privacy policy.

At PalHawk (“we”, “us”, “our”), we value the trust you place in us when sharing your contact details, brand strategies, and proprietary business data. We are committed to safeguarding your privacy in compliance with global data protection frameworks including the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).

This Privacy Policy details what information we collect, why we collect it, how it is secured, and your individual rights regarding personal data when visiting our website, commissioning software, or interacting with our atelier team.

We collect information strictly necessary to provide tailored digital design and custom software engineering services:

• Direct Inquiries & Project Briefs: Name, professional email address, company name, telephone/WhatsApp number, project timelines, budget parameters, and technical scope notes submitted through our inquiry modal or WhatsApp channel.
• Client Engagement Data: Billing addresses, corporate registration details, tax identifiers, and payment transaction metadata processed through encrypted merchant providers.
• Automated Telemetry & Analytics: Anonymized browser version, device viewport dimensions, general geographic location (country/city level), referring URLs, and page interaction timestamps to optimize Core Web Vitals and site responsiveness.

We process collected data exclusively for legitimate commercial purposes:

• To formulate customized architectural proposals, milestone roadmaps, and commercial estimates for portfolio sites, e-commerce, custom CRM, billing software, and SEO engagements.
• To execute engineering sprints, coordinate user testing, and deliver production-ready code repositories.
• To provision hosting environments, secure DNS records, and integrate third-party payment gateways.
• To communicate project milestones, invoice updates, and warranty support diagnostics.
• To maintain website security, prevent malicious automated scraping, and ensure compliance with statutory tax accounting requirements.

We recognize that custom CRM databases, billing algorithms, and proprietary e-commerce business models constitute trade secrets.

All client codebases, database schemas, financial transaction logs, and unpublished brand assets are treated with strict confidentiality. Our team operates under mandatory Non-Disclosure Agreements (NDAs).

We never sell, rent, monetize, or broker your personal or enterprise data to third-party advertisers or data brokers under any circumstances.

We employ bank-grade technical and organizational safeguards to protect your personal information against unauthorized access, accidental loss, or alteration:

• Encryption in Transit: All web traffic is strictly enforced over HTTPS utilizing TLS 1.3 cryptographic protocols with modern cipher suites.
• Encryption at Rest: Internal project archives, database backups, and client credentials are encrypted using industry-standard AES-256 encryption.
• Access Controls: Access to sensitive client environments and staging servers is restricted via Multi-Factor Authentication (MFA) and least-privilege role-based access.

We collaborate with vetted, industry-leading infrastructure partners who process data strictly under our instructions and in compliance with GDPR/CCPA standards:

• Cloud Hosting & Edge Delivery: Vercel Inc., Amazon Web Services (AWS).
• Payment Gateways: Stripe Inc. (PCI-DSS Level 1 compliant payment tokenization).
• Direct Communications: Meta Platforms Inc. / WhatsApp Business API (end-to-end encrypted messaging).

Our flagship site utilizes minimal, privacy-centric cookies to maintain session states, track smooth scroll physics, and compile anonymized aggregated performance metrics.

You can modify your browser settings to refuse or delete cookies at any time. Doing so will not restrict your access to core visual showcases or inquiry submissions.

Depending on your jurisdiction (such as the EEA, UK, or California), you possess statutory rights regarding your personal data:

• Right to Access & Portability: Request an export of the personal information we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete records.
• Right to Erasure (“Right to be Forgotten”): Request permanent deletion of your personal contact records, subject to legal accounting retentions.
• Right to Restrict or Object: Object to processing of your data on legitimate interest grounds.

We retain client inquiry records and completed project correspondence for as long as necessary to fulfill the purposes outlined in this policy or comply with applicable legal, tax, and auditing regulations (typically up to seven years for fiscal records). Non-converted prospective client inquiries are purged after 18 months of inactivity.

To exercise any of your data privacy rights, report security concerns, or submit questions regarding this policy, please reach our Data Privacy Officer: