Privacy Policy

Last Updated and Effective: August 16, 2026

Zylon Studio ("we", "our", or "us") is deeply committed to protecting your privacy and ensuring the security of your personal data. This comprehensive Privacy Policy outlines the extensive measures we take to protect your information, the specific types of data we collect, how we process and utilize this data, and the rights you possess regarding your personal information. By accessing, browsing, or utilizing the Zylon Studio digital storefront and associated services (collectively, the "Services"), you acknowledge that you have read, comprehended, and unconditionally agreed to the data practices described in this document.

1. Introduction and Scope

This Privacy Policy applies globally to all visitors, users, and customers of the Zylon Studio website, regardless of geographic location. It encompasses all digital touchpoints operated by Zylon Studio, including our primary web domain, associated subdomains, API endpoints, and our integrated customer service channels, specifically including our direct communication lines via WhatsApp.

The scope of this policy extends to the collection, storage, processing, transfer, and deletion of all Personally Identifiable Information (PII) and non-personally identifiable information generated through your interaction with our Services. If you disagree with any provision of this Privacy Policy, your sole recourse is to immediately discontinue your use of our Services.

2. The Information We Collect

To provide a seamless, bespoke, and premium service, we must collect and process various categories of data. We strictly adhere to the principle of data minimization, collecting only what is absolutely necessary for the fulfillment of our operational obligations. The data we collect includes, but is not limited to:

• Identity Data: First name, last name, username, and social media handles (when interacting with us on social platforms).
• Contact Data: Billing address, delivery address, email address, and telephone/mobile numbers (specifically WhatsApp-registered numbers).
• Financial Data: While we do not process credit cards directly on our website, we may collect records of transaction IDs, bank transfer references, and Mobile Financial Services (MFS) payment receipts.
• Transaction Data: Comprehensive details about payments to and from you, purchase history, specific product customizations, frame selections, and order fulfillment tracking.
• Technical Data: Internet Protocol (IP) address, browser type and version, time zone setting and location, browser plug-in types and versions, operating system, device identifiers, and platform telemetrics.
• Usage Data: Analytical information regarding how you navigate our website, the products you view, the links you click, and the duration of your sessions.
• Communications Data: The entire transcript of your interactions with our customer service team via WhatsApp, email, or direct messaging, maintained for quality assurance and dispute resolution.

3. How We Collect Your Information

We employ a multi-faceted approach to data collection, ensuring transparency at every ingestion point. Your data is collected through the following primary mechanisms:

Direct Interactions: The vast majority of PII we collect is provided voluntarily by you. This occurs when you click "Order Now" and initiate a conversation via WhatsApp, request customer support, or provide feedback. During these direct interactions, you actively provide your Identity, Contact, and Financial Data.

Automated Technologies: As you interact with our digital storefront, we automatically collect Technical and Usage Data utilizing server logs, web beacons, and similar analytical technologies. This automated collection is vital for maintaining the structural integrity of our website, preventing cyber-attacks, and optimizing our server infrastructure (hosted via Vercel).

4. Purpose of Data Collection and Processing

We utilize the information we collect for highly specific, rigidly defined purposes. We will not utilize your data for any ancillary purpose that is incompatible with the original context of collection without obtaining your explicit, prior consent. Our primary processing purposes include:

• Contractual Fulfillment: To register you as a new customer, process your bespoke frame orders, manage financial transactions, and coordinate physical delivery via third-party logistics.
• Customer Relationship Management: To provide technical support, notify you of changes to our Terms or Privacy Policy, and respond to your direct inquiries.
• Platform Optimization: To administer and protect our business and website (including troubleshooting, data analysis, testing, system maintenance, support, reporting, and hosting of data).
• Security and Fraud Prevention: To deploy robust countermeasures against fraudulent transactions, unauthorized access attempts, and malicious cyber activities.
• Legal Compliance: To comply with applicable tax laws, accounting regulations, and lawful requests from governmental or judicial authorities.

5. Legal Basis for Processing Data

For users residing in jurisdictions that mandate a specific legal basis for data processing, we rely on the following pillars:

(a) Contractual Necessity: The processing of your Contact and Transaction data is strictly necessary for the performance of the contract we enter into with you when you purchase a product.
(b) Legitimate Interests: We process Technical and Usage data based on our legitimate business interests in ensuring network security, optimizing user experience, and developing our product lines, provided these interests are not overridden by your fundamental rights.
(c) Legal Obligation: We may process your data to comply with statutory legal requirements.
(d) Consent: Where required by law, we will obtain your explicit consent prior to processing your data for marketing or non-essential analytical purposes.

