Privacy Policy.

1. Who We Are

Forma × Zarif ("we", "us", "our") is an independent creative studio specialising in motion graphics, 3D animation, AI-assisted video production, and visual design systems. This Privacy Policy explains how we collect, use, store, and protect personal information when you visit our website or use our services.

2. Information We Collect

2.1 Information You Provide

• Contact form submissions: Your name, email address, inquiry reason, and message text.
• Client portal accounts: Name, email, and password (stored as a secure hash) when you are invited as a client.
• Project files: Documents, images, videos, or other files uploaded during a client collaboration.

2.2 Information Collected Automatically

• IP address hashes: We store a one-way hash of your IP address for security rate-limiting (login attempts and contact form). We do not store your raw IP address in contact records.
• Session cookies: We use session cookies to keep you logged in to the admin workspace or client portal. These are strictly necessary and contain no tracking information.
• Analytics & UX Insights: We use Google Analytics (Tag ID: G-M4T678T28Q) and Microsoft Clarity (Project ID: yozizk1qiq) to aggregate anonymous website traffic, session playbacks, and visual heatmap metrics.
• Server logs: Our hosting provider may collect standard web server logs (IP address, browser type, pages visited) for security and diagnostic purposes.

2.3 Information We Do Not Collect

• We do not collect sensitive personal identity data without your explicit submission.
• We do not use advertising cookies or cross-site retargeting tracking pixels.
• We do not sell, rent, or share your personal information with third parties for marketing.

3. How We Use Your Information

• To respond to inquiries: We use your name and email to reply to your contact form messages.
• To provide client services: We use account data to manage projects, share deliverables, and communicate within the client portal.
• To protect security: IP hashes are used to prevent brute-force login attempts and contact form abuse.
• To improve the website: We may review aggregate, non-identifying usage patterns to improve our site experience.

4. Data Storage & Security

Your data is stored in a secure MySQL database on our web hosting server. We implement the following security measures:

• Passwords are hashed using bcrypt (never stored in plain text).
• All forms are protected with CSRF tokens.
• Session cookies are set with HttpOnly, Secure, and SameSite attributes.
• File uploads are validated by MIME type and size, and private files are only accessible through authenticated download endpoints.
• Admin and client areas require authentication on every request.

5. Cookies

We only use strictly necessary session cookies to maintain your login state in the admin workspace or client portal. These cookies:

• Are deleted when you close your browser.
• Do not track your activity across other websites.
• Cannot be used to identify you personally.

For more details, see our Cookie Policy.

6. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate data.
• Erasure: Request deletion of your personal data.
• Restriction: Request that we limit how we use your data.
• Portability: Request your data in a machine-readable format.
• Objection: Object to our processing of your data.

To exercise any of these rights, contact us at the address below.

7. Data Retention

• Contact inquiries: Retained for up to 2 years, then archived or deleted.
• Client data: Retained for the duration of the project plus 3 years for legal and accounting purposes.
• Login attempt logs: Automatically purged after 15 minutes.
• Activity logs: Retained for up to 1 year for audit purposes.

8. Third-Party Services

Our website loads the following external resources:

• Google Fonts: Typography is loaded from Google's CDN. Google's privacy policy applies to this service.

We do not embed social media trackers, third-party analytics, or advertising scripts.

9. Children's Privacy

Our services are not directed to individuals under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us immediately.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated "Last updated" date. We encourage you to review this page periodically.

11. Contact Us

For any questions about this Privacy Policy or your personal data, reach out through our contact page.