Privacy policy

Who we are

This website is operated by Lenzo Studio L.L.C, trade licence 1524512, registered in Dubai, United Arab Emirates. Web development services described on this site are delivered under White Nine IT L.L.C, trade licence 1165185.

What we collect

Through the contact form we collect only what you choose to send us: when you submit it, we receive your name, email address, and optionally your phone number and company name, along with the service you are enquiring about, an indicative budget band if you select one, and your message.

Our servers also record standard technical information for every request — IP address, timestamp, requested URL and browser user agent — in access logs. These logs exist to keep the service running and to detect abuse.

What we do not do

• We do not run advertising on this site, and our analytics are not used to target you with ads.
• We never send what you type into the contact form to any analytics service.
• We do not sell, rent or share your personal data with third parties for marketing.
• We do not send marketing email to people who only made an enquiry.

How we measure the site

We want to know which pages help people and where they get stuck, so we measure how the site is used: the pages visited, how far they were read, the device type, and actions such as opening the contact form, sending an enquiry or tapping our phone number. Three tools do this.

• Our own measurement, which runs on our servers, sets no cookie and keeps no identifier beyond your browser tab.
• Google Analytics, run by Google, for traffic and audience reports. We have turned off the use of this data for ad personalisation.
• Microsoft Clarity, run by Microsoft, which records how pages are scrolled and clicked so we can see where a layout confuses people. Anything typed into a form is masked and never recorded.

If your browser sends a Do Not Track or Global Privacy Control signal, none of the three runs at all. Google and Microsoft process this data under their own terms: Google Privacy Policy and Microsoft Privacy Statement.

Cookies

Our own cookie is named theme, and it is set only when you switch between the light and dark colour schemes. It stores that choice so the page opens in the scheme you picked, contains nothing that identifies you and expires after a year.

Google Analytics sets _ga and _ga_* (up to two years) to tell visits from the same browser apart. Microsoft Clarity sets _clck (one year) and _clsk (one day), and Microsoft may set its own cookies, such as MUID, on its domains. Blocking or deleting any of these does not change how the site works.

The contact form carries a Cloudflare Turnstile check, which tells automated traffic apart from people without a puzzle in most cases. It loads only on that form, not on the rest of the site. To do its work Cloudflare receives technical information about your browser and device for that page, governed by the Cloudflare Privacy Policy. We use the result for one thing — deciding whether a form submission is genuine. If you would rather not use it, every other channel on the contact page — WhatsApp, phone and email — works without it.

Why we process it

Enquiry details are processed for one purpose: to answer you and, if we go on to work together, to deliver the project. Technical logs are processed for security, abuse prevention and service reliability.

Who else is involved

Traffic to this site passes through Cloudflare, which provides TLS encryption, protection against denial-of-service attacks and bot filtering. Cloudflare processes connection metadata on our behalf as part of delivering that protection.

Google (Google Analytics) and Microsoft (Clarity) receive the usage measurements described above, which they may process outside the United Arab Emirates. Neither receives the contents of an enquiry.

Everything else — the application, the database and the stored enquiries — runs on infrastructure we operate ourselves.

How long we keep it

Enquiries are retained for up to twenty-four months so that we have context if you come back to us, then deleted. Access logs are rotated and retained for up to ninety days.

How we protect it

All traffic is encrypted in transit. The database is reachable only from the application server itself and never from the internet. Access to stored enquiries is limited to the two directors of the studio.

Your rights

You can ask us what personal data we hold about you, ask for it to be corrected, or ask for it to be deleted. Write to [email protected] and we will respond within thirty days.

Changes

If our practices change, this page changes with them and the date at the top is updated. There is no separate archive; the version published here is the current one.