6. Data Sharing and Disclosure

Zylon Studio operates on a strict policy of confidentiality. We do not, under any circumstances, sell, rent, or lease your Personally Identifiable Information to data brokers, marketing agencies, or unauthorized third parties. However, in order to operate our business efficiently, we must share your data with rigorously vetted, trusted third-party service providers:

• Logistics and Courier Partners: We share your Name, Delivery Address, and Contact Number with nationwide courier services (e.g., Pathao, RedX, Steadfast) strictly for the purpose of executing physical product delivery.
• Infrastructure Providers: Our website and backend databases are hosted on enterprise-grade infrastructure (Vercel and Supabase). These entities process data on our behalf under strict Data Processing Agreements.
• Legal and Regulatory Authorities: We may disclose your information to law enforcement agencies, regulators, or courts if required to do so by law, or if we believe in good faith that such action is necessary to comply with a legal obligation, protect our rights, or investigate fraud.

7. International Data Transfers

While Zylon Studio operates primarily within Bangladesh, our digital infrastructure heavily relies on distributed, global cloud networks. As a result, the data we collect from you may be transferred to, stored at, and processed in destinations outside of your country of residence (such as data centers operated by Vercel or Supabase in the United States or the European Union). By submitting your personal data, you explicitly agree to this transfer, storing, or processing. We take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this Privacy Policy, utilizing standard contractual clauses or relying on adequacy decisions where applicable.

8. Data Security Measures

We have implemented a highly rigorous, multi-layered security architecture designed to prevent your personal data from being accidentally lost, used, or accessed in an unauthorized way, altered, or disclosed. Our databases are secured by Supabase utilizing Row Level Security (RLS) protocols, encrypted in transit using industry-standard Transport Layer Security (TLS/SSL), and encrypted at rest. Access to your personal data is strictly limited to those employees, agents, contractors, and other third parties who have an absolute operational need to know. They will only process your personal data on our direct instructions, and they are subject to severe contractual duties of confidentiality. Furthermore, we have established procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

9. Data Retention Policy

We will only retain your personal data for as long as reasonably necessary to fulfill the purposes for which we collected it, including for the purposes of satisfying any legal, regulatory, tax, accounting, or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure, the purposes for which we process your data, and the applicable legal frameworks. When data is no longer necessary, it is securely and permanently purged from our primary systems and encrypted backups.

10. Your Privacy Rights and Choices

Depending on your geographic jurisdiction, you may be afforded significant and far-reaching rights under comprehensive data protection laws. Regardless of your location, Zylon Studio strives to offer the following capabilities to all our users:

• The Right to Access: You may request a complete export of the personal data we hold about you.
• The Right to Rectification: You may request that we correct any inaccurate or incomplete data.
• The Right to Erasure ("Right to be Forgotten"): You may request the absolute deletion of your personal data, subject to our overriding legal or financial record-keeping obligations.
• The Right to Object: You may object to the processing of your data where we are relying on a legitimate interest as the legal basis.

To exercise any of these rights, please submit a formal, written request to our administrative team. We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data—this is a critical security measure to ensure that personal data is not disclosed to any person who has no right to receive it.

11. Third-Party Integrations and Platforms

Because Zylon Studio utilizes WhatsApp as our primary transaction and customer support terminal, you must recognize that your interactions are fundamentally routed through Meta Platforms, Inc.'s infrastructure. When you engage with our WhatsApp Business account, Meta processes the metadata and content of those communications in accordance with their own extensive Privacy Policy and Terms of Service. Zylon Studio exercises absolutely zero control over Meta's internal data processing algorithms, encryption key management, or corporate data-sharing policies. We heavily advise you to review WhatsApp's privacy documentation to fully understand how your data is handled on their proprietary network before initiating a purchase.

12. Children's Privacy Protection

Our Services are exclusively directed toward individuals who are at least eighteen (18) years of age. Zylon Studio does not knowingly, intentionally, or purposefully collect personal information from children under the age of 13 (or higher age thresholds as defined by local law). If you are a parent or guardian and you believe that your child has provided us with Personally Identifiable Information without your consent, please contact us immediately. If we become aware that we have collected personal data from a child without verification of parental consent, we will take immediate and aggressive steps to purge that information from our servers completely.

13. Automated Decision-Making and Profiling

Zylon Studio does not utilize your personal data for automated decision-making processes or aggressive behavioral profiling that would produce legal effects concerning you or similarly significantly affect you. Our operations rely on human-led customer service interactions and manual artisanal curation.

14. Changes and Updates to This Privacy Policy

The digital landscape and data protection regulations are constantly evolving. As such, Zylon Studio reserves the unilateral right to update, radically alter, or completely rewrite this Privacy Policy at any given moment. Any changes will be published directly to this URL, and the "Last Updated" timestamp at the apex of this document will be amended accordingly. We strongly encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your data.

15. Contact Information

If you have any detailed inquiries, data subject access requests, or require profound clarification regarding this Privacy Policy, please contact our Data Protection Office directly at:

Zylon Studio - Data Protection Office
Email: privacy@zylons.me
WhatsApp: +880 1742-792928