How we handle your information.
Who we are and what this policy covers
Amanah Studios is a sole proprietorship based in New York City, serving businesses and organizations in different locations. This policy explains how we handle information through our website, direct communications, bookings, project delivery, and ongoing services.
For privacy questions or requests, contact contact@amanahstudios.com. This policy explains our information practices; it does not replace the service agreement or any applicable data-protection schedule.
Information we collect
Information you provide. This can include your name, business contact details, organization, service interests, booking details, messages, project briefs, approvals, and billing or transaction correspondence. Only provide information relevant to the inquiry or service.
Information supplied for client work. Depending on the agreed scope, clients may provide photographs, logos, contracts, website materials, customer or sales records, employee information, and access to service accounts. These records may relate to people other than the client contact. Clients must have the authority and permissions needed to provide them. Access credentials should be shared through an agreed secure method, not ordinary inquiry fields.
Information from website use and other sources. Website and hosting operations may process network and device information, requested pages, timestamps, and security or error records. Browser features can save preferences and drafts on your device. We may also consult public business information or receive information from authorized client representatives and service providers. Storage and optional analytics are explained below.
How we use information
We use relevant information to respond to inquiries, assess project fit, arrange meetings, prepare proposals, deliver and maintain agreed services, administer billing, resolve support issues, protect accounts and systems, and meet legal obligations. We do not sell personal information.
Where data-protection law requires a legal basis, we use information as necessary to take requested steps toward or perform a contract with you; meet a legal obligation; or pursue legitimate interests such as communicating with business representatives, managing engagements, and protecting services, after considering the effects on individuals. A contract with your employer does not automatically make contract performance the basis for processing your information. Where consent is required, we seek it for the particular activity, and it may be withdrawn. Sensitive information can require an additional legal condition and project-specific safeguards.
Information handled for clients
We determine how to handle our own inquiry, relationship, billing, and administrative records. When we handle a client’s customer, employee, or other personal information solely to provide their agreed services, we act on that client’s documented instructions, subject to applicable law and the agreed data-protection arrangements.
The client generally determines why those records are used and supplies the relevant notices and permissions. Requests about a client’s records should normally be directed to that client; if a request reaches us, we coordinate with the client as appropriate. Having a manager role or using a client-owned account does not remove our own applicable privacy, security, or confidentiality obligations.
Files and account access
We prefer clients to establish and control their own service and storage accounts and give us the permissions needed for the work. We generally use Google Drive, including ordinary folders shared with specified recipients, and can use other agreed services. Studio-controlled project folders are restricted to authorized recipients rather than made accessible to anyone with a link.
We may keep necessary local working copies for development, editing, and work without an internet connection. Clients should retain their original materials and independent copies of delivered work. Shared folders and working copies support delivery; they are not a backup or archival service unless separately agreed. Contractual responsibilities are set out in the website and service terms and the signed service agreement, subject to applicable law.
Clients can manage permissions on their own accounts. Removing access may prevent us from completing work that needs it; any effect on delivery is handled under the service agreement. Revoking access does not itself erase working copies already held by us, which remain subject to retention, deletion, and confidentiality requirements.
Bookings and meetings
When you book a call, we use your name, email address, selected time, time zone, notes, selected service, and business details you provide. These can include location counts, website, ordering platforms, checkout systems, and an attached service request. Our scheduling service checks Google Calendar availability and stores the booking and request in a private studio reservation. We use Resend to send separate confirmation emails and calendar invitations to you and the studio. Meeting details are supplied separately when needed.
Calendar credentials and other people’s event details are not sent to your browser. Booking-form details are not saved in browser storage; separately saved project drafts are described below. To change or cancel a call, contact our privacy email. Cancellation does not automatically delete the related calendar reservation, emails, or project records.
We record meetings for project notes and use manual transcription only. Before recording begins, we explain the recording and its purpose and obtain the consent required for the participants and circumstances. If required consent is not obtained, we do not record. Referring to this policy or booking a meeting is not blanket consent to recording. Recordings and transcripts are private project information, restricted to authorized people who need them and subject to our retention and deletion arrangements.
Use of AI tools
We do not submit private or confidential client information, customer records, private messages, meeting recordings or transcripts, or account credentials to AI tools. This restriction also applies when such information is embedded in files or source code.
AI-assisted work is limited to public materials and appropriately authorized, nonconfidential code and content. Public availability does not remove applicable privacy, licensing, or other rights. Our use of a tool does not authorize reuse of confidential material or override an agreed restriction.
Providers, contractors, and international processing
Relevant providers may support hosting, storage, email, scheduling, payments, project collaboration, development, analytics, and security. The provider and information involved depend on the website feature or agreed service. Payment services may process payment information under their own terms and privacy notices; our billing records can include transaction references and payment status. Do not send payment-card details through ordinary contact or booking fields.
Contractors and partners receive access needed for their assigned work and are subject to confidentiality requirements. Private information is limited to authorized people who need it, including the primary service developer where required. Additional client restrictions must be documented so that access and delivery can be arranged accordingly.
Providers and working locations may change. We apply relevant contractual restrictions, authorization, and notice requirements when making changes. Processing may take place outside your country, where privacy laws differ. Where applicable law requires safeguards for an international transfer, the relevant arrangements must be in place before that transfer; this policy is not consent to unrestricted transfers. Contact us for information about providers and transfer safeguards relevant to your engagement.
Information may also be disclosed where legally required, to establish or defend legal claims, or in connection with a business transfer, subject to applicable confidentiality and privacy requirements and any required notices.
Cookies, browser storage, and analytics
Saved drafts and preferences. Browser storage can retain selected services, project briefs, answers, and notes, as well as appearance and other feature preferences. Some interactive features also save local drafts or progress. These persistent records have no fixed automatic expiry and can remain until removed through the relevant feature or cleared from the browser. Session storage is generally limited to a browsing session, subject to browser restoration behavior. Saving a project draft does not itself submit a booking.
Protected proposals. Successful access to a passcode-protected proposal sets an access cookie with a 12-hour lifetime. Clearing or blocking it can require you to enter the passcode again. This cookie is not needed by every visitor.
Optional analytics. When enabled, Plausible helps us understand page use and interactions. The optional implementation sends page paths, URL query information, and interaction labels; it does not intentionally attach booking-form names, email addresses, or private briefs to those events. URL information can nevertheless contain identifying details, so we do not describe every analytics record as anonymous. Browser Do Not Track settings do not currently change this optional analytics implementation.
You can manage cookies and stored site data in your browser. Clearing site data can remove unsent drafts, preferences, progress, and remembered proposal access; blocking storage may affect these features. This does not delete information already submitted to us. Contact us with questions about tracking or available choices. A browser setting or this policy does not replace consent or an opt-out mechanism where one is legally required.
Retention and deletion
Project working files may be retained during the engagement and for up to 12 months after it ends, only while needed for the project, handover, or related administration. Earlier return or deletion may be required by the client’s lawful instructions, the service agreement, or applicable law. This period is a retention limit, not a promise of backup, file recovery, or continuous availability, and deletion is not an automatic website function.
Inquiry and booking records are retained according to their continuing purpose, including arranging a conversation, following up on a request, and resolving related issues. Recordings and transcripts should be kept only while needed for their note-taking purpose and within the project retention limit unless a legal requirement applies. Contracts, invoices, transaction records, and evidence needed for legal obligations or disputes have separate retention needs; the project-file limit does not require destruction of records we must lawfully keep.
Where information must be retained for a legal obligation or claim, its use remains limited to that purpose. Return and deletion must consider studio-controlled folders, local copies, calendar entries, emails, and relevant providers. Provider recovery systems can have their own deletion cycles. Copies controlled by a client or another recipient are not automatically erased when we delete ours. We do not maintain an independent client-file backup service unless expressly agreed.
Security and confidentiality
We use safeguards appropriate to the information and work, including restricted permissions, confidentiality commitments, and account and device protections. Measures can include two-factor authentication and encryption where supported and configured. No system or method of transmission is completely secure, and we do not guarantee that files can never be lost or accessed without authorization.
If you suspect unauthorized access involving information entrusted to us, contact us promptly. We assess the issue, coordinate with affected clients and providers as appropriate, and comply with applicable security and notification obligations. Client backup responsibilities do not remove duties that the law places on us.
Communications and public project work
Booking confirmations, delivery updates, support, and billing communications help us provide the requested service. Marketing messages are distinct from these operational communications. If we send marketing, you can ask us to stop through the message’s available opt-out method or by contacting us. We follow applicable marketing notice, consent, and opt-out requirements; an inquiry is not blanket marketing consent.
Use of a client’s identity or public project work in our portfolio or marketing depends on the service agreement, applicable rights, and confidentiality restrictions. This policy does not grant us a publicity license. It does not authorize publication of private records, confidential communications, or personal endorsements.
Sensitive information and children
Do not provide sensitive records, identity documents, health information, payment-card details, or children’s information through general inquiry or booking fields. Our business inquiry and booking services are intended for adult business representatives.
A project involving healthcare, schools, children, or other regulated information requires a specific assessment of permissions, notices, access, providers, safeguards, and any required agreements before access is granted. We cannot treat a client-owned account or manager role as a substitute for these protections. If inappropriate information has been supplied, contact us so that we can assess and address it.
Your privacy rights and contact
Depending on your location, the information, and the law that applies, you may have rights to access, correct, delete, or obtain a portable copy of personal information; restrict or object to processing; withdraw consent; or opt out of particular uses. Where applicable, you may use an authorized representative, appeal a decision, or complain to the relevant privacy regulator. These rights are subject to applicable conditions and exceptions, and withdrawing consent does not affect processing lawfully carried out before withdrawal.
Send a request to contact@amanahstudios.com, identifying the relevant relationship and what you are requesting. We may ask for proportionate information to verify identity or authority, without requesting unnecessary sensitive documents. We respond within the time required by applicable law and explain relevant exceptions, additional steps, or appeal routes. We do not penalize people for exercising rights protected by law.
Where we handle information for a client, we coordinate the request with that client under the applicable arrangements. Deleting information is distinct from ending a service agreement or resolving amounts lawfully owed, and contractual terms do not override mandatory privacy rights.
Changes to this policy
We may update this policy as our practices and services evolve. The date above identifies the revision. Where required, we provide additional notice of material changes and obtain consent before introducing a use that requires it. Publishing a revised policy does not by itself authorize an incompatible new use of previously collected information or amend an existing service agreement.