Privacy Policy

This policy explains what personal data we collect when you visit hashbitstudio.com, why we collect it, who we share it with, and the choices you have. We have written it to describe what this website actually does — nothing more.

Who we are

HashBitStudio (SMC-Private) Ltd is a software design and development studio registered in Pakistan, with our studio in Islamabad. We build web and mobile applications, user interfaces, AI and blockchain products, and graphics design work for clients.

For anything in this policy, we are the data controller for the personal data described below. You can reach us at hello@hashbitstudio.com.

What we collect and why

Information you give us through the contact form

Our contact page has a form. When you submit it, we collect the fields you fill in:

• Full name — so we know who we are replying to.
• Company — optional, and only for context about your project.
• Email address — so we can respond, and so we can send you a confirmation that your message arrived.
• Service required — so your inquiry reaches the right people on our team.
• Project budget — to help us judge whether we are a sensible fit before we take up your time.
• Project details — whatever you choose to tell us about what you want built.

Submissions are delivered to us by email and are not written to a database on this website. A copy goes to our studio inbox, and an automatic confirmation goes back to the address you supplied. Please do not include sensitive information, credentials or confidential material in the form — email is not a secure channel for that. If you need to share something confidential, tell us and we will arrange a better route.

Security data

The form endpoint is protected by Arcjet, which screens requests for automated abuse and applies rate limits. To do that it processes your IP address and technical request metadata, such as headers and request timing. This is used to decide whether a submission is genuine — not to profile you or to build a marketing record. Our hosting provider also keeps standard server logs, which include IP addresses, for operating and securing the site.

Analytics — only if you agree

We use Google Tag Manager and Google Analytics 4 to understand which pages people find useful. These run under Google Consent Mode v2 and every consent signal defaults to denied. No analytics cookies are written and no analytics identifiers are set until you grant consent through our cookie banner. If you never consent, or decline, we receive no analytics cookies from your visit. Where consent is given, we look at aggregate behaviour — pages viewed, referring source, approximate location, device and browser type — to improve the site.

Your consent choice itself is stored in your own browser under the key hbs-consent-v1. That is a strictly necessary item: it exists so we can remember your decision and stop asking. Our Cookie Policy lists everything in detail.

Booking a call

We embed Calendly on the contact page so you can schedule a call with us. If you use it, Calendly sets its own cookies and processes the details you enter into the scheduling widget under its own privacy policy. We receive the booking information so we can attend the meeting.

What we do not do

• We do not offer accounts, so there are no profiles or passwords.
• We do not collect payment or card details on this website.
• We do not sell or rent personal data to anyone.
• We do not use your inquiry to add you to a marketing list without your asking.

Legal bases for processing

If you are in the European Economic Area or the United Kingdom, we rely on the following legal bases under the GDPR and UK GDPR:

• Consent — for analytics cookies and any measurement that depends on them. You may withdraw consent at any time, and doing so does not affect processing carried out before you withdrew it.
• Legitimate interests — for replying to inquiries you send us, and for keeping the site secure and available. Our interest is in running a functioning business and protecting our infrastructure from abuse; we have considered this against your rights and use the minimum data needed.
• Performance of a contract, or steps prior to one — where your message concerns a possible engagement and we correspond with you about scope, timelines or a quote.

Your rights in the EEA and the UK

If the GDPR or UK GDPR applies to you, you have the right to:

• Access the personal data we hold about you, and get a copy of it.
• Rectification of data that is inaccurate or incomplete.
• Erasure of your data where we no longer have a reason to keep it.
• Restriction of processing in certain circumstances.
• Portability — to receive data you provided in a structured, commonly used, machine-readable format.
• Objection to processing carried out on the basis of our legitimate interests.
• Complain to a supervisory authority in your country of residence or place of work.

To exercise any of these, email hello@hashbitstudio.com and tell us what you would like us to do. We will respond within one month. We may ask a question or two to confirm we are dealing with the right person before we act, and we do not charge for this.

California residents

We do not sell personal information, and we do not share it for cross-context behavioural advertising, as those terms are used in the California Consumer Privacy Act. We have not done so in the preceding twelve months. California residents may request access to or deletion of personal information we hold, and we will not discriminate against you for making a request. Use the same address — hello@hashbitstudio.com.

International transfers

We are based in Pakistan, so personal data you send us is read and stored by our team there. The service providers listed below operate their own international infrastructure and process data under their own transfer safeguards, including the European Commission’s Standard Contractual Clauses where those apply. If you are in the EEA or the UK and would like more detail on the arrangements for a particular provider, write to us and we will point you to the relevant documentation.

How long we keep things

Inquiry emails are kept for as long as they remain useful to the conversation they belong to — while we are talking, and afterwards for our business records if the inquiry becomes a project. If nothing comes of it, we delete the correspondence once it no longer serves any purpose. Security and server logs are short-lived and retained by our providers on their own schedules. Analytics data collected after consent is retained by Google for up to fourteen months. Your consent choice stays in your browser until you clear it or change it.

Service providers

We use a small number of processors to run the site. Each handles data only as needed to provide their service:

• Vercel — hosting and server logs. Privacy policy
• Hostinger — SMTP email delivery for form submissions and confirmations. Privacy policy
• Google — Tag Manager and Analytics 4, after consent. Privacy policy
• Calendly — call scheduling on the contact page. Privacy policy
• Arcjet — bot detection and rate limiting on the form endpoint. Privacy policy

Children

This site is aimed at businesses and is not directed at children under 16. We do not knowingly collect personal data from anyone under 16. If you believe a child has sent us personal data, contact us and we will delete it.

Changes to this policy

If we change how the site handles data, we will update this page and move the “last updated” date at the top. Where a change materially affects your rights, we will make that clear rather than relying on the date alone. It is worth checking back if you have not visited in a while.

Contact us