Privacy Policy
This policy describes the data flow implemented in the website repository. Business-owner and professional legal review is still required before publication.
1. Scope
This policy explains how information is handled when you browse mmsstudio.tech, submit a project inquiry, comment on an article, or use the optional publishing workspace. It does not describe a client's separate privacy practices.
2. Information collected
The project inquiry form collects your name, email address, optional phone number, project type, optional estimated timeline, and the project details you choose to provide. A hidden anti-spam field and an optional Cloudflare Turnstile token may also be processed.
Article comments collect the display name and comment text you submit, together with anti-abuse data. For the built-in comment check, the application stores a keyed, non-reversible tag derived from the request address with short-lived challenge and rate-limit records; it does not store the raw address in the comment database. Authorized publishing users sign in through Supabase when the production content workspace is configured. The website does not collect customer billing or delivery addresses.
For first-party website measurement, the site records the normalized public page path and request time. A random tab-session identifier and the request address are transformed into separate keyed, non-reversible tags before storage. The analytics database does not store the raw session identifier, raw address, full referrer, browser fingerprint, query string, or page-fragment data. Measurement is skipped when the browser sends Global Privacy Control or Do Not Track.
The web host and security providers may process technical request data such as IP address, browser information, timestamps, and requested URLs for delivery, security, and abuse prevention.
3. How information is used
- To receive, review, and respond to project inquiries.
- To protect the form and website from spam, misuse, and security threats.
- To understand measured page activity, operate the publishing dashboard, troubleshoot issues, and improve website performance.
- To meet legal obligations that apply to the operator.
4. Service providers and transfers
The site is configured for Vercel hosting, Cloudinary-hosted portfolio images, and Supabase publishing, authentication, media, comment moderation, and first-party measurement. Contact messages are sent through the server-side delivery provider configured by the site owner; supported configurations include a private webhook, Resend, or EmailJS. Cloudflare Turnstile and an optional Upstash rate-limit store are used only when their environment variables are configured.
These providers may process information in countries outside your own. Their contractual terms and privacy notices govern their processing. The exact production provider configuration must be confirmed by the site owner.
5. Publishing and browser-local features
When Supabase is configured, published articles, account records for authorized editors, uploaded article media, and comments submitted for moderation are processed in the configured Supabase project. When it is not configured, the development preview can store drafts, posts, names, and comments in the browser's local storage. Local preview information remains on that device and browser profile unless browser tools or extensions transmit it.
6. Analytics, cookies, and measurement
The site uses first-party, privacy-conscious page measurement to show aggregate views, page performance, and publishing activity to authorized CMS users. A page is measured at most once within a short repeat window for the same tab session and path. These figures are approximate because privacy controls, disabled JavaScript, network failures, and automated traffic can affect counts. The application does not set advertising cookies or send contact-form or comment content through analytics.
7. Retention and security
Analytics session tags are removed after approximately 32 days, and CMS activity history is removed after approximately 400 days. Daily aggregate counts contain no raw address or session identifier and may be retained for longitudinal reporting. Inquiry information should be retained only as long as reasonably needed to respond, manage a potential engagement, meet legal obligations, and resolve disputes. Reasonable technical and organizational safeguards are used, but no internet service can promise absolute security.
8. Your choices and rights
Depending on where you live, you may have rights to request access, correction, deletion, restriction, objection, or a copy of personal information. You may also withdraw consent where consent is the basis for processing. Requests can be sent to the email below; identity verification may be required.
9. Contact and deletion requests
Email privacy questions or requests to hello@mmsstudio.tech. The legal identity, registered address, applicable regulator, and response timetable require owner or legal confirmation.