HomePrivacy Policy

Privacy Policy

Last updated: July 28, 2026 · Effective immediately

Digital Agency Flow ("we", "us", "our") is committed to protecting your personal data and privacy. This policy explains what information we collect, how we use it, and the rights you hold over your data. By using our platform, you agree to the practices described below.

Information We Collect

Account information you provide during registration: name, email address, company name, and phone number.
Project and service request data you submit through the client portal including briefs, uploaded files, and messages.
Payment information processed securely through Stripe and Nepal bank transfer — we do not store raw card data.
Usage data such as pages visited, features used, session duration, and browser type for performance analytics.
Communication records including emails, support tickets, and chat messages exchanged with our team.

How We Use Your Information

To provision and manage your client portal account and authenticate your identity securely.
To deliver, coordinate, and track the digital services and sprint milestones you have contracted.
To send transactional emails such as welcome emails, invoice receipts, project updates, and OTP codes.
To generate AI-powered project estimates and scope analyses based on your submitted requirements.
To improve our platform, analyze usage patterns, and optimize the overall client experience.
To comply with applicable laws, resolve disputes, and enforce our service agreements.

Data Security

All data is transmitted over HTTPS/TLS encrypted connections. Passwords are hashed using bcrypt with salted rounds.
Your database records are stored on MongoDB Atlas with VPC network peering and IP whitelisting.
OTP codes for password resets are single-use, expire in 15 minutes, and are never stored in logs or API responses.
We conduct regular security audits and follow OWASP best practices across all API endpoints.
Access to production databases and client data is restricted to authorized personnel only via role-based access control.

Third-Party Services

Stripe — Payment processing. Your card data is handled directly by Stripe under PCI-DSS Level 1 compliance.
MongoDB Atlas — Cloud database hosting on AWS infrastructure with end-to-end encryption at rest.
Google (Gmail/SMTP) — Transactional email delivery via Nodemailer using secure App Passwords.
Vercel — Frontend hosting and edge network. Your IP and request data may be processed by Vercel.
We do not sell, rent, or broker your personal data to any third-party advertising or data brokerage companies.

Your Rights

Right to Access: You may request a full export of all personal data we hold about you at any time.
Right to Correction: You can update your name, company, and phone number directly in Account Settings. Email cannot be changed for security reasons.
Right to Deletion: You may request complete account deletion and data erasure by contacting us via email.
Right to Portability: We will provide your project data, deliverables, and account records in a machine-readable format upon request.
Right to Object: You may opt out of non-transactional communications at any time via the unsubscribe link in our emails.

Contact & Inquiries

For privacy-related inquiries, data access requests, or deletion requests, contact us at: dpworldsharma@gmail.com
Our Data Protection Officer (DPO) is Chandan Sharma, Strategic Director at Digital Agency Flow.
We will respond to all verified data requests within 7 business days.
For urgent security concerns or suspected data breaches, use the subject line: SECURITY URGENT.

🍪 Cookies & Local Storage

We use browser localStorage to maintain your login session and user preferences. No third-party tracking cookies are used. You may clear site data from your browser settings at any time to remove all stored session data.

Jurisdiction & Governing Law

This Privacy Policy is governed by the laws of Nepal and applicable international data protection regulations including GDPR principles for EU/EEA users. Any disputes shall be subject to the exclusive jurisdiction of courts in Kathmandu, Nepal.

Questions about this policy?