Privacy Policy

Last updated: January 2025  ·  Nullforge Studio

At Nullforge Studio, we take your privacy seriously. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website nullforge.studio or engage with our services.

1. Information We Collect

Information You Provide Directly

When you interact with us, we may collect the following information:

• Contact Information: Name, email address, phone number, and business name when you submit a contact form or inquiry.
• Project Details: Service type, budget range, project description, and any files you upload through our contact form.
• Communication Data: Content of messages exchanged between you and our team via email or other communication channels.

Information Collected Automatically

When you visit our website, we automatically collect certain information:

• Device & Browser Data: Browser type, device type, and operating system.
• Geolocation: Country-level location derived from your IP address.
• Usage Analytics: Pages visited, time on page, referring URLs, and interaction patterns.
• UTM Parameters: Campaign source and medium if you arrive via a tracked link.

2. How We Use Information

We use the information we collect for the following purposes:

• Service Delivery: To respond to your inquiries, provide project estimates, and deliver contracted services.
• Communication: To send you updates about your projects, respond to questions, and provide customer support.
• Business Operations: To maintain and improve our website, analyze trends, and optimize our services.
• Legal Compliance: To comply with applicable laws, regulations, and legal processes.
• Security: To detect, prevent, and address technical issues, fraud, or security threats.

We do not sell, rent, or trade your personal information to third parties for marketing purposes.

3. Data Storage & Security

Your data is stored on secure infrastructure provided by Cloudflare, utilizing their D1 database service and R2 object storage. We implement multiple layers of security:

• Encryption in Transit: All data transmitted to and from our website is encrypted via TLS/HTTPS.
• Access Controls: Administrative access to lead data is protected by JWT-based authentication with HTTP-only, secure, SameSite cookies.
• Input Validation: All user-submitted data is sanitized and validated to prevent injection attacks.
• Rate Limiting: API endpoints are rate-limited to prevent abuse and automated scraping.

While we employ industry-standard security measures, no method of transmission over the Internet is 100% secure. We cannot guarantee absolute security of your data.

4. Cookies & Tracking

Essential Cookies

We use a single essential cookie for administrative authentication:

• auth_token: An HTTP-only, secure, SameSite=Strict cookie that stores a JWT token for authenticated admin sessions. This cookie expires after 24 hours and is never accessed by client-side JavaScript.

Analytics

We operate our own privacy-first analytics system. We do not use third-party analytics services such as Google Analytics. Our analytics track:

• Page visits and paths
• General geographic location (country level)
• Device type and browser
• Referrer information

No personally identifiable information is used for analytics purposes. We do not use tracking pixels, fingerprinting, or cross-site tracking.

Cloudflare Turnstile

Our contact form uses Cloudflare Turnstile for bot protection. Turnstile may set necessary cookies to verify that submissions are made by humans. See Cloudflare's Privacy Policy for more details.

5. Third-Party Services

We rely on a minimal set of third-party services:

• Cloudflare: Hosting, CDN, D1 database, R2 storage, and Turnstile captcha.
• Telegram: Lead notification delivery. When you submit our contact form, your inquiry details (name, email, service, etc.) are sent to our team via Telegram for prompt response.
• Google Fonts: Web fonts loaded from Google's CDN. Google may collect your IP address during font delivery. See Google's Privacy Policy.

We do not integrate with advertising networks, data brokers, or social media tracking pixels.

6. Your Rights

Depending on your jurisdiction, you may have the following rights:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request corrections to inaccurate or incomplete data.
• Deletion: Request deletion of your personal data, subject to legal retention requirements.
• Data Portability: Request your data in a structured, machine-readable format.
• Objection: Object to the processing of your data for specific purposes.
• Withdrawal of Consent: Withdraw consent for any data processing based on your consent at any time.

To exercise any of these rights, contact us using the information provided below. We will respond to your request within 30 days.

7. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes outlined in this policy, unless a longer retention period is required by law. Lead inquiry data is retained for a maximum of 24 months after last interaction, after which it is automatically purged from our systems.

8. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please reach out:

• Email: support@nullforge.studio
• Website: nullforge.studio/contact

We take your privacy seriously and will make every effort to address your concerns promptly.