Privacy

Who is responsible

Virtioz is operated by Safeerullah Afridi as an individual based in Islamabad, Pakistan. For this website’s enquiries and client records, Safeerullah Afridi is responsible for deciding how your personal information is used.

Contact [email protected] for privacy questions, requests or further business contact details.

Information you provide

The public contact form asks for your name, email and project brief. Company information is optional. Other enquiry or meeting flows may also collect an optional phone number, scheduling details or notes. We store these details in our Supabase project database so we can respond, discuss the requested work and manage the relationship.

Client accounts can contain project details, tasks, messages, proposals, maintenance and payment records relevant to the work. Payment records in the workspace record amounts received; the public contact form does not process payments or collect payment card details.

You choose whether to contact us. Required form fields are needed to identify your request and reply. Submitting an enquiry does not sign you up for marketing. Please do not send passwords, payment card numbers or sensitive personal information through the form.

Why we use information

We use enquiry details to answer your request, understand the project and prepare any agreed next steps. Client information supports the services, communications and records connected with an agreed project. Technical request information, such as IP addresses and request times, is also processed for delivery, security and abuse prevention.

Where applicable data-protection law requires a lawful basis, processing needed to take steps you request before a contract, or to perform a contract with you, relies on that basis. Business-contact enquiries and service security can rely on legitimate interests in handling requested communications and protecting the service. Records required by law rely on the relevant legal obligation. Optional Google Analytics relies on your permission.

Providers and international processing

We use Supabase for the project database and authentication, Vercel for application hosting, Cloudflare for network delivery and protection, and Google services for Gmail correspondence and, if allowed, Google Analytics. These providers process information needed to supply their services. Information may also be disclosed where legally required or needed to establish, exercise or defend legal claims.

These services operate internationally, so information may be processed outside Pakistan or your home country. The connected Supabase project is hosted in Singapore. Other service locations and retention arrangements depend on the provider and account configuration. Contact us for information about the providers and arrangements used for your project.

Provider information: Supabase privacy, Vercel privacy, Cloudflare privacy, and Google privacy.

How long we keep records

We review enquiries that have not become projects quarterly. We delete them after 12 months without meaningful contact, unless there is an ongoing discussion or a documented legal reason to retain them. This is a manual review process, not an automatic deletion timer.

For active clients, we retain information needed to deliver and maintain the agreed work. After the relationship ends, retention depends on outstanding obligations, relevant tax or accounting requirements, and any need to establish, exercise or defend legal claims. Records should be deleted or anonymised when those purposes no longer require identifiable information.

Removing information from active records does not necessarily erase every provider backup immediately. Provider backups and technical logs follow their own retention arrangements. The lifetime of an analytics cookie is also different from how long Google retains reports or event data.

Cookies and browser storage

• Client sign-in: Supabase authentication cookies keep requested account sessions signed in and refreshed. Their expiry depends on the authentication session and browser; the current library can set cookies for up to 400 days. Signing out ends the application session.
• Enquiry and booking verification: after a saved enquiry, a signed vz-booking cookie helps verify a subsequent meeting request. It expires after 20 minutes or is removed after a successful meeting request.
• Your analytics choice: vz-analytics-consent-v1 is stored locally in your browser until changed or cleared. A previous vz-analytics-opt-out preference is also respected. These preferences do not load Google Analytics by themselves.
• Intro display: vz-seen in session storage records whether the website intro has been shown during the browser session.
• Optional Google Analytics: when allowed, _ga and the stream-specific _ga_VN2L9QR1EE cookies help distinguish visits and sessions. We configure them for up to 90 days without extending that expiry on every visit. Browser controls can shorten storage.

Optional website analytics

Google Analytics measures public page visits, saved enquiries, email-link clicks and portfolio-link clicks only after you allow analytics. Google processes connection and device information and cookie identifiers to produce reports. Advertising storage, ad personalisation and Google Signals are disabled in our website integration.

We do not include your form content, name, email, enquiry ID, URL query strings or private dashboard paths in the events sent by our integration. Do Not Track, Global Privacy Control and earlier opt-outs are respected. You can withdraw permission below; this disables our Google tag and removes its configured analytics cookies from this browser.

Read how Google uses information from sites and apps that use its services.

Hosting and network providers may separately process request and performance information to deliver and protect the website. The preference below controls our optional Google Analytics integration; it does not control provider infrastructure logs or an external website’s services.

External links and project previews

Portfolio pages showcase demonstration projects owned by the Virtioz operator and hosted on Vercel. Live previews can load automatically as they approach the visible part of the page, connecting your browser to the displayed project domain and its hosting services. You can also open each project in another tab.

Each project deployment has its own technical settings. The Google Analytics preference on this website controls Virtioz’s tag; it does not change the settings of an embedded project or another website opened through a link.

Your choices and rights

You can contact [email protected] to ask about your information, request access or correction, or request deletion. Depending on applicable law and the reason for processing, you may also have rights to restrict processing, receive portable data, or object to processing based on legitimate interests. You can withdraw optional analytics permission at any time using the control above.

Some information may need to be retained for legal duties, an active agreement or legal claims. We may need to verify a requester's identity before acting on a request. Withdrawing permission does not undo processing that was already carried out lawfully.

You may also have a right to complain to the relevant data-protection authority under the law that applies to you, including the authority where you live or work where applicable. You can raise a concern with us using the email above.

Changes to this notice

We will update this notice when the website’s processing or operator details change. The date above identifies the current version.