Privacy Policy

1. Who we are

This Privacy Policy explains how the digital services business presented under the public-facing name Metaract ("we", "us" or "our") collects, uses, stores and shares information when you visit our website, contact us, submit a project enquiry, or purchase our services. The contracting person or entity and any required business disclosures will be provided in the relevant project or transaction documents and website notices, as applicable.

Metaract operates online. For privacy questions, use the communication channel through which you contacted us or the channel stated in your project documents.

2. What this policy covers

We provide digital services including website development, custom software, application development, UI/UX design and prototyping, graphic design, and AI/LLM-related services. This policy covers information collected through our public website and our direct interactions with prospective and existing clients.

A project may require a separate statement of work, confidentiality agreement, or data-processing agreement. If we process personal data on a client's instructions as part of a project, that project agreement governs the details of that processing. This Privacy Policy describes our own handling of information, including when we receive an enquiry or manage our business relationship.

3. Information we may collect

Depending on how you interact with us, we may collect:

• Contact and identity details: name, business name, email address, telephone number, role and other details you choose to provide.
• Project information: your project description, required features, preferred timeline, budget range, design references, links, existing website or application details, and answers to service-specific questions.
• Files and content: documents, images, brand assets, source files, datasets, example inputs or outputs, and other files you submit. Please do not upload sensitive or confidential information unless it is necessary for the project and we have agreed how it will be protected.
• Business and transaction records: quotes, statements of work, invoices, payment status, approvals, support requests and project communications. Invoices and payment links will be sent directly to clients through DMs or another agreed messaging channel. The messaging platform and payment provider may vary and should be identified in the transaction information or applicable notice where required by law. Payments should be completed on a secure payment-provider page; Metaract does not ask for card numbers, CVVs, passwords or one-time authentication codes through DMs and does not intend to store full payment-card details on its own systems.
• Technical and usage information: IP address, device and browser information, pages visited, approximate access times, referral information, security logs, and cookie or similar technology data where these are used by the website.
• Information from others: information supplied by a person authorised to act for your business, or information needed to verify or administer a project.

We collect only information that is reasonably relevant to the enquiry, project, website operation, security or legal obligations.

4. How we use information

We may use information to:

1. 1.respond to enquiries and understand the outcome you want to achieve;
2. 2.assess feasibility, request clarification, prepare estimates and quotes, and agree project scope;
3. 3.perform services, share drafts, coordinate reviews, deliver files, and provide support;
4. 4.manage contracts, milestones, invoices, payments, refunds and accounting records;
5. 5.protect our website, systems, people, clients and business against fraud, abuse or security incidents;
6. 6.operate, troubleshoot and improve the website and our internal processes;
7. 7.meet legal obligations, respond to valid legal requests, and establish or defend legal claims; and
8. 8.send agency news or marketing where permitted and, where required, with your consent. You can opt out of marketing messages at any time.

We do not sell personal information as a data-broker business. We do not use confidential client files for unrelated purposes or to train general-purpose/public AI models unless you have expressly authorised that use in writing.

5. Legal grounds and choices

We handle information on a basis permitted by applicable law. Depending on the context and the law that applies, this may include your consent, steps taken at your request before entering a contract, performing a contract, complying with legal requirements, protecting systems and legitimate business operations where recognised by law, or establishing and defending legal claims.

Where processing relies on consent, you may withdraw that consent. Withdrawal does not retrospectively invalidate processing already carried out lawfully, and we may still retain information where a legal obligation or other permitted ground applies. If information is essential to quote or perform a requested project, not providing it may mean we cannot proceed.

6. Client project data and our role

If you provide information about your own customers, employees, users or other individuals as part of a project, you are responsible for having the rights and permissions needed to share it with us. Tell us before sending sensitive, regulated or high-risk data.

For ordinary enquiries and our own client relationship records, we generally determine why and how the information is used. When we process personal data solely on a client's documented instructions to deliver a service, our role and the client's role will be described in the relevant project or data-processing agreement. The client may need to provide its own privacy notices and respond to requests from the individuals whose data it controls.

We will not use client datasets or confidential files for unrelated AI training without valid written authorisation. For work involving external AI systems, we will use tools and data handling arrangements selected for the project and disclose material processing arrangements in the project scope or agreement where appropriate. Do not send credentials, secret keys, payment-card data, or highly sensitive data through ordinary enquiry forms.

7. When we share information

We may disclose information to the following categories of recipients, to the extent needed for the purposes described above:

• service providers for website hosting, databases, secure file storage, email, customer support, analytics, security, payment processing, e-signatures, or project management;
• the messaging service we use to notify our team of a new enquiry (currently Telegram), which receives the enquiry details you submit so that we can respond;
• contractors or team members who need the information to perform the agreed work and who are subject to appropriate confidentiality obligations;
• software, cloud-compute, model or API providers needed for a project, subject to the project scope and applicable terms;
• professional advisers, auditors, insurers, payment providers, or authorities where reasonably necessary; and
• a successor or buyer in connection with a business reorganisation, subject to appropriate safeguards and applicable law.

We do not authorise service providers to use client information for their own unrelated purposes. The specific providers used depend on the website setup and the services selected for a project. We will identify providers where required by applicable law or where material to the project arrangement.

8. International processing

Some service providers or team members may process information in countries other than your own. Where cross-border processing occurs, we will take steps required by applicable law and use appropriate contractual or other safeguards where required. If your project has geographic or data-residency requirements, tell us before work begins so we can assess feasibility and cost.

9. How long we retain information

We retain information only for as long as reasonably necessary for the purpose collected, project delivery, security, dispute handling and applicable legal or accounting requirements. Retention periods may differ by record type and applicable law. The project agreement may specify how long project files are kept after handover. We will delete or anonymise information when it is no longer needed, unless retention is legally required or otherwise permitted.

At the end of the applicable period, we will delete or anonymise information, or securely retain only what we are permitted or required to keep. Backups may take a reasonable period to cycle out, subject to security and legal requirements.

10. Security

We use reasonable organisational and technical safeguards appropriate to the information we handle. These may include access restrictions, secure storage, encryption in transit where supported, backups, account controls and limiting access to people who need it. No website, transmission method or storage system can be guaranteed completely secure. Please contact us promptly if you believe information sent to us has been exposed or misused.

11. Cookies and analytics

Our website may use essential cookies or similar technologies needed for site functionality, security or form operation. If we enable optional analytics, advertising or other non-essential tracking, we will describe the tools used and provide any consent or choice mechanism required by applicable law. We keep this notice and any consent controls consistent with the cookies and tracking tools enabled on the website.

12. Your requests and rights

Depending on applicable law and the context, you may be able to ask us to access, correct, update, erase or obtain information about personal data we hold, withdraw consent, or raise a complaint. You can also opt out of marketing messages using the unsubscribe method provided or by contacting us.

Send requests to the communication channel through which you contacted Metaract with the subject "Privacy Request". We may ask for information needed to verify your identity or authority before acting. Some records may need to be retained for legal, contractual, security or dispute purposes. If we process the information on behalf of a client, we may refer your request to that client or assist the client as required by our agreement and applicable law.

For privacy requests, use the communication channel through which you contacted Metaract or the channel stated in your project documents. Any statutory grievance or complaint route available under applicable law remains available.

13. Children

Our agency services and project submission process are intended for adults and business users, not for children to use independently. Do not submit a child's personal data unless the project requires it, the necessary authority and permissions are in place, and we have agreed in writing how it will be handled. If you believe a child has submitted personal information to us improperly, contact us.

14. Third-party sites and services

Our website or project deliverables may link to third-party websites, platforms or integrations. Their privacy practices are governed by their own policies. Review those policies before submitting information to them. We are not responsible for third-party practices outside our control.

15. Changes to this policy

We may update this policy to reflect changes in our services, systems or legal requirements. The revised version will be posted on this page with an updated "Last updated" date. If a change materially affects an existing project, we will provide any notice required by law or the relevant agreement.

16. Contact

For questions or complaints about this Privacy Policy, contact Metaract at the communication channel through which you contacted Metaract or the contact channel stated in the relevant project documents. If applicable law provides a specific complaint or grievance route, that route remains available and is not replaced by this contact process.