Privacy policy

1. General

This policy explains what personal data the ualilab studio website collects, why, and how we process and protect it. It follows the Law of the Republic of Kazakhstan “On personal data and their protection”.

The data controller is [legal entity name, BIN], address: 52V Abay Ave, Almaty, Kazakhstan (the “Studio”, “we”).

By sending a brief, an access request or another enquiry through the website, you consent to the processing of your personal data under this policy.

2. What we collect

Project brief: name, company, role, preferred contact channel and contact details (phone number, Telegram username or email), your answers about the project, timing and budget, links and comments you provide.

Access request for a confidential project: name, company, work email, purpose, acceptance of the confidentiality terms, viewing dates.

Technical details of the visit that show where an enquiry came from: first page visited, referring site, advertising (UTM) tags, site language. We do not use analytics or advertising cookies.

Brief answers are saved as you fill them in so they are not lost; an unfinished brief with contact details may be used to get back to you about your enquiry.

3. Why we process data

To respond to your enquiry, discuss the project, prepare a proposal and sign a contract.

To grant access to confidential materials and monitor compliance with the confidentiality terms.

To improve the website and understand, in aggregate, which channels bring clients.

We do not sell personal data and do not send newsletters without separate consent.

4. Who receives the data

Data is available only to Studio staff handling enquiries.

The website relies on services that process data on our behalf: Sanity (content and enquiry storage), Telegram (notifications to the team), Anthropic (automatic short summary of brief text) and website hosting. Their servers may be located outside Kazakhstan; transfers comply with the rules on cross-border transfer of personal data.

We may disclose data upon a lawful request of public authorities.

5. Retention and security

Enquiry data is kept for no longer than three years after the last interaction or until consent is withdrawn, unless the law requires otherwise. Access request data is kept for no longer than three years.

We apply organisational and technical safeguards: access to data is restricted, the connection to the website is encrypted, service keys are stored on the server only.

6. Your rights

You may ask what data we hold about you, request correction, blocking or deletion, and withdraw your consent.

To exercise your rights, write to hello@ualilab.com — we will reply within the time limits set by the laws of Kazakhstan.

7. Changes

We may update this policy. The current version is always published on this page with its effective date.