Kindredd Studio is a small studio - no marketing team, no ad network. The short version of this policy: I collect only what I need to build your project, I keep it in well-known tools, the one analytics tool I use only loads if you say yes, and you can ask to see, correct, or delete anything at any time.
What I collect
Brief submissions.When you fill in the brief form, I collect your name, email address, company (if you give one), a description of your project, and any attachments you upload. These are stored in Supabase (the studio's database). Only I (Chinazo) read them.
Project rooms.Once a project starts, your project room collects the messages we send each other, screenshots and file uploads, quotes, deliveries, and a log of actions like "approved" or "requested a change". All of it lives in the same Supabase database, scoped so that only you and the studio can see it.
Payments. Card details go directly to PayFast. Kindredd Studio never sees, touches or stores card numbers. What I do keep is the record of which invoices were paid, when, and for how much, which is required for tax.
WhatsApp. If you message the studio on WhatsApp, I keep the messages you send, any images or documents you attach, your WhatsApp phone number and display name, and the delivery receipts WhatsApp returns (sent, delivered, read). This lets me answer you, quote for work, and remind you about a payment in the same thread you started. It sits in the same database as the rest of your project, and only I read it.
Your number is used to suggest which client you are. I confirm that match by hand before it is linked to your account, because phone numbers get recycled and shared.
Reply STOP at any time and I will stop sending you WhatsApp messages. That is recorded the moment it arrives and is never quietly undone. Unsubscribe, cancel, end, quit and opt out do the same thing. You keep your email and portal access, so nothing about your project is affected.
Cookies, analytics, and advertising. The site uses a single session cookie for sign-in (provided by Supabase Auth). On top of that, if you click Sure, that's fineon the banner at the bottom of the page, the site will load analytics and advertising scripts so I can see which pages are useful and reach you with relevant ads on the platforms where I advertise. Decline (or close the banner) and none of those scripts load - the only cookie on the site is the sign-in one. Your choice is stored in your browser's local storage (not a cookie) and you can revisit it anytime by clearing site data.
Specifically, with consent, the site loads: Google Analytics 4(page views, engagement, sources), Meta Pixel (Facebook and Instagram ad measurement and retargeting), TikTok Pixel,LinkedIn Insight Tag, and the X (Twitter) Pixel. Each of these may set its own cookies and may share aggregated data with its parent ad platform for the purpose of measuring ad effectiveness and showing you relevant ads. None of it is sold to third parties unrelated to the ad platforms themselves.
Third parties I rely on
- Supabase - database and authentication.
- Resend - sending transactional email (quote notifications, delivery emails).
- PayFast - payment processing.
- Google - OAuth (only if you choose "sign in with Google"), and Google Analytics + Google Ads (only with cookie consent).
- Meta (Facebook, Instagram, WhatsApp) - advertising pixels on Facebook and Instagram, loaded only with cookie consent and used for ad measurement and retargeting; and the WhatsApp Business Platform if you message the studio on WhatsApp, which Meta processes and delivers under its own terms.
- TikTok, LinkedIn, X (Twitter) - advertising pixels, loaded only with cookie consent. Used for ad measurement and retargeting on those platforms.
- Vercel - hosting the site and the portal.
Each of these has its own privacy policy, and each is contractually bound to protect the data I send them. I don't sell, rent, or share your data with anyone else.
How long I keep it
Project data (briefs, messages, files, deliveries) is kept for three years after a project completes, in case you come back wanting changes or copies of old work. After that I'll delete it on request - and you can ask sooner if you prefer. Financial records (invoices, payment confirmations) are kept for five years because South African tax law requires it. WhatsApp conversations follow the same three-year project rule. An opt-out record is kept indefinitely, because it is the only way to be sure you are not messaged again by mistake.
Your rights
You can ask, at any time, for:
- A copy of the data I hold about you.
- A correction if any of it is wrong.
- Deletion of data that I'm not legally required to keep.
- An export of your project files in a portable format.
Email hello@kindreddstudio.comand I'll respond within one working day. This policy is aligned with South Africa's POPIA and is compatible with the GDPR for international clients.
Children
The service isn't designed for people under 18. If you're under 18, please don't submit a brief - ask a parent or guardian to do it on your behalf.
Security
Connections to the portal are encrypted in transit. Data at rest is held in Supabase's managed Postgres, with row-level security so that one client can't read another client's data. Backups are encrypted. If a breach ever affects your data, I'll tell you directly and promptly.
Questions, complaints, or privacy requests
Email hello@kindreddstudio.com. If you're in South Africa and you're not satisfied with how I've handled a complaint, you can also contact the Information Regulator (South Africa).