Privacy Policy

Effective date: 12 August 2026

This Privacy Policy explains how InfiniteCipher (“we”, “us”, “our”) handles personal data when you visit https://infinitecipher.com (the “Site”) or contact us through it.

1. Who we are

InfiniteCipher is a remote-first web and mobile development studio based in the Philippines and serving clients worldwide.

Privacy contact: infinitecipher04@gmail.com

For questions about this policy or to exercise your rights, email that address with the subject line “Privacy request”.

2. What we collect

2.1 Information you submit

When you use our contact or consultation forms, we collect:

• Name
• Email address
• Phone number (optional)
• Company name (optional)
• Message / project details
• Form type (contact vs consultation)

We also store campaign attribution when present (UTM source, medium, campaign, and the landing path), so we can see which pages or campaigns led to an enquiry.

2.2 Information collected automatically

• Server and security logs needed to operate and protect the Site (for example IP address, user agent, and request metadata processed by our hosting provider).
• Spam protection. If Cloudflare Turnstile is enabled, your browser completes a challenge token that we verify server-side. We do not use Turnstile as a marketing tracker.
• Analytics and advertising (only after you accept cookies — see §5): page views, device/browser information, and similar usage data via Google Analytics 4, Google Ads, and/or Meta Pixel when those tools are configured.

2.3 CMS playground

The public /playground demo stores an anonymous sandbox session cookie and temporary demo edits in memory or Redis. It is not linked to your contact details and does not write to our production content database.

2.4 Admin accounts

Staff who sign in to the admin CRM have account credentials processed for authentication only. The admin area is not covered by marketing analytics on this Site.

3. Why we use personal data

We use the data above to:

• Reply to enquiries and consultation requests
• Prepare quotes and discuss project scope
• Prevent spam and abuse of our forms
• Attribute leads to campaigns and landing pages
• Operate, secure, and improve the Site
• Measure traffic and marketing performance when you have consented to analytics/marketing cookies

We do not sell your personal data.

4. Processors and service providers

Depending on configuration, we may use:

• Vercel — hosting, edge delivery, optional media storage (Blob)
• Neon — PostgreSQL database for Site content and CRM leads
• Resend — transactional email notifying us of new leads
• Cloudflare Turnstile — form spam protection
• Google Analytics 4 / Google Ads — analytics and ads measurement (consent-gated)
• Meta Pixel — ads measurement (consent-gated)
• Upstash Redis — optional playground sandbox persistence

These providers process data on our instructions to deliver the services above. Their own privacy terms also apply to their processing.

5. Cookies and similar technologies

Essential (always on)

• ic_attribution — first-party cookie storing UTM/landing attribution until a lead is submitted
• ic_playground — anonymous playground sandbox id (scoped to /playground)
• Auth.js session cookies — admin sign-in only
• ic_consent — stores your cookie preference so we remember Accept / Reject

Analytics and marketing (only after you Accept)

If you accept, we may load Google Analytics 4, Google Ads tags, and/or the Meta Pixel. You can reject analytics/marketing cookies; essential cookies still work and forms still submit.

You can change your mind later by clearing Site cookies for this domain (the consent banner will appear again when no preference is stored).

6. Retention

• Leads are kept in our CRM until we have finished handling the enquiry and then deleted or anonymized when no longer needed for that purpose, or sooner if you ask us to delete them (unless we must retain a record for a legal claim or dispute).
• Email notifications of new leads may be retained in our mailbox according to normal email practice.
• Analytics data follows each vendor’s retention defaults when those tools are enabled.
• Playground sandboxes are ephemeral and are not part of our CRM.

7. Your rights

As a Philippines-based studio, we handle personal data in line with the Data Privacy Act of 2012 and its implementing rules. Subject to applicable law, you may request:

• Access to personal data we hold about you
• Correction of inaccurate data
• Deletion or blocking of data that is no longer needed
• Information about how we process your data

If you are in the EEA/UK or another region with similar rights, you may also ask us about restriction, objection, or portability where those rights apply. We will respond to valid requests sent to infinitecipher04@gmail.com.

You may also lodge a complaint with the National Privacy Commission (Philippines) or your local supervisory authority.

8. International transfers

We use cloud providers that may process data in the United States or other countries. Where we transfer personal data internationally, we rely on appropriate safeguards offered by those providers and on your relationship with us as a website visitor or prospective client.

9. Children

The Site is aimed at businesses and professionals. We do not knowingly collect personal data from children.

10. Changes

We may update this policy from time to time. The effective date at the top will change when we do. Continued use of the Site after an update means you acknowledge the revised policy.

11. Contact

InfiniteCipher
Email: infinitecipher04@gmail.com
Website: https://infinitecipher.com