Privacy Policy

This website (https://subrata.fedardokan.com) is operated by Subrata Mohajan, an independent Graphic Designer, Brand Visualizer, and Digital Products provider based in Chattogram, Bangladesh. This Privacy Policy applies to all visitors, prospective and active design clients (including clients in the United Kingdom, European Economic Area, United States, and Bangladesh), and customers purchasing digital software subscriptions or tools through our online store.

For any privacy-related questions or data requests, you may contact the Data Controller directly at subratamohajanniloy@gmail.com or via WhatsApp at +880 1601 168996.

We only collect information necessary to deliver design services, fulfill digital product orders, verify payments, prevent fraud, and improve website performance:

• Client Consultation & Contact Inquiries: When you reach out via our contact page, email, or WhatsApp, we collect your name, email address, phone/WhatsApp number, company/brand name, and project brief details.
• Digital Store Checkout Information (/checkout/): When you place an order for a digital product (such as Google AI Pro / Gemini Advanced, Adobe Express Premium, Duolingo Super, or Lovable Pro), we collect your Customer Name, Phone / WhatsApp Number, Email Address (used for official license/invite delivery), selected Payment Method (bKash, Nagad, Rocket, or Bank Transfer), and your mobile money or bank Transaction ID (TrxID). We do not collect or store your mobile wallet PIN, bank password, or payment card numbers.
• Anti-Bot & Fraud Prevention Data: Our checkout uses Cloudflare Turnstile to protect order endpoints from automated abuse without capturing invasive biometrics.
• Privacy-Preserving IP Anonymization: In accordance with strict data minimization standards, we do never store raw client IP addresses. All incoming network IP addresses are truncated at the server level (IPv4 addresses are masked to /24 e.g. 203.0.113.0, and IPv6 addresses are masked to /48). Anonymized IPs are used solely in memory for adaptive rate-limiting and duplicate-TrxID fraud mitigation before automated expiration.

We believe in radical data privacy and user autonomy. We implement Google Consent Mode v2 natively across all pages. By default, before you interact with our consent banner, all non-essential storage and advertising parameters (ad_storage, ad_user_data, ad_personalization, and analytics_storage) are strictly set to denied.

Your Consent Choices & How to Change Them

When you visit the site, you are presented with our self-hosted consent banner offering two transparent choices:

• সব গ্রহণ করুন (Accept All): Grants consent for Google Analytics 4, Google Tag Manager, and Meta Pixel. These tags are deferred to idle execution to prevent render blocking.
• শুধু প্রয়োজনীয় (Essential Only): Rejects all advertising and third-party analytics cookies. Zero network requests are made to Google Tag Manager, Google Analytics, or Facebook Pixel. Only essential error logging and anonymized presence beacons operate.

You can change or revoke your consent choice at any time simply by clicking the Cookie Settings link located in the footer of every page, or by clearing the sm_consent key in your browser’s local storage.

Analytics & Infrastructure Tools

• Google Analytics 4 (GA4 — G-0VF0MBD3ZP): Gated behind Consent Mode v2. Measures pseudonymized visitor interactions only when consent is granted.
• Google Tag Manager (GTM — GTM-NCB7L3MC): Gated behind Consent Mode v2. Loads container tags only upon user consent.
• Meta Pixel (1079290228313088): Gated behind user consent. Zero scripts or tracking pixels fire while consent is denied or set to Essential Only.
• Vercel Web Analytics & Speed Insights: Privacy-friendly Core Web Vitals (LCP, INP, CLS) monitoring without tracking cookies.
• First-Party Visitor Presence Tracker (/api/visitor-ping): Essential store telemetry that generates an anonymized session token to estimate concurrent store traffic, respecting your consent setting for non-essential telemetry.
• Sentry Crash & Error Monitoring (sentry.io): Essential technical diagnostic service capturing JavaScript runtime exceptions and API failures to ensure checkout reliability.

We also use browser localStorage to cache live product stock counts (sm_live_stocks, sm_live_prices) and your recent order token locally on your device for secure order status retrieval.

Under the UK General Data Protection Regulation (UK-GDPR), EU-GDPR, and applicable international privacy laws, we process personal data under the following legal bases:

• Performance of a Contract: Processing your name, email, phone number, and TrxID to verify payment, deliver digital product invitations/keys, provide replacement warranty support, or execute graphic design commissions.
• Legitimate Interests: Securing our checkout against fraudulent Transaction IDs, monitoring application errors via Sentry, and measuring aggregate website performance.
• Legal Obligation: Retaining transaction and invoice records required for tax, accounting, and dispute resolution compliance.
• Consent: Where required by law for optional marketing or advertising cookies, which you may block or clear at any time via your browser settings or ad-preference controls.

We never sell, rent, or trade your personal information or contact list to third-party marketers. Data is shared strictly with trusted infrastructure processors that power this site:

• Vercel Inc. (United States) — Cloud platform hosting, edge routing, serverless API functions, and privacy-preserving Web Analytics.
• Supabase Inc. (United States / AWS us-east-1) — Managed PostgreSQL database with Row Level Security (RLS) for digital product order storage, encrypted customer records, and product license vaults.
• Google LLC (United States) — Google Tag Manager and Google Analytics 4 (executed strictly in accordance with Google Consent Mode v2 signals).
• Meta Platforms, Inc. (United States) — Meta Pixel advertising measurement (gated strictly behind explicit consent) and WhatsApp Business client communication.
• Functional Software, Inc. d/b/a Sentry (United States) — Real-time application error logging, exception stack traces, and crash diagnostics.
• Cloudflare, Inc. (United States) — Cloudflare Turnstile CAPTCHA-free bot verification, DDoS protection, and DNS security.

We enforce strict automated data retention limits to prevent unbounded data accumulation:

• Digital Product Orders: Retained for 5 years for accounting, taxation, dispute resolution, and subscription warranty validation (up to 18 months for Google AI Pro warranties). Orders older than 5 years are archived or scrubbed.
• Visitor Presence & Telemetry Records (/api/visitor-ping): Anonymized visit logs and telemetry records are retained for a maximum of 90 days, after which they are permanently deleted via automated cron routines.
• Design Client Contracts & Project Deliverables: Retained for 5 years for business accounting and client re-download requests unless an earlier erasure request is submitted.
• Admin Dashboard Audit Logs: Security audit logs of administrative actions are retained for 1 year for cybersecurity review and anomaly detection.

Regardless of your location (including the UK, EU/EEA, US, or Bangladesh), you have the right to:

• Access: Request a copy of the personal data or order records we hold about you.
• Correction (Rectification): Ask us to update an incorrect email address, phone number, or order detail.
• Deletion (Erasure): Request deletion of your personal data from our database, subject to mandatory accounting or fraud-prevention retention laws.
• Opt-Out of Tracking: Clear cookies and localStorage in your browser, use browser privacy extensions, or opt out of Google Analytics (Google Analytics Opt-out Add-on) and Meta targeted ads via your Facebook Ad Preferences.

How to Submit a Data Deletion or Access Request: Send an email from the email address associated with your order or inquiry to subratamohajanniloy@gmail.com with the subject line Data Deletion Request or Privacy Access Request. Please include your Order ID or phone number if applicable. All verified requests are actioned and confirmed within 30 calendar days in full compliance with UK-GDPR and international privacy frameworks.