Privacy Policy
This policy describes the data flow implemented in the website repository. Business-owner and professional legal review is still required before publication.
1. Scope
This policy explains how information is handled when you browse mmsstudio.tech, submit a project inquiry, comment on an article, or use the optional publishing workspace. It does not describe a client's separate privacy practices.
2. Information collected
The project inquiry form collects your name, email address, optional phone number, project type, optional estimated timeline, and the project details you choose to provide. A hidden anti-spam field and an optional Cloudflare Turnstile token may also be processed.
Article comments collect the display name and comment text you submit, together with anti-abuse data. For the built-in comment check, the application stores a keyed, non-reversible tag derived from the request address with short-lived challenge and rate-limit records; it does not store the raw address in the comment database. Authorized publishing users sign in through Supabase when the production content workspace is configured. The website does not collect customer billing or delivery addresses.
The web host and security providers may process technical request data such as IP address, browser information, timestamps, and requested URLs for delivery, security, and abuse prevention.
3. How information is used
- To receive, review, and respond to project inquiries.
- To protect the form and website from spam, misuse, and security threats.
- To operate, troubleshoot, and improve website performance.
- To meet legal obligations that apply to the operator.
4. Service providers and transfers
The site is configured for Vercel hosting, Cloudinary-hosted portfolio images, and optional Supabase publishing, authentication, media, and comment moderation. Contact messages are sent through the server-side delivery provider configured by the site owner; supported configurations include a private webhook, Resend, or EmailJS. Cloudflare Turnstile, an optional same-origin analytics endpoint, and an optional Upstash rate-limit store are used only when their environment variables are configured.
These providers may process information in countries outside your own. Their contractual terms and privacy notices govern their processing. The exact production provider configuration must be confirmed by the site owner.
5. Publishing and browser-local features
When Supabase is configured, published articles, account records for authorized editors, uploaded article media, and comments submitted for moderation are processed in the configured Supabase project. When it is not configured, the development preview can store drafts, posts, names, and comments in the browser's local storage. Local preview information remains on that device and browser profile unless browser tools or extensions transmit it.
6. Analytics, cookies, and measurement
The repository includes privacy-conscious event and Web Vitals hooks that remain disabled unless an analytics endpoint is configured. They do not send contact-form content. The application does not set advertising cookies. Hosting, security, or future configured providers may use necessary storage or request data as described in their notices.
7. Retention and security
Inquiry information should be retained only as long as reasonably needed to respond, manage a potential engagement, meet legal obligations, and resolve disputes. The owner has not confirmed a fixed retention schedule. Reasonable technical and organizational safeguards are used, but no internet service can promise absolute security.
8. Your choices and rights
Depending on where you live, you may have rights to request access, correction, deletion, restriction, objection, or a copy of personal information. You may also withdraw consent where consent is the basis for processing. Requests can be sent to the email below; identity verification may be required.
9. Contact and deletion requests
Email privacy questions or requests to hello@mmsstudio.tech. The legal identity, registered address, applicable regulator, and response timetable require owner or legal confirmation.