Privacy Policy
Full text
1. Who is responsible for your data
The data controller is Cup Code Establishment (Cup Code Studio), an establishment registered in the Kingdom of Saudi Arabia under unified national number 7051565781, based in Madinah.
For anything related to privacy: privacy@cupcodestudio.com.
We process personal data in accordance with the Saudi Personal Data Protection Law (Royal Decree No. M/19, 9/2/1443H) and its Implementing Regulations, supervised by the Saudi Data & AI Authority (SDAIA).
2. Our principles
- Minimisation: we ask for the least data needed.
- Purpose limitation: data is used only for the purpose it was collected for.
- Transparency: we explain what we collect and why, in plain language.
- Deletion when no longer needed: we don’t keep data forever.
3. What we collect
Contact details
When you use the contact form: name, email, organisation (optional), subject and message.
Support requests
When you open a support request: name, email, request details, any attachments you choose to upload, and device/browser information if you provide it, plus your browser type to help solve the problem.
Newsletter
Only your email and preferred language, when you subscribe yourself.
Privacy requests and security reports
Whatever you submit in the privacy request form or the security report form, used only to handle that request or report.
Technical logs
- The site’s error logs record technical details about errors only, not form contents.
- The hosting provider may keep standard access logs (such as IP address, time and page) under its operational settings.
Security data
To protect forms from abuse and rate-limit attempts, we compute a hashed fingerprint of the IP address (HMAC) and store that instead of the address.
Cookies
One essential session cookie and one language preference. Details in the cookie policy.
Analytics
A daily aggregate count of page views — no cookies, no IP addresses, no visitor identifiers.
4. Why we process your data
- Answering messages and support requests: at your request and with your consent when you submit the form.
- Newsletter: based on your consent, which you can withdraw anytime via the unsubscribe link.
- Protecting the site and preventing abuse: a legitimate interest in protecting the service, without prejudice to your rights and within the limits the law allows.
- Legal obligations: when a law or a competent authority requires it.
We don’t use your data for automated decisions about you or to build marketing profiles.
5. Retention
We keep data only for as long as the purpose requires, then delete or anonymise it. Current retention periods are listed in the table below.
| Data | Period |
|---|---|
| Contact messages | Until the purpose ends — final period being set |
| Support requests after closing (with attachments) | Until the purpose ends — final period being set |
| Privacy requests after closing | Until the purpose ends — final period being set |
| Security reports after closing | Until the purpose ends — final period being set |
| Aggregate visit statistics | Until the purpose ends — final period being set |
| Admin audit log | Until the purpose ends — final period being set |
| Technical logs | Until the purpose ends — final period being set |
| Newsletter subscription | Until you unsubscribe |
6. Third parties
We don’t sell data or share it for marketing. We rely on a small number of service providers to run the site (such as hosting and email), who process data on our behalf and under our instructions. The current list is on the subprocessors page.
We may disclose data when a competent authority lawfully requires it.
7. Transfers outside the Kingdom
Hosting server location: to be confirmed and updated on this page.
Where servers or providers are outside the Kingdom, data is transferred in accordance with the rules governing the transfer of personal data outside the Kingdom under the law and its regulations, and only as needed for the purpose.
8. Security
- Connections are encrypted over HTTPS.
- Passwords are stored with secure hashing and sessions are protected.
- Attachments and system files are never publicly accessible.
- Admin access is limited to the person responsible for the site.
- Regular backups.
No system is 100% secure. If a breach is likely to harm you, we notify the competent authority and you as the law requires.
9. Children
The site is not directed at children. We don’t knowingly collect data from anyone under 18 without a guardian’s consent. If you believe a child has sent us data, contact us and we’ll delete it.
10. Your rights
The law grants you rights including: to be informed how your data is collected and processed, to access it, to obtain a copy, to have it corrected, to request its destruction when no longer needed, and to withdraw consent — subject to the exceptions the law sets out.
Details and how to apply: your data rights. You may also file a complaint with SDAIA.
11. Changes to this policy
When we change this policy we raise the version number, update the effective date, and keep previous versions at the bottom of the page. We never silently edit the published version.
12. Contact
Questions or requests: privacy@cupcodestudio.com, or the privacy request form.
Questions about this page? privacy@cupcodestudio.com