Privacy Policy

LoomaDev ("LoomaDev," "we," "us," or "our") is a web development and UI/UX design agency based in Islamabad, Pakistan. This Privacy Policy explains what information we collect through loomadev.com (the "Site"), why we collect it, and how you can control it. By using the Site, you agree to the practices described below.

1. Information We Collect

We collect information in two ways: what you give us directly, and what's collected automatically.

Information you provide

When you submit our contact form, we collect:

• Your name and email address
• Your phone number, if you choose to provide it
• The service you're enquiring about and your budget range
• Your project description and any other details you include in your message

We use this solely to respond to your enquiry. We don't ask for payment details, passwords, or any other sensitive information through the contact form.

Information collected automatically

We use Google Analytics to understand how visitors use the Site, page views, approximate location (city/country level), device type, browser, and time on page. Google Analytics sets its own cookies to do this. These analytics cookies are not loaded until you accept them via the cookie banner shown on your first visit. If you decline, or ignore the banner, no Google Analytics cookies are set and no analytics data is collected. You can change your mind at any time by clearing this site's cookies in your browser, and you can additionally use the Google Analytics Opt-out Browser Add-on.

2. How We Use Your Information

• To respond to your project enquiry and follow up by email, phone, or WhatsApp
• To send a confirmation email when you submit the contact form
• To understand which pages and services visitors are most interested in, so we can improve the Site
• To meet legal or accounting obligations, where applicable

We don't sell, rent, or trade your personal information to third parties for marketing purposes.

3. Who We Share Information With

We use a small number of trusted service providers to run the Site and respond to enquiries:

• MongoDB Atlas — stores contact-form submissions securely in our database.
• Email/SMTP provider — delivers the notification and confirmation emails triggered by the contact form.
• Cloudinary — hosts images used in our blog content.
• Google Analytics — provides anonymized, aggregate traffic analytics.
• Vercel — hosts and serves the Site itself.

Each of these providers only receives the minimum data needed to perform their function, and none are permitted to use your information for their own marketing.

4. Cookies & Consent

Analytics cookies (via Google Analytics) are non-essential and are only set after you actively accept them through the cookie banner. Until you accept, no analytics cookies are placed. If you log into our admin dashboard, a single strictly-necessary authentication cookie is set to keep you signed in — this is not used for tracking, does not require consent, and is not set for ordinary visitors.

5. Lawful Basis for Processing (UK/EU GDPR)

Where the UK GDPR or EU GDPR applies, we rely on the following lawful bases for each processing activity:

• Responding to your enquiry — steps taken at your request before entering a contract (Article 6(1)(b)) and our legitimate interests (Article 6(1)(f)) in answering and following up on business enquiries.
• Sending the contact-form confirmation email — legitimate interests in confirming we received your message.
• Analytics cookies (Google Analytics) — your consent (Article 6(1)(a)), given via the cookie banner and withdrawable at any time.
• Meeting legal or accounting obligations — compliance with a legal obligation (Article 6(1)(c)) where applicable.

You can object to processing based on legitimate interests, and withdraw consent for analytics, at any time (see Your Rights below). This section is provided for transparency and should be reviewed by a qualified privacy professional for your specific circumstances.

6. Data Retention

We retain contact-form submissions for as long as needed to respond to your enquiry and maintain a record of past leads, generally up to 24 months, after which they're periodically deleted. You can request earlier deletion at any time (see Section 8).

7. Data Security

Submissions are transmitted over HTTPS and stored in an access-controlled database. Admin access to lead data is restricted to authorized LoomaDev team members via password- and role-protected accounts. No method of transmission or storage is 100% secure, but we take reasonable, industry-standard steps to protect your information.

8. Your Rights

Depending on where you're located, you may have the right to:

• Request a copy of the personal information we hold about you
• Ask us to correct inaccurate information
• Ask us to delete your information
• Object to or restrict how we use your information

To exercise any of these rights, email us at info@loomadev.com. We'll respond within a reasonable timeframe.

9. Children's Privacy

The Site is intended for businesses and professionals. We don't knowingly collect information from anyone under 16. If you believe a child has provided us with personal information, contact us and we'll remove it.

10. International Visitors

LoomaDev is based in Pakistan and serves clients worldwide, including the US, UK, UAE, and Canada. By using the Site, you understand that your information may be processed and stored in Pakistan or in the countries where our service providers (listed in Section 3) operate.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal reasons. The "Last updated" date at the top of this page will always reflect the latest revision.

12. Contact Us

Questions about this Privacy Policy or how we handle your data? Email us at info@loomadev.com or visit our contact page.