Privacy
What this site records, and why
Short version: a random identifier in a cookie, the pages you read, and whatever you type into an enquiry. No advertising trackers, no data sold, no third-party analytics.
This page describes the actual behaviour of this website, not a template. If something here is unclear or looks wrong, message the bot and it will be corrected — a privacy notice that has drifted from the code is worse than none, because it is a documented false statement.
The session cookie
On your first visit the site sets one cookie, __tps_sid. It contains a 22-character random string and nothing else. No name, no email, no fingerprint. It is marked HttpOnly and Secure, so it cannot be read by JavaScript in your browser or sent over an unencrypted connection, and it expires after 90 days.
It exists for one reason. If you decide to send an enquiry, it opens in Telegram, and a Telegram deep link can carry only 64 characters. Without an identifier to look up, an enquiry would arrive with no idea which pages prompted it — which means answering you with a generic reply instead of a useful one. That is the whole purpose: carrying your own enquiry from the page you were reading to the conversation you chose to start.
For that reason it is treated as strictly necessary and set without asking. Anything beyond it sits behind a consent choice.
What is stored against that identifier
- Pages
- Which pages you opened, in order, with how long you spent and how far you scrolled.
- How you arrived
- The referring website or campaign tag, both for your first visit and your most recent one.
- Device
- Phone, tablet or desktop. Derived from your browser’s user agent, not stored raw.
- Country
- A two-letter country code supplied by the content network. Not a city, not a location.
- Which button
- Which call to action you clicked, if you clicked one.
Your IP address is not stored. It is combined with a secret value and hashed, and only that hash is written, so repeated submissions can be rate-limited without keeping anything that identifies you or your connection.
What happens when you send an enquiry
What you type — your name, your Telegram handle or phone, an email address if you supply one as a backup, and your message — is stored, then delivered as a message into a private Telegram group used by the team. The session record above is attached so that whoever replies knows what you were reading.
If the delivery fails, the enquiry is retried and, if it still fails, flagged for a human. It is never discarded. This means a copy exists in the database independently of Telegram.
Who else sees it
Three processors, each doing one job: Cloudflare hosts the site and the database and provides the anti-abuse check on the form; Telegram delivers and stores the messages; and nothing else. There is no advertising network, no Google Analytics, no session recorder, no data broker, and none of this is sold or shared for anyone else’s marketing.
How long it is kept
- Browsing sessions and page paths: 12 months, then deleted.
- Enquiries and the messages attached to them: 36 months, because they are business records.
- Rate-limiting counters: 24 hours.
Your rights
Under the UAE Personal Data Protection Law, and under the GDPR if you are in the EU or UK, you can ask what is held about you, ask for it to be corrected, ask for it to be deleted, or object to it being processed. Message the bot, or use the address on the contact page, and you will get an answer within 30 days. You do not need to give a reason to have your data deleted, and asking will not affect any work in progress.
The legal basis for the session identifier and enquiry handling is legitimate interest in responding to people who contact us, and performance of a contract once work begins. Anything optional is consent, and consent can be withdrawn at any time.
Changes
If this changes, the change is made here first and the site is updated in the same release, so the description and the behaviour ship together. See also the terms for how engagements work, and about for who is behind this.