The short version
We collect the details you enter into the contact form or the project estimator, and a count of which pages get read. There are no cookies on this site, no advertising pixels, and no third-party analytics — no Google Analytics, no Tag Manager, nothing that follows you to another site. Nothing is sold, rented, or shared for marketing.
Xtenzium is a digital agency based in Karachi, Sindh, Pakistan, and is the controller of the data described here. Reach us about anything on this page at contact@xtenzium.com.
What we collect
- Contact form
- Your name, email address, and message, which are required; and your company, budget range and the service you are asking about, which are optional and blank unless you fill them in.
- Project estimator
- Your email address, the four answers you selected, and the range the estimator produced. The answers are ranges and categories rather than anything identifying — the estimator asks nothing about you until it has already shown you a number.
- Page analytics
- Which pages are viewed, how far down them people read, which outbound links get clicked, and whether a form was started and finished. It is recorded by us, into our own database, and never leaves it.
Each visit is tagged with a random identifier generated in your browser and held in session storage. It is not a cookie, it is not derived from anything about you, and it is discarded when you close the tab — so the same browser tomorrow is a new visit and cannot be connected to this one. It exists so that ten pages read by one person are not counted as ten people.
If you send an enquiry, that identifier is stored alongside it, which is how we learn which pages lead to conversations. That link is only as durable as the session it came from.
If your browser sends a Do Not Track or Global Privacy Control signal, none of this runs at all. Neither signal legally binds us here; ignoring an explicit request while claiming to be the privacy-respecting option is not a position worth holding. - Server logs
- Our host records ordinary request information, including IP address, browser user agent and the page requested. This is standard web server logging, used to keep the site available and to investigate abuse. We do not build profiles from it.
We do not ask for, and have no use for, special category data — health, political opinions, biometrics and the rest. Please do not send it through these forms.
Why we hold it
To reply to you. An enquiry is a request to be contacted back, and the details you send are used to answer it and to carry on that conversation — quoting, scoping, and delivering work if it gets that far. In data protection terms this is our legitimate interest in responding to people who deliberately contact a business, and the steps necessary before entering a contract at your request.
We do not send marketing email. If that ever changes, it will be something you opt into rather than something you are enrolled in by having once made an enquiry.
Where it goes
Form submissions are stored in a Supabase database that only we can read — the public site can write an enquiry and cannot read any of them back. Access is limited to the people at Xtenzium who need it to reply to you.
Three third parties are involved in running this site:
- Supabase — the database that stores enquiries, acting as our processor.
- Vercel — hosting and delivery, which involves the server logging described above.
- Google Fonts — the site loads three typefaces from Google's servers, which means your browser makes a request to Google and your IP address is visible to them as part of it. No cookie is set by this and we receive nothing from it, but it is a request to a third party and you are entitled to know it happens.
Xtenzium is in Pakistan, so an enquiry sent from the UK or the EU involves a transfer outside that jurisdiction. If you would rather not use the form for that reason, email is fine, and so is asking us to delete the record after we have replied.
Cookies and browser storage
This site sets no cookies. There is no consent banner because there is nothing to consent to.
Three things are kept in your browser's session storage:
- How far down each page you had scrolled, so the back button returns you where you were. This never leaves your device.
- Whether you have dismissed the prompt that appears once when leaving, so it does not appear again. This never leaves your device either.
- The random visit identifier described above, which is the one thing in this list that is sent to us.
All three are cleared when you close the tab. None of them is a cookie, and none is readable by any other site.
How long we keep it
Page analytics are pruned after 90 days. The aggregate — which pages get read, which lead to enquiries — is what has value after that, and holding the raw rows longer is a liability rather than an asset.
Enquiries are kept while the conversation is live and for as long as we may reasonably need them afterwards — a project has a history, and deleting the enquiry that started it makes that history incomplete. Records that went nowhere are reviewed and cleared periodically. If you want yours removed sooner, ask, and we will.
Your rights
You can ask us for a copy of what we hold about you, ask us to correct it, ask us to delete it, or object to us holding it at all. If you are in the UK or the EU, those rights come with a statutory deadline and we will answer inside it; if you are elsewhere, we will do the same thing anyway because there is no good reason not to.
One email to contact@xtenzium.com is enough. We do not require a form, and we will not make it difficult.
If you are in the UK or the EU and think we have handled your data badly, you have the right to complain to your national data protection authority. We would rather you told us first so we can fix it.
Changes
If this policy changes, the date at the top of the page changes with it. A material change to how we handle enquiries will be described here rather than quietly folded in.