Privacy Policy

1. Introduction & Data Controller

At Digital Ustad ("we", "our", or "us"), operated from Lahore, Punjab, Pakistan, we value the trust placed in us by Pakistani small-and-medium businesses, entrepreneurs, and international clients. This Privacy Policy explains how personal and commercial data is collected, processed, and safeguarded when you visit digitalustad.co, interact with our consultation widgets, or submit project briefs.

Digital Ustad acts as the Data Controller responsible for determining the purposes and means of processing personal data collected across our web properties.

2. Website Chat Technology & Clonvo Processor Disclosure

We provide an interactive conversational assistant to help visitors explore service packages, calculate estimates, and submit project inquiries. This conversational technology is powered by Clonvo.chat ("Clonvo").

• Role of Clonvo: Clonvo acts strictly as a data processor / service provider to Digital Ustad. Clonvo processes chat conversations, telemetry, and visitor context solely under our documented instructions and for our internal business communication. Clonvo does not sell, lease, or independently commercialize visitor data.
• Chat Data & Messages: Full text transcripts of inquiries, messages, chat data, and project requirements communicated by visitors within the chat interface.
• Session Data & Identifiers: Ephemeral session data and a pseudonymous session identifier (stored locally in browser sessionStorage as du_clonvo_session_id) to maintain conversation context across page navigation within a single browsing tab. It is discarded when the browsing session ends.
• Page Context & Telemetry: When the chat assistant is opened, structured page context is transmitted once (including current page URL, referring service, selected package ID, and user language preference) to provide relevant project recommendations without requiring redundant input.
• Lead Data & Contact Inquiries: If you request a follow-up or quotation via chat, your provided lead data (name, WhatsApp/phone number, project timeline, and budget band) are captured for proposal preparation.

3. Lead Forms & Ingestion Data Flow

When you submit a project brief through our on-page quotation forms or modal dialogs, data is transmitted via secure HTTP POST to our dedicated serverless ingestion endpoint (/api/leads).

• Minimum Data Collected: Full name, WhatsApp/telephone number, selected service, estimated budget band, and optional project notes. We deliberately do not request unnecessary personal identifiers.
• Security & Anti-Abuse Measures: Submissions are protected by hidden honeypot fields (_gotcha) to deflect automated spam bots, strict payload size limits (< 10 KB), origin verification, and sliding-window rate limiting per IP address.
• Safe Logging: Server-side telemetry strictly redacts and masks telephone numbers and personal identifiers to prevent unencrypted PII exposure in server logs.

4. Purposes of Processing

Your information is collected and processed exclusively for legitimate business purposes:

• Evaluating technical project feasibility, scope, and preparation of commercial proposals.
• Direct client communication via WhatsApp, telephone, or email regarding quotations, deliverables, and milestone staging approvals.
• Executing client contracts, web engineering, graphic design deliverables, and advertising management.
• Preventing malicious attacks, brute-force form flooding, and automated abuse of website services.

5. Third-Party Service Providers & Data Sharing

Transparency Notice: We do NOT make the blanket claim that "no data is shared with third parties."

In order to reliably host our website, process inquiries, and deliver professional agency services, Digital Ustad engages vetted third-party service providers acting as sub-processors:

• Clonvo.chat: Third-party conversational webchat software and AI message routing infrastructure.
• Netlify, Inc.: Global CDN hosting, SSL certificate management, and serverless compute infrastructure (where lead submissions are received and verified).
• Lead Destinations & Automation Providers: Where configured for business operations, confirmed leads may be forwarded via secure HTTPS webhooks to approved automation relays (e.g. n8n, Zapier) or internal CRM systems to notify our engineering team.
• Meta Platforms (WhatsApp Business): Used for direct client messaging and consultation initiated voluntarily by the visitor from our Contact page.
• Google Services: Google Search Console and Google Maps API used for SEO audit and local business verification.

We do not sell, rent, or trade your contact details, customer lists, or proprietary business documents to third-party telemarketers or external advertisers.

6. Data Retention Schedule

We retain personal data only for as long as necessary to fulfill the commercial purposes outlined in this policy:

• Active Client Records & Invoices: Retained for the active duration of the client relationship, and for up to 3 years thereafter to satisfy statutory commercial recordkeeping and accounting requirements.
• Prospective Project Inquiries: Unconverted lead submissions and proposal requests are retained for an evaluation window of 90 to 180 days, after which they are securely purged.
• Browser Session Identifiers: Ephemeral session tokens are stored in session memory and expire immediately upon closing the browser tab.
• Temporary Credentials: Any temporary server or DNS credentials supplied during development are purged from encrypted vaults within 14 days of live handover.

7. Consent & Legal Basis for Processing

By submitting a form on our website or interacting with our chat interface, you provide your informed consent for Digital Ustad and our designated processors to contact you regarding your inquiry. You may withdraw this consent at any time by contacting our administrative office.

8. User Rights (Access, Correction & Deletion)

Under applicable fair information practices and data protection principles, you maintain full user rights over your personal data:

• Right of Access: You may request a confirmation and copy of any personal details or brief records maintained in our systems.
• Right to Correction: You may request immediate correction of inaccurate or incomplete contact numbers, business names, or project requirements.
• Right to Deletion ("Right to be Forgotten"): You may request the permanent deletion and erasure of your contact details, project brief records, and conversation history from our active databases and CRM systems.

To exercise any of these rights, simply email our official privacy desk at contact@digitalustad.co with the subject line "Data Privacy Request". We process all verified requests within five (5) business days without fee.

9. Inquiries & Official Contact Email

For any questions regarding this Privacy Policy, our data handling practices, or processor relationships, please reach out to our administrative desk: