Privacy Policy

We collect information you provide directly to us, including: - **Personal Information:** Name, email address, phone number, company name when you fill out our contact form, subscribe to our newsletter, or apply for a position. - **Project Information:** Details about your project requirements, budget, and timeline shared through our consultation forms. - **Account Information:** If you create an account for our admin dashboard or client portal, we collect login credentials and profile information. - **Communication Data:** Records of correspondence when you contact us via email, chat, or phone. - **Enterprise & NDA Data:** Any sensitive business information shared under a Non-Disclosure Agreement (NDA) or during enterprise IT staff augmentation engagements. We also automatically collect certain technical information when you visit our website, including IP address, browser type, device information, pages visited, and referring URLs. What we store is narrower than what we receive. Our servers see your IP address on every request. The activity log keeps a SHA-256 hash of it, truncated to 20 characters, and never the address itself. That hash is what rate limiting and the abuse block list match against, so we can stop a spammer without holding a readable record of who they are.

We use the information we collect to: - Respond to your inquiries and provide requested services - Process job applications and manage the recruitment process - Send you newsletters, updates, and marketing communications (with your consent) - Improve our website, services, and user experience - Analyze usage patterns and optimize performance - Comply with legal obligations, GDPR requirements, and protect our rights - Detect, prevent, and address technical issues and security threats We never sell your personal information to third parties. We only share data with service providers who need it to help us operate our business, and they are contractually bound by enterprise-grade confidentiality agreements to protect your information and Intellectual Property (IP).

We use Google Consent Mode v2. Before any tracking tag loads, your browser is sent a signal saying you have not agreed to anything yet. We keep two categories: analytics and advertising. The banner gives you three choices: - **Reject all** — every tag in our container is told you declined. No advertising storage is set, and the site works exactly as it does now. - **Analytics only** — analytics is allowed, advertising storage stays denied. - **Accept all** — both. Your answer is kept in your browser's local storage, so we do not ask again next visit. Clear your browser data and the banner comes back. **What runs inside Google Tag Manager:** - **Google Analytics 4** (analytics category) — which pages get read, which forms get filled in, which outbound links get clicked, and what language the site was read in. It runs for visitors who accept analytics. - **Microsoft Clarity** (analytics category) — session recordings and heatmaps, so we can find the exact point where someone gives up on a form. It runs only for visitors who accept analytics, and only if the tag is switched on in our container; we will remove this line if we ever turn it off. Recordings are handled by Microsoft under their own privacy policy. - **Advertising tags** (advertising category) — we do not currently run any. If we ever add one, it will require your advertising consent and this policy will name it here first. **What we set ourselves:** - **Theme** — whether you chose light or dark. - **Consent** — your choice, in local storage. You can change or withdraw it at any time via **Cookie settings** in the footer, which brings the same dialog back. Clearing your browser data also removes it. - **Attribution** — the campaign that first brought you here (utm values, click IDs, and the hostname you arrived from), as a first-party cookie that expires after 30 days. It is written only after you allow analytics. Until then it stays in memory for the current page, so a contact form you send in the same visit is still credited to the campaign that sent you. - **Sign-in** — if you log in to the admin panel, an authentication cookie keeps you signed in. There is no locale cookie. English and Bangla are separate URLs, and you get the one you asked for. We do not fingerprint, and we do not sell your personal information to anyone.

We integrate with the following third-party services to operate our website and business: - **Neon (PostgreSQL):** Database hosting for application data - **Cloudflare:** CDN, DDoS protection, DNS, and Turnstile bot checks on our forms - **Resend / SMTP:** Email delivery for contact form submissions and newsletters - **Google:** Tag Manager, Analytics 4, and the Consent Mode signals behind them - **Microsoft:** Clarity session recordings - **Cloudflare R2:** File storage for uploaded media Each of these services has its own privacy policy. Google, Microsoft, Cloudflare, Neon and Resend all publish one, and they are the right place to read what happens to your data once it leaves us.

We retain your personal information only for as long as necessary to fulfill the purposes for which it was collected: - **Contact Form Submissions:** Retained for 2 years after last interaction, then permanently deleted - **Newsletter Subscriptions:** Retained until you unsubscribe, then deleted within 30 days - **Job Applications:** Retained for 1 year after the position is filled, then deleted - **Analytics Data:** Google Analytics 4 runs on Google's default retention, 14 months of user-level data and 25 months of event-level data, after which it is aggregated. Microsoft Clarity deletes recordings on a rolling schedule set in the Clarity settings. - **Consent:** Kept in local storage until you change it or clear your browser data. - **Activity Log:** Hashed IP, country, browser, page path and event name for form submissions and sign-in attempts. There is no automatic purge; we delete entries from the admin panel. - **Account Data:** Retained as long as your account is active; deleted within 90 days of account closure You may request deletion of your data at any time by contacting us at privacy@waafitech.com.

Depending on your jurisdiction, you may have the following rights regarding your personal data: - **Right of Access:** Request a copy of the personal data we hold about you - **Right to Rectification:** Request correction of inaccurate or incomplete data - **Right to Erasure:** Request deletion of your personal data ("right to be forgotten") - **Right to Restrict Processing:** Request that we limit how we use your data - **Right to Data Portability:** Receive your data in a structured, machine-readable format - **Right to Object:** Object to processing of your data for marketing purposes - **Right to Withdraw Consent:** Withdraw consent at any time where processing is based on consent **GDPR & International Compliance:** We fully comply with international data protection standards, including GDPR, ensuring that offshore clients partnering with us for staff augmentation or custom software development maintain complete data sovereignty and IP security. To exercise any of these rights, contact us at privacy@waafitech.com. We will respond within 30 days.

If you have any questions about this Privacy Policy or our data practices, please contact us: - **Email:** privacy@waafitech.com - **General Inquiries:** hello@waafitech.com - **Website:** waafitech.com/contact