Data Controller
KRATIVFORM is an independent strategic digital studio. For all inquiries submitted through krativform.com, the data controller is:
Lead Architect & Founder: Asfak Ahamed Chowdhury
Primary Contact: studio@krativform.com
Jurisdiction: Dhaka, Bangladesh
Purpose of Data Processing
We collect information exclusively when you voluntarily submit a project inquiry via our strategic inquiry form or via direct electronic mail. The purposes are strictly bounded to:
- Architectural & Technical Evaluation: Assessing your operational challenge, software stack compatibility, timeline feasibility, and project requirements.
- Direct Correspondence: Communicating directly regarding your inquiry, clarifying scope, and scheduling an initial architectural conversation.
- Abuse & Denial-of-Service Defense: Ensuring infrastructure resilience through client rate limiting and automated spam prevention.
Notice: We do NOT operate marketing email newsletters, third-party advertising retargeting, nor do we sell, rent, or trade client information to any third-party broker under any circumstances.
Data Scope & Retention Schedules
| Data Field | Classification | Retention Window |
|---|---|---|
| Name & Business Email | Contact Identity | 12 months from last interaction (if uncontracted) |
| Organization & Timeline | Project Metadata | 12 months from last interaction |
| Project Brief / Message | Confidential Correspondence | 12 months (or purged immediately on request) |
| IP Audit Hash (SHA-256) | Security Telemetry | Rotated and purged within 30 days |
Inquiries that do not materialize into an active engagement are routinely archived and permanently purged after 12 months.
Data Subject Access & Deletion Process
You retain full rights to inspect, update, or permanently delete any personal information transmitted to KRATIVFORM.
Send an email from the address used in your original inquiry to:
Include the subject line: [Data Deletion Request] along with your inquiry reference ID or business email. Deletion requests are processed manually within 5 business days, permanently removing records from our Supabase database.
Authorized Technical Sub-Processors
To host and deliver reliable digital infrastructure, we engage select industry-standard processors subject to strict technical isolation:
Stores encrypted inquiry records. Protected by Row Level Security (RLS) preventing all anonymous public read/write access. Accessible strictly through authenticated server-side service roles.
Executes Next.js App Router edge and serverless functions, serving SSL/TLS encrypted connections across global point-of-presence caches.
Security Architecture
In alignment with KRATIVFORM core engineering principles, security is treated as an architectural baseline rather than an afterthought:
- No Client-Side Credentials: The database service role key is strictly isolated in server environments and never bundled in client JavaScript.
- RLS Enforcement: Direct SQL queries from browser clients are revoked at the Postgres catalog level.
- Input Sanitization: All payloads are stripped of markup and validated against strict type schemas before storage.
- Zero Client Tracking: We do not load Google Analytics, Meta Pixels, or cookie trackers.
Questions about your data?
Reach out directly to studio leadership for data access requests, deletion verifications, or security audits.