Kindredd Studio is a small studio - no marketing team, no ad network. The short version of this policy: I collect only what I need to build your project, I keep it in well-known tools, the one analytics tool I use only loads if you say yes, and you can ask to see, correct, or delete anything at any time.
What I collect
Brief submissions.When you fill in the brief form, I collect your name, email address, company (if you give one), a description of your project, and any attachments you upload. These are stored in Supabase (the studio's database). Only I (Chinazo) read them.
Project rooms.Once a project starts, your project room collects the messages we send each other, screenshots and file uploads, quotes, deliveries, and a log of actions like "approved" or "requested a change". All of it lives in the same Supabase database, scoped so that only you and the studio can see it.
Payments. Card details go directly to PayFast. Kindredd Studio never sees, touches or stores card numbers. What I do keep is the record of which invoices were paid, when, and for how much, which is required for tax.
WhatsApp. If you message the studio on WhatsApp, I keep the messages you send, any images or documents you attach, your WhatsApp phone number and display name, and the delivery receipts WhatsApp returns (sent, delivered, read). This lets me answer you, quote for work, and remind you about a payment in the same thread you started. It sits in the same database as the rest of your project, and only I read it.
Your number is used to suggest which client you are. I confirm that match by hand before it is linked to your account, because phone numbers get recycled and shared.
Reply STOP at any time and I will stop sending you WhatsApp messages. That is recorded the moment it arrives and is never quietly undone. Unsubscribe, cancel, end, quit and opt out do the same thing. You keep your email and portal access, so nothing about your project is affected.
Cookies, analytics, and advertising. The site uses a session cookie for sign-in (provided by Supabase Auth). It also uses analytics and advertising tools so I can see which pages help people, how far down a page they read, which parts of the brief form they finish, and how my ads perform. A notice at the bottom of the page tells you about this the first time you visit, and by continuing to use the site you agree to it. If you turned these off under the earlier cookie banner, that choice still stands.
Specifically, the site loads: Google Analytics 4 (page views, how far down a page you scroll, which brief questions are answered, and where visitors come from), Microsoft Clarity (how pages are used, such as scrolling, clicks and mouse movement, shown as heatmaps and anonymous replays), Meta Pixel(Facebook and Instagram ad measurement and retargeting), TikTok Pixel, LinkedIn Insight Tag, and the X (Twitter) Pixel. These tools never receive what you type into a form: brief answers, names, emails and messages are hidden from Clarity, and analytics events carry only which question was answered, never the answer. Clarity does not run inside the client portal. Each tool may set its own cookies and may share aggregated data with its parent platform for measurement and relevant ads. None of it is sold to anyone else.
Saved project briefs. Once you add your name and email to the brief form, your answers are saved so you can pick up where you left off. If you do not send the brief, you get one email reminding you to finish it, with a link to unsubscribe. Drafts that are never sent are deleted after 90 days. When you send the brief, the draft is replaced by your brief and its contact details are removed.
Third parties I rely on
- Supabase - database and authentication.
- Resend - sending transactional email (quote notifications, delivery emails).
- PayFast - payment processing.
- Google - OAuth (only if you choose "sign in with Google"), and Google Analytics + Google Ads.
- Meta (Facebook, Instagram, WhatsApp) - advertising pixels on Facebook and Instagram, used for ad measurement and retargeting; and the WhatsApp Business Platform if you message the studio on WhatsApp, which Meta processes and delivers under its own terms.
- Microsoft - Clarity, to see how the marketing site is used. Form typing is hidden from it.
- TikTok, LinkedIn, X (Twitter) - advertising pixels, used for ad measurement and retargeting on those platforms.
- Vercel - hosting the site and the portal.
Each of these has its own privacy policy, and each is contractually bound to protect the data I send them. I don't sell, rent, or share your data with anyone else.
How long I keep it
Project data (briefs, messages, files, deliveries) is kept for three years after a project completes, in case you come back wanting changes or copies of old work. After that I'll delete it on request - and you can ask sooner if you prefer. Financial records (invoices, payment confirmations) are kept for five years because South African tax law requires it. WhatsApp conversations follow the same three-year project rule. An opt-out record is kept indefinitely, because it is the only way to be sure you are not messaged again by mistake.
Your rights
You can ask, at any time, for:
- A copy of the data I hold about you.
- A correction if any of it is wrong.
- Deletion of data that I'm not legally required to keep.
- An export of your project files in a portable format.
Email hello@kindreddstudio.comand I'll respond within one working day. This policy is aligned with South Africa's POPIA and is compatible with the GDPR for international clients.
Children
The service isn't designed for people under 18. If you're under 18, please don't submit a brief - ask a parent or guardian to do it on your behalf.
Security
Connections to the portal are encrypted in transit. Data at rest is held in Supabase's managed Postgres, with row-level security so that one client can't read another client's data. Backups are encrypted. If a breach ever affects your data, I'll tell you directly and promptly.
Requests from public authorities
If the police, a court, SARS, a regulator or any other public authority asks me for your personal information, this is how I handle it:
- I check it is lawful first. Nothing is shared until I have confirmed the request has a valid legal basis, such as a subpoena, warrant or court order, and that it comes from an authority entitled to make it. Where needed, I take legal advice.
- I challenge requests that are not lawful. If a request has no proper legal basis, is too broad, or is not properly made, I refuse it or challenge it through the correct legal channels.
- I share the minimum. If I must comply, I disclose only the information the request strictly requires, and nothing more.
- I keep a record. Every request is logged with the date, who asked, what they asked for, the legal basis given, what I shared or refused, why, and who was involved.
Where the law allows it, I will tell you about the request before sharing anything, so you have the chance to object.
Questions, complaints, or privacy requests
Email hello@kindreddstudio.com. If you're in South Africa and you're not satisfied with how I've handled a complaint, you can also contact the Information Regulator (South Africa).