Privacy Policy

Who we are

The Right Hand Digital is a software and digital services studio based in Pakistan. For all activities described on this page, we act as the data controller. In everyday terms, that means we make the decisions about what information is collected across our site and why.

If you have questions about how we handle information, send a message to contact@therighthand.digital. If you need our registered business postal address, email that same address and we will provide it right away.

What this policy covers

This policy applies strictly to our public website. It explains what happens when you visit our pages, send an inquiry, book a discovery session, or apply for an open job.

It does not cover our technical deliverables for clients. Whenever we build, deploy, or maintain digital products for our clients, those clients decide what data is collected. We simply follow their project instructions, and our client services agreement governs that relationship.

What we collect and when

We believe in privacy by default. We do not gather any information about you simply for reading our website. You will not find third party tracking scripts, tracking pixels, or marketing beacons anywhere here. Our strict content security policy blocks unauthorized outside connections from loading in your browser.

We only receive personal information when you decide to send it to us.

When you submit an inquiry

Our contact form gathers your name, your email address, your phone number, and a brief description of your project. Supplying a company name is completely optional.

When you book a consultation

To schedule time with our engineering team, we request your name, your email address, your phone number, your estimated budget, your target launch timeline, your preferred consultation topics, any additional project notes, and your chosen calendar slot. Adding your organization name remains optional.

When you apply for a position

We ask for your name, your email address, your phone number, your current city or region, your professional experience level, your required notice period, your written answers to role questions, and your uploaded CV. You may optionally share your online portfolio, your LinkedIn profile, your compensation expectations, your core tech stack, how you found us, your preferred work setup, and a basic statement confirming your right to work.

Every applicant must actively confirm consent before sending an application. Our backend database requires this explicit confirmation before it accepts the submission.

When you send any form

Our servers record the IP address used during submission. This single detail helps us block automated spam runs and avoid server abuse. Our background workers automatically wipe these logged addresses after two hours.

When staff use the internal dashboard

A limited number of internal team members can sign into our administrative dashboard. For those team members, we store an essential session cookie to manage active logins along with an audit record of administrative tasks. That audit trail tracks which account performed an action, but it never logs the actual contents of modified records.

What we do not collect

We do not place tracking cookies on public site visitors. You can read every article and public page without setting off persistent trackers.

Why we can handle your information

• To reply to your questions: When you send an inquiry or book a meeting, we use your details to answer you and carry the project conversation forward. This handles steps you explicitly asked us to take.
• To assess job candidates: When you apply for a job, we review your resume and answers to see if our team is the right home for your talents. We rely on the explicit consent you grant upon applying, which you can withdraw whenever you want.
• To protect our infrastructure: Using IP addresses to prevent bot spam and auditing administrative logins represent our legitimate interests in keeping our software safe and dependable.
• To comply with statutory duties: Certain transaction and communication records must stay on file to fulfill regional accounting, corporate, and tax regulations.

How long we keep your information

• Job applications and uploaded CVs: Kept for six months after your submission date, then permanently cleared from our cloud records. If we wish to retain your resume for future opportunities, we will ask for your consent beforehand.
• Inquiries and consultation notes: Kept for twenty-four months following your most recent communication with our team. These provide a sensible record of our commercial conversations.
• Form rate limiter IP logs: Deleted automatically after two hours.
• Internal administrative audit trails: Retained for ninety days before scheduled purging.

If a project conversation turns into a signed client partnership, all related business records follow our statutory commercial recordkeeping retention periods.

Who processes your information

We partner with a small, carefully chosen group of cloud service providers. Each vendor processes data strictly under our directions and cannot use it for secondary purposes.

• Supabase: Manages our encrypted database and secure cloud object storage for incoming inquiries, meeting bookings, job applications, and uploaded candidate CVs.
• Vercel: Hosts our web application front end and maintains standard server operational logs.
• Resend: Delivers transactional email alerts to our team whenever someone fills out a contact or booking form.
• Cloudflare: Provides real time bot protection by analyzing technical browser headers and IP signals before forms process.

We do not sell your personal data to anyone, and we never share it with outside advertisers or broker platforms.

International data transfers

Because our infrastructure providers maintain data centers in multiple regions around the world, your information may be routed or held on secure servers outside Pakistan. We only choose vendors that uphold rigorous data safety standards, including recognized standard contractual clauses and robust data processing addendums.

Your privacy rights

Our core standard is Pakistani data protection law, but we extend comprehensive privacy rights to everyone who contacts us, wherever you live. This includes all protections guaranteed under the GDPR in the United Kingdom and the European Union.

• Review: You can ask to see the personal information we hold about you.
• Correction: You can ask us to fix any inaccurate or out of date records.
• Deletion: You can request that we wipe your information completely. For job applicants, we honor this without hesitation or conditions.
• Revocation: You can withdraw any consent you granted earlier.
• Objection: You can object to or ask us to restrict how we process your records.
• Portability: You can request a readable digital export of your stored personal details.
• Complaints: You have the right to register concerns directly with our team, or with your national data protection regulator if one exists in your area.

To exercise any of these rights, email us at contact@therighthand.digital. We will fulfill your verified request within thirty days. We never charge administrative fees for requests, and we will never ask you to justify your decision.

If your request relates to an employment application, sending your note to careers@therighthand.digital reaches the same review team.

Keeping your data safe

• Uploaded resumes go straight into private cloud storage buckets. There are no public web links. Team members can only view an uploaded CV by generating a temporary signed link that expires quickly.
• Every database table blocks traffic by default, granting access only through explicit, role based authorization rules.
• Administrative accounts require two factor authentication, and inactive dashboard sessions sign out automatically.
• Key system actions create permanent audit trails.
• All site traffic runs over encrypted HTTPS alongside an aggressive content security policy.

While no digital system is completely immune to risks, we prefer using practical, layered security over making empty promises.

Data incidents and notifications

If a security event ever compromises personal information under our care, we will quickly investigate, isolate the issue, notify the individuals affected when required, and inform applicable authorities according to legal timelines.

Children

Our website and services are made for businesses and working professionals. We do not build services for anyone under sixteen years of age, and we do not knowingly gather details from children. If you believe a minor has shared personal data with us, contact us so we can erase it immediately.

Policy updates

Whenever we adjust what we collect or update our operational practices, we will post the revised wording on this page and refresh the effective date at the top.

Contact

You can reach us anytime at contact@therighthand.digital. A member of our team will respond to you directly