Privacy Policy

Two things, and they are worth separating because they are collected very differently.

You give it to us

The inquiry form on /contact: your name, email address, phone number if you enter one, the service you are interested in, the budget range you select, and your message. Nothing on that form is collected that you did not type.

Your browser sends it

Standard server request data — IP address, user agent, the page requested and a timestamp — which our hosting providers log automatically for security and to keep the site running. We do not build profiles from it.

We do not ask for, and have no field for, payment card details, government identification, date of birth, or any special-category data (health, biometrics, political or religious views). Do not send those through the inquiry form.

If you send us documents during a project — a brief, a spreadsheet, credentials for a staging environment — those arrive by email or through your own systems, not through this website, and are handled under the confidentiality terms of your engagement.

Every item above maps to one reason. If a reason stops applying, the data goes.

To reply to you

An inquiry is a request to be contacted. We use your details to answer it, scope the work, and follow up. Legal basis: steps taken at your request before entering a contract.

To run the business

We keep a record of inquiries so we know what was quoted, to whom, and when. Legal basis: our legitimate interest in operating and defending the business.

To keep the site up

Server logs and rate limiting exist to detect abuse and outages. Legal basis: legitimate interest in security.

Where you have agreed

Anything non-essential runs only if you accept it in the cookie banner. Today nothing does. Legal basis: consent, withdrawable at any time.

We do not use your information for automated decision-making or profiling, and we do not send marketing email to people who only filled in the inquiry form.

This site runs Google Tag Manager, which is the container our measurement tags are configured in. It loads on every public page, but it loads with every storage category switched off: until you press Accept on the banner, no tag inside it may write a cookie, read an advertising identifier or store anything that could identify you. If you decline, or simply ignore the banner, it stays switched off — Google receives an anonymous, cookieless signal that a page was viewed, and nothing that links that page view to you, to your device or to a previous visit.

There is no session recorder and no A/B testing script. Setting aside what Tag Manager may store after you accept, the following is everything this site keeps in your browser, all of it readable only by us.

Your consent choice

Records whether you accepted or declined non-essential storage, so the banner does not ask again on every page. Strictly necessary — it exists to honour your answer.

Theme preference

Remembers light or dark mode. Strictly necessary for the preference to survive a reload; it identifies nothing.

Admin session

A signed authentication cookie set only for staff signing in to the dashboard at /admin. It is never set for a public visitor.

Everything in that list is strictly necessary or set only after you sign in, so the site works identically whether you accept or decline. Declining costs you nothing, which is the point, and you can change your answer at any time from the cookie settings link at the end of this page.

If we add a tag that needs more than the categories described here, this section is updated before it ships, and your existing consent choice is never quietly widened to cover it.

We do not sell personal information, we do not share it with advertisers, and we do not trade contact lists. A small number of infrastructure providers process data on our behalf, under contract, because the site cannot run without them.

Vercel

Hosts and serves this website. Processes request logs, including IP addresses.

Render

Hosts the application server that receives the inquiry form.

MongoDB Atlas

The managed database where inquiry records and site content are stored.

Google (Tag Manager)

Serves the measurement container described above. Because your browser loads it directly, Google sees your IP address and user agent on every page view. Before you accept the banner, that is all it receives — no cookie is set and no advertising identifier is read.

Fontshare

Serves one webfont used across the site. Your browser requests it directly, so their CDN sees your IP address and user agent. No cookie is set.

Beyond those, we disclose personal information only where we are legally required to — a valid court order or regulatory demand — or where it is necessary to establish or defend a legal claim. If we are ever compelled to hand over your data, we will tell you unless we are legally barred from doing so.

We operate from Bangladesh and roughly half our clients are outside it, so your information will in practice be processed in more than one country — including in the United States and the European Union, depending on where the providers above run the infrastructure serving you.

Where personal information covered by UK or EU data protection law leaves that jurisdiction, we rely on our providers' standard contractual clauses and equivalent safeguards. If you want to know which provider handles a specific record, ask and we will tell you.

Inquiries that went nowhere

Deleted within 24 months of the last contact, unless you ask for it sooner.

Inquiries that became projects

Kept for the life of the engagement and for as long afterwards as tax and contract-limitation rules require, then deleted.

Server and security logs

Retained on a short rolling window by our hosting providers, typically measured in days to weeks, then rotated out automatically.

We do not keep data indefinitely on the theory that it might be useful later. If a record has no live reason to exist, it is deleted.

Wherever you are, you can ask us to do all of the following, and we will do it regardless of whether your local law obliges us to.

• Tell you exactly what we hold about you, and give you a copy.
• Correct anything that is wrong or out of date.
• Delete your record entirely.
• Stop using your information for a particular purpose.
• Provide your data in a portable, machine-readable format.
• Withdraw a consent you previously gave, without penalty.

Email info@strsltd.com with the request. We reply within one business day and complete the request within 30 days at the outside. We will not charge you, and we will not make you explain why.

If you are in the UK or the EEA, you also have the right to complain to your national supervisory authority. We would rather you raised it with us first, but that right does not depend on our agreement.

The site is served over HTTPS end to end. The inquiry endpoint is rate limited and every submitted field is validated and sanitised on the server before it is stored. Administrative access to the dashboard requires a signed session, and access to the database is restricted to the application and to the small number of people who need it.

No system is perfectly secure and we will not claim otherwise. If a breach ever affects your personal information, we will notify you and the relevant authority within the timeframes the applicable law requires.

This is a business-to-business site and is not directed at children. We do not knowingly collect information from anyone under 16. If you believe a child has sent us something through this site, email us and we will delete it.

When this policy changes, the effective date at the top of the page changes with it. Material changes — a new processor, a new category of data, a new purpose — will be described here rather than folded in silently.

We do not apply a new purpose retroactively to data we already hold. If we ever want to use existing records for something this policy does not cover, we will ask first.

Questions, requests and complaints about this policy all go to info@strsltd.com, or by post to STR Solutions Ltd., Dhaka, Bangladesh. Put "Privacy" in the subject line and it will reach the right person faster.