our last contact, so we can pick up the conversation if you return, unless you ask us to delete them sooner.
• Client and billing records: for as long as the project requires, and then for as long as tax, accounting and other laws require.
• Hosting request and error logs: up to 7 days.
• Contact form rate-limit data: briefly in temporary memory, and never written to storage.

When we no longer need your data and no law requires us to keep it, we delete it. Providers may hold brief copies in their own systems and backups under their own retention schedules.

Subject to applicable law, you can ask us to:

• tell you what personal data we hold about you, how we use it and who we have shared it with;
• correct, complete or update it;
• erase it, unless we must keep it by law;
• stop using it where you withdraw your consent, which does not affect what we lawfully did before;
• respond to a grievance about how we handled it;
• act on the request of someone you nominate to exercise your rights if you die or become unable to do so.

We do not charge for these requests. We may ask you to confirm your identity first, so we do not give your data to someone else.

Write to info@criza.dev with the subject "Privacy request" and we will confirm receipt within a few working days. We aim to resolve requests and grievances within 30 days, and will tell you if we need longer.

Our grievance officer is Abrar Ali, who can be reached at the same address.

If you are not satisfied, you may have the right to complain to the Data Protection Board of India once the relevant provisions of the law are in force, or to another competent authority.

This website and our services are for businesses and adults. We do not knowingly collect personal data from anyone under 18. If you believe a child has sent us their data, write to us and we will delete it.

We link to other services, such as LinkedIn, GitHub and WhatsApp, and offer share buttons on articles. These only connect when you use them, and those services' own privacy policies apply once you do.

This policy is intended to meet the Information Technology Act, 2000 and the rules made under it, including the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Digital Personal Data Protection Act, 2023 and its Rules as their provisions come into force.

If we change our practices, we will update this page and the date at the top of it. For a significant change that affects data we already hold, we will tell you directly where we can.