Your data, handled with care.

1. What we collect

• Account details: your name, e-mail address and password (stored only as a salted hash). With Google or Facebook sign-in we receive your name, e-mail address, the provider’s user ID and, if available, your profile picture — never your password.
• Optional profile details you choose to add: photo, company, role, website and a short bio.
• Order details: the service and package, your brief, deadline, reference links, files you attach, messages you exchange with the studio, and order status history.
• Payment confirmation from PayPal: the amount, PayPal order and transaction IDs, the payer e-mail PayPal reports and the time of payment. We never receive or store card numbers.
• Technical data needed to run the site safely: IP address (used for rate limiting and abuse prevention), browser type and timestamps in server logs.
• Assistant chats: questions typed into the website assistant and, if the AI assistant is enabled, the recent conversation sent to the AI provider the studio uses to generate a reply.

2. Why we use it

• To create and secure your account and let you log in.
• To deliver the service you ordered: quotes, progress updates, messages, deliveries, invoices and receipts.
• To send order-related e-mails (order received, payment received, quote ready, delivered, completed) and account e-mails (welcome, password reset). We do not send marketing e-mails without asking you first.
• To improve the website and your experience, using aggregated, non-identifying information.
• To prevent fraud and abuse, and to meet legal and accounting obligations.

3. Cookies

The site uses only essential cookies: a session cookie when you log in, a private conversation cookie that lets the browser you ordered from see its orders for 30 days, and a short-lived cookie during Google/Facebook sign-in. A browser setting remembers your preferred currency for displayed prices. There are no advertising or cross-site tracking cookies.

4. Who can see your data

• Only Ashir Khan (the studio owner) can read your orders, files and messages, through a password-protected studio with optional two-step verification.
• PayPal processes payments under its own privacy policy. Google and Facebook handle sign-in under theirs. If the AI assistant is enabled, assistant questions are processed by the configured AI provider.
• The website runs on a virtual server hosted by Hostinger. Data is stored there in an encrypted-in-transit (HTTPS) environment with regular backups.
• We never sell your data and do not share it with advertisers.

5. How long we keep it

• Account and order records are kept while your account exists and for as long as needed for accounting and legal purposes (invoices and receipts are typically kept for 7 years).
• Unpaid, unconfirmed orders are removed automatically after three days.
• Uploaded delivery and reference files are kept with the order; you can ask us to delete them once the order is complete.

6. Your choices and rights

• You can view and update your profile at any time from your dashboard, change your password, and sign out of all devices.
• You can ask for a copy of your data, or for your account, messages and files to be deleted, by messaging the studio or e-mailing info@ashflick.com. We answer within 30 days. Some order and payment records may need to be kept for accounting.
• If you are in the EU/UK you have the rights under the GDPR/UK GDPR, including the right to complain to your data protection authority.

7. Security

Passwords are hashed with scrypt, sessions are HttpOnly secure cookies, every request is protected by HTTPS, uploads are type-checked and size-limited, and requests are rate-limited. No system is perfectly secure; if we learn of a breach affecting your data we will inform you without undue delay.

8. Changes and contact

We may update this policy; the current version is always at www.ashflick.com/privacy with its effective date. Contact: Ashir Khan, Ashflick, Islamabad, Pakistan — info@ashflick.com or the contact page.