Privacy policy

Last updated: October 26, 2026.

Salma Creative Studio is a creative studio run by Salma Syeda in Canada. This policy explains what personal information we collect through this website and our client tools, why, who handles it for us, and how long we keep it. Questions or requests: hello@salmastudioco.com.

What we collect

• When you send an inquiry: your name, email, phone number (optional), contact preference, business details, the services you're interested in, your goals, budget range and timeline, your answers to service questions, links, and any files you upload (up to 5 files, 10 MB each).
• Your consent choices: your agreement to this policy, whether you chose to receive marketing emails, which version of the wording you saw, and the date and time.
• Technical details of each inquiry: your IP address and browser information, used to stop spam and abuse.
• If you become a client: the name you type to accept a proposal and when you accepted it; your approvals, change requests and comments in your client portal; onboarding information you share, such as brand files and how to give us access to accounts (we never ask for passwords); and invoice amounts and payment status. We don't collect card or bank details: you pay by Interac e-Transfer or Zelle outside this website.
• Our own notes: we keep private notes about each inquiry and project, such as follow-up dates, its stage and, if it doesn't go ahead, the reason.

Why we use it

• To reply to your inquiry, understand your project and prepare a quote or proposal.
• To deliver your project, share work for review, record approvals and send invoices.
• To keep business, tax and accounting records.
• To protect the website and our records from spam, abuse and fraud.
• To send you marketing emails, but only if you ticked the separate marketing box.

Who handles it for us

We use these service providers to run the studio:

• Supabase: stores our database and the files you upload, in its Canada region.
• Cloudflare: hosts this website, runs the security check on our inquiry form, and forwards email sent to hello@salmastudioco.com.
• Resend: sends us email alerts about new inquiries and a daily summary. These include your name, email and project details.
• Google (Gmail): our business inbox, where we receive those alerts and your emails and write our replies to you.

Our main database is in Canada, but Cloudflare, Resend and Google are based in the United States and may process your information in the United States or other countries, where it may be accessible under local law. Each provider also handles information under its own security, support and backup arrangements.

Marketing emails

We only send marketing emails if you opted in. Every marketing email will say who it's from and include a way to unsubscribe. If you unsubscribe or ask us not to contact you, we keep a short record of your email address so you aren't added back by mistake. Replies about your inquiry or project are not marketing.

How long we keep it

• Inquiries that don't become projects, and their files, are deleted 12 months after the last activity.
• Project records and files are kept while we work together and for as long as needed afterwards to support you and resolve any questions about the work.
• Invoices and other records needed for tax are kept for at least six years, as Canadian tax law requires.
• Records of consent and unsubscribe requests are kept as long as needed to show we respected your choices.

How we protect it

Information is sent over encrypted connections. Only Salma can sign in to our records, using a one-time link sent to her email. Client portals and proposals use private links that are hard to guess, so please don't share yours. No system is perfectly secure; if a breach creates a real risk of significant harm to you, we will tell you and report it as the law requires.

Your rights

You can ask to see the personal information we hold about you, correct it, ask us to delete it, or withdraw your consent, by emailing hello@salmastudioco.com. We'll reply within 30 days. Some records, such as invoices, must be kept for legal or tax reasons even if you ask us to delete them; if so, we'll tell you. We handle personal information under PIPEDA, Canada's federal privacy law for businesses.

Cookies and tracking

This website has no analytics, advertising or tracking cookies. While you fill in the inquiry form, your answers are saved in your own browser so you don't lose them, and cleared once you send. Cloudflare's security check on the form uses information about your browser and device to tell people from bots. The only cookie we set is for Salma's own sign-in.

Changes

If we change this policy, we'll update it here and change the date at the top.