Privacy Policy

When you contact us through our contact form, we collect the details you choose to share:

• Your name and email address
• Your phone number and business name, if you provide them
• The service you’re interested in, your budget range, and how you found us
• Your project details or message

Your business name and phone number are optional. Your name, email, selected service, budget range, referral source and project message are required so we can understand and respond to your enquiry.

When you visit the Site, we automatically collect a small amount of technical data so we can keep it secure and working:

• Your IP address is necessarily processed by our hosting and bot-protection providers. In our contact-message database, we store only a salted one-way code when a private hashing salt is configured; otherwise, we store no IP identifier there.
• Your browser type and device (user agent), trimmed to a short length.
• Basic, anonymous usage information collected by our hosting provider.
• If we enable Cloudflare Web Analytics, it records only aggregate, de-identified totals — page views, visits, approximate country and device type. It sets no cookies, does not track you across other sites, and cannot identify you personally.

We do not use advertising cookies to follow you around the web.

We use your information only to:

• Reply to your enquiry and discuss a possible project
• Deliver the services you’ve hired us for
• Send invoices and handle payments
• Keep the Site protected from spam, bots and abuse
• Meet our legal, accounting and tax obligations

We never sell or rent your personal information to anyone.

Where data-protection law such as the UK/EU GDPR applies to you, we rely on the following grounds:

• Legitimate interests — responding to your enquiry, protecting the Site from spam and abuse, and keeping ordinary business records.
• Performance of a contract — delivering the services you have hired us for, and invoicing you for them.
• Legal obligation — meeting accounting, tax and other statutory requirements.
• Consent — anything optional, such as marketing email. You can withdraw consent at any time, and we act on it promptly.

Our contact form uses Cloudflare Turnstile, a managed “prove you’re human” check that may be visible or interactive when needed. It runs a lightweight challenge in your browser and tells our server whether a submission looks genuine. During this check, limited technical data may be shared with Cloudflare. You can read their privacy notice at cloudflare.com/privacypolicies.

The Site itself is light on tracking:

• Your theme choice (light or dark) is stored in your browser’s local storage so the Site remembers it next time. It stays on your device — we never see it.
• We don’t use advertising or cross-site tracking cookies. Any traffic analytics we run (Cloudflare Web Analytics) is cookieless and reports only aggregate, de-identified totals.
• Cloudflare, our hosting provider, may set essential technical cookies to keep the Site secure and fast.

We share the minimum necessary with a small number of trusted providers:

• Supabase — securely stores the messages you send through our contact form.
• Cloudflare — hosts the Site, provides DNS and Turnstile bot protection, and (when we enable it) provides cookieless, aggregate Web Analytics.
• Google Fonts — delivers the fonts you see on the Site.

Each provider has its own privacy policy and handles data under its own terms.

We do not keep personal data indefinitely. Our standard retention periods are:

• Contact enquiries that don’t become projects — up to 24 months from your last contact with us, then deleted.
• Client project records — for the duration of our work and for 12 months afterwards, so we can support what we built.
• Invoices and financial records — retained for as long as accounting and tax law requires, typically 6 years. We cannot delete these earlier, even on request.
• Technical and security logs — a short rolling window, typically no more than 90 days.

You can ask us to delete your enquiry data sooner — see Your rights below.

If a security incident affects your personal data in a way likely to put you at risk, we will notify you without undue delay and, where we are required to, the relevant supervisory authority within 72 hours of becoming aware. We will tell you what happened, what data was involved and what we are doing about it — we will not quietly sit on it.

Depending on where you live, you may have the right to:

• Access the personal data we hold about you
• Correct information that’s wrong
• Ask us to delete your data
• Ask us to stop using your data
• Receive a copy of your data in a portable format
• Object to processing based on our legitimate interests
• Withdraw consent at any time, where consent is what we relied on
• Complain to your local data-protection authority

To exercise any of these, email contact@twstack.com. We acknowledge requests within 5 business days and respond in full within 30 days. These rights are free to use; we may ask you to verify your identity first, and we may decline requests that are repetitive or clearly unfounded.

If you are unhappy with how we have handled a request, you have the right to complain to your national data-protection regulator. We would appreciate the chance to put it right first.

We take security seriously. Among other measures:

• All secrets — such as database and bot-protection keys — live only on our server and never reach your browser.
• Our contact-message table never stores your raw IP address.
• Our database blocks public writes; only our server can save a message.
• The Site is served over HTTPS and protected by Cloudflare.

No system is perfectly secure, but we work hard to keep yours safe.

The Site isn’t aimed at children under 16, and we don’t knowingly collect their information. If you believe a child has sent us their data, contact us and we’ll delete it.

Because we work with clients worldwide and use global providers (such as Cloudflare, Google and Supabase), your data may be processed outside Pakistan, including in the United States and the European Union.

Each provider handles international transfers under its own current terms, locations and legal safeguards. We review the services we use and, where applicable, rely on the transfer mechanisms and contractual protections they publish. Contact us if you need details relevant to your jurisdiction.

We may update this policy from time to time. When we do, we’ll change the “Last updated” date above and, for major changes, do our best to let you know.

Questions about your privacy? Email us at contact@twstack.com or message us on WhatsApp at +92 3289985569. We are available 9:00 AM – 10:00 PM (PKT, UTC+5), seven days a week, and we respond to privacy requests within 5 business days.