Privacy Policy

Last updated 20 October 2026

Who we are (controller)

Mavyn Studio, a design studio based in Dubai, UAE, is the controller of your personal data. Contact: [email protected].

What we collect

• Order data: your name, email, business details, package and amount.
• Your brief: the one-line brief, discovery answers, and any photos, logos or links you send us.
• Payments: processed by Ziina. We never see or store your card details.
• Site logs: minimal technical logs kept by our host, Cloudflare, for security and reliability.
• Chat assistant: runs entirely in your browser from fixed answers, with no tracking, no cookies and nothing stored on our side.
• Business outreach: when we write to a business for the first time, we use only the business email that business has published (for example on its website or a public directory), and we note where we found it.

Why, and our lawful bases

• Contract: to deliver your order and send updates.
• Legitimate interest: limited business-to-business outreach offering one free sample made for that business. A sample is private to the business it was made for. We never present it as client work or imply that business endorses us.
• Consent: where you give it, for example permission to show your project in our portfolio.

Processors and international transfers

We use a small set of service providers only to run the studio: Cloudflare (hosting, forms and email routing), Ziina (payments), Zoho Mail (email) and Google Drive (file delivery). Some of them process data outside the UAE, UK or EU. Where they do, we rely on their contractual safeguards, such as standard contractual clauses or equivalent protections. We never sell or rent personal data.

Retention

• Order records are kept for 5 years for accounting.
• Outreach records of businesses that don't reply are deleted after 6 months.
• Our do-not-contact list is kept permanently, so that we never write to you again.

Your choices and rights

Reply "no" to any email and we'll never write again: your address goes on our permanent do-not-contact list. We send at most one follow-up. Under the UAE Personal Data Protection Law (PDPL) and the UK and EU GDPR, you can ask to access, correct, delete or port your data, and you can object to processing. Email [email protected]. You can also complain to the UK ICO, your local EU authority, or the UAE Data Office.

Security

We use access-controlled accounts, encrypted connections (HTTPS) and private, link-restricted delivery folders.

Children

Our services are for businesses and adults. They aren't for anyone under 18.

Changes

We may update this policy. The date at the top shows the latest version.