Last updated
Privacy Policy
This Privacy Policy explains how Vansoov Tech LLC (“Vansoov Tech”, “we”, “us”) collects, uses and protects personal data when you visit vansoov.com (the “Site”), contact us, or work with us as a client, prospect, partner or job applicant. It also describes how we handle data that clients entrust to us when we manage advertising, cloud infrastructure or software on their behalf.
1. Controller and contact
The controller of personal data described in this policy is Vansoov Tech LLC. For any privacy question or request, email hello@vansoov.com with “Privacy” in the subject line.
2. Data we collect
Contact form and email. When you write to us through the Site or by email we receive your name, email address, the service you selected, your message, the language of the page you used, and any information you choose to include. The form has a hidden anti-spam field; we do not store its content.
Business relationship. When you become a client or supplier we collect the contact details of the people we work with (name, role, work email and phone), contract and billing information, correspondence, meeting notes and project records.
Access credentials. During an engagement we may hold access to your advertising, analytics, cloud, source-code and other accounts. We store credentials in a password manager with multi-factor authentication, use named accounts where the platform allows it, and remove our access when the engagement ends.
Technical data. Our hosting provider, Cloudflare, records standard server logs (IP address, user agent, requested URL, timestamp, referrer) to serve the Site and protect it from abuse. We do not combine these logs with other data about you.
Job applications. If you apply to work with us we collect your CV, portfolio and correspondence.
We do not knowingly collect data from children under 16. The Site is intended for businesses.
3. Cookies and tracking on this Site
The Site does not set first-party cookies and does not currently load analytics or advertising trackers. Fonts and scripts are served from our own domain. Cloudflare may set strictly necessary cookies for security and bot protection; they do not track you across sites.
If we add analytics or advertising tools to the Site in future (for example Google Analytics 4, Google Ads conversion tracking or the Meta Pixel), we will update this policy, display a consent banner where the law requires it, and load those tools only after consent. You can also limit such tools through the settings and opt-out pages listed in section 6.
4. Why we use data and on what legal basis
| Purpose | Data | Legal basis |
|---|---|---|
| Replying to your enquiry and preparing a proposal | contact-form and email data | pre-contractual steps at your request; legitimate interest |
| Delivering services, invoicing, support | business relationship data, credentials | performance of a contract |
| Keeping the Site secure and available | technical data | legitimate interest |
| Accounting, tax and legal obligations | contract and billing data | legal obligation |
| Portfolio, case studies, references | client name and project description | consent (given in writing) |
| Recruitment | application data | pre-contractual steps; legitimate interest |
We do not sell personal data and do not use it for automated decisions that have legal effects on you.
5. Data we process on behalf of clients
Much of the personal data we touch belongs to our clients’ customers, not to us. Examples: customer lists uploaded as advertising audiences, e-commerce orders during an integration, CRM records during a migration, or user accounts in a system we build or host for a client. For this data the client is the controller and we are a processor. We process it only on the client’s documented instructions, only to deliver the agreed work, and under the data-protection clauses of our Terms or a separate data processing agreement. Requests about that data should be sent to the client concerned; we will help them respond.
Google platforms. When a client grants us access to Google Ads, Google Analytics, Google Tag Manager, Google Merchant Center, Google Search Console, Google Cloud or the Google APIs, our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use that data only to provide and improve the services the client asked for, do not sell it, do not use it for advertising unrelated to the client, and do not allow humans to read it except with the client’s consent, for security purposes, or where required by law.
Meta platforms. When a client grants us access to Meta Business Manager, ad accounts, pages, pixels or the Conversions API, we act on the client’s behalf under the Meta Business Tools Terms and the Meta Platform Terms. Customer data used for custom audiences is hashed before upload where the platform supports it and is used only for the client’s own campaigns.
6. Advertising and analytics tools we use in client work
As an advertising agency we configure tools on client websites that collect data about their visitors, typically Google Analytics 4, Google Ads conversion tracking and remarketing, Google Tag Manager, Google Consent Mode, the Meta Pixel and the Meta Conversions API. What those tools collect is described in the client’s own privacy policy and in the platforms’ policies:
- Google: how Google uses data from sites and apps that use its services, at policies.google.com/technologies/partner-sites. Opt out of Google Analytics with the browser add-on at tools.google.com/dlpage/gaoptout and manage ad personalisation at adssettings.google.com.
- Meta: data policy at facebook.com/privacy/policy and ad preferences at facebook.com/ads/preferences.
- Industry opt-outs: youronlinechoices.eu (EU), optout.aboutads.info (US).
We advise clients on the consent notices these tools require, but each site owner remains responsible for their own compliance.
7. Who we share data with
We share personal data only with providers who help us run the business, under contracts that restrict them to our instructions:
- Cloudflare — hosting, DNS and the serverless function that delivers the contact form (US and global edge network).
- Resend — transactional email that forwards contact-form submissions to our inbox (US).
- Email, calendar and document providers used for day-to-day correspondence and project files.
- Accounting and invoicing software and, where applicable, banks and tax authorities.
- Google and Meta — only for client campaigns, as described in section 5, never for our own advertising without consent.
- Professional advisers (lawyers, accountants) and authorities where the law requires it.
If our business is transferred, personal data may pass to the successor under the same protections.
8. International transfers
Our providers operate in several countries, including the United States and the European Union. Where data leaves the country in which it was collected, we rely on the provider’s standard contractual clauses, adequacy decisions or equivalent safeguards, and on the cross-border transfer rules of the applicable law, including the Law of the Republic of Uzbekistan “On Personal Data” where it applies.
9. Retention
- Contact-form enquiries that do not lead to an engagement: 12 months, then deleted.
- Client and supplier records, contracts and invoices: for the duration of the relationship plus the period required by accounting and tax law (typically 5 years).
- Credentials and access to client systems: removed at the end of the engagement.
- Client data processed on the client’s behalf: returned or deleted at the end of the engagement, unless the client instructs otherwise.
- Job applications: 6 months after the position closes, unless you agree to a longer period.
- Server logs at Cloudflare: retained by Cloudflare for a short period under its own policy.
10. Security
We use encrypted connections (TLS) on the Site and with our providers, a password manager and multi-factor authentication for all business and client accounts, least-privilege access, separate environments for development and production, and regular removal of unused access. Client source code is stored in private repositories. No method of transmission or storage is completely secure; if we become aware of a breach affecting your data we will inform you without undue delay and, where required, the competent authority.
11. Your rights
Depending on where you live (for example under the EU/UK GDPR or the Law of the Republic of Uzbekistan “On Personal Data”), you may have the right to: access the personal data we hold about you; correct inaccurate data; request deletion; restrict or object to processing; receive your data in a portable format; withdraw consent at any time without affecting prior processing; and lodge a complaint with a supervisory authority. To exercise these rights, email hello@vansoov.com. We respond within 30 days and may ask you to verify your identity. If you are a customer of one of our clients, we will forward your request to that client or tell you how to reach them.
12. Changes
We may update this policy as our services, providers or the law change. The date at the top shows the last revision. Material changes are announced on the Site; continued use of the Site after that date means you have taken note of the new version.
Questions about this policy: hello@vansoov.com.