Privacy Policy

1. Who is responsible for your data

The data controller is Amad Zulfiqar, trading as Kovion Holdings, an unincorporated business (see our legal status). For anything privacy-related, email [email protected].

2. What we collect and why

When you contact us

The contact form asks for your name, email address, a subject and your message. We use these to reply and, if it goes further, to prepare a proposal. To stop spam we also store a one-way hash of your IP address (not the address itself) and run a Cloudflare Turnstile check.

Legal basis: our legitimate interest in answering enquiries, or taking steps at your request before entering into a contract.

When you report a bug

The bug-report form stores your description, the priority you choose, the page address and your browser's user-agent string. It doesn't ask for your name or email.

Legal basis: our legitimate interest in keeping the site working.

Analytics, only if you agree

If you accept analytics in the cookie banner, we record which pages you view, clicks on project links, and your browser's user-agent string. This is stored in our own database and isn't shared with an advertising or analytics company. If you reject analytics, nothing is recorded.

Legal basis: your consent, which you can withdraw at any time from “Cookie preferences” in the footer.

When you become a client

We keep the contact details, correspondence, contracts and invoices needed to run the project and meet our legal and tax obligations.

Legal basis: performing our contract with you, and legal obligation.

3. What we don't do

• We don't sell or rent your personal data.
• We don't use advertising cookies, tracking pixels or cross-site profiles.
• We don't make automated decisions about you that have legal or similar effects.

4. Who else handles your data

We use a small number of service providers who process data on our behalf:

• Supabase for the database that stores contact messages, bug reports and analytics events.
• Cloudflare for the Turnstile anti-spam check on the contact form.
• Resend for sending email replies.
• Our web hosting provider, which serves the site and keeps short-term technical logs.

Some of these providers process data outside the UK and EEA. Where they do, we rely on the safeguards they provide, such as standard contractual clauses. We may also disclose information if the law requires it.

5. How long we keep it

• Enquiries that don't lead to a project: deleted within 24 months.
• Client records: kept for as long as tax and accounting rules require, typically six years after the project ends.
• Bug reports and analytics events: deleted within 24 months.

6. Your rights

Depending on where you live, including under UK and EU data protection law, you have the right to:

• access the personal data we hold about you
• have it corrected or deleted
• object to or restrict how we use it
• receive a copy in a portable format
• withdraw consent at any time, where we rely on consent

Email [email protected] and we'll respond within one month. If you're unhappy with how we handle your data, you can complain to your local data protection authority. In the UK that's the Information Commissioner's Office (ico.org.uk). We'd appreciate the chance to put it right first.

7. Children

This website isn't aimed at children under 13, and we don't knowingly collect their data.

8. Changes

If we change this policy, we'll update the date at the top. If a change materially affects how we use data you've already given us, we'll tell you directly where we can.