Privacy Policy

Automatrix AI is an independently operated business name based in Pakistan. It is not a separate incorporated legal entity. References to “we”, “us” and “our” refer to the business operating under the name Automatrix AI.

This policy explains what personal information we collect through this website, why we collect it, where it is stored, who processes it for us and the choices available to you. It applies to this website only. If you become a client, information you share during a project is handled under the written agreement we sign with you.

We have written this policy to describe our actual practices as accurately as we can. Publishing it does not by itself mean that every law in every country applies to us or has been satisfied; where a law gives you rights, those rights apply whatever this policy says.

We collect personal information in three ways:

• Information you send us through the contact form or the review form (sections 3 and 4).
• Technical information that your browser sends when you open a page that contains a form, such as your IP address. This includes our homepage, which contains the review form, and our Contact page (section 5).
• Administrator account information for the small number of people who manage this website. If you are a visitor, we do not create an account for you.

We do not use analytics tools, advertising networks, tracking pixels or social media plugins on this website, and we do not ask you for payment details or government identification numbers.

When you send an inquiry, we collect:

• your full name;
• your email address;
• your country;
• your WhatsApp number, including its country code, if you choose to give it (it is optional);
• whether you ticked the optional box agreeing to be contacted on WhatsApp;
• the project description you write.

We use this information to read and respond to your inquiry and to keep a record of inquiries we have received. We reply by email from our Google Gmail account, and contact you on WhatsApp only if you have agreed to it (see below). We do not add you to a mailing list.

WhatsApp contact and your consent

You can send an inquiry with your email address alone. If you also give a WhatsApp number, you can tick an optional box agreeing that Automatrix AI may contact you on WhatsApp about that inquiry. The box is unticked unless you tick it, and leaving it unticked does not affect your inquiry.

When you send the form, we record whether you ticked the box, the exact wording you were shown, and, if you ticked it, the time you agreed. That time is set by our database, not by your device. We contact you on WhatsApp only while that consent is active, and only about the inquiry you sent.

You can withdraw your WhatsApp consent at any time by contacting us (section 15). An administrator then records the date of your withdrawal, and we stop contacting you on WhatsApp about that inquiry. We keep the original consent record alongside the withdrawal, as a record of what you agreed to and when. Inquiries sent before we started recording consent are treated as having no WhatsApp consent.

To store and deliver each inquiry, we also record:

• the date and time it was received;
• a random reference number created by your browser, so that an accidental double submission is saved once;
• a one-way fingerprint of your IP address (explained in section 5), used to limit how many inquiries one network can send;
• the delivery status of the notification email we send to ourselves: whether it was sent, how many attempts were made, when, and any error returned by our email provider. An administrator can retry a notification that failed.

Each new inquiry is sent automatically, through our transactional email provider Resend, to our business inbox at Google Gmail as an email notification containing your name, email address, WhatsApp number (if given), country, project description, the time of your inquiry, its reference number and whether you agreed to WhatsApp contact when you sent it.

Please do not include confidential or sensitive information in your project description. Any confidentiality obligations between us apply only once agreed in writing.

When you submit a review, we collect your name, your company name (optional), your star rating and your review text.

Moderation before publication

Every review is saved as pending and is not shown publicly when you submit it. An administrator reads it and either approves or rejects it. Only approved reviews appear on the website.

We decide using the same criteria for every review, whatever its rating or tone. We do not reject a review because it is negative, and we do not reject a review because it criticises us. We reject a review only for one of these content-neutral reasons, which apply in the same way to every rating:

• it is spam, advertising, automated or a duplicate;
• we reasonably believe it does not describe a genuine experience of our services;
• it is unrelated to our services;
• it contains abusive, threatening, discriminatory or unlawful content;
• it includes someone’s personal or confidential information; or
• you, the reviewer, asked us to withdraw it.

Before rejecting a review, an administrator must choose one of these reasons and confirm that the review is not being rejected because of its rating or because it criticises us.

What is shown publicly

For an approved review, the website shows your name, your company name (if you gave one), your rating, your review text and the date you submitted it. Nothing else you send us is published. Once a review is public, other people and search engines may see, copy or store it, which we cannot control.

The homepage shows the 24 most recent approved reviews. Older approved reviews stay stored but are not currently displayed.

Rejected and withdrawn reviews

A rejected review is not published and remains stored privately in our database. An administrator can later change an approved review to rejected, which removes it from the website, or approve a review that was previously rejected.

For each review we keep a moderation history: each change of status, the reason for each rejection, which administrator made the change and when. The history is recorded automatically, cannot be edited, is visible only to our administrators and is never published. Rejection reasons are never shown on the website.

Duplicate and spam protection

With each review we also store a one-way fingerprint of your IP address and a one-way fingerprint of the review text. We use them to stop the same review being submitted twice within a short period and to limit how many reviews one network can submit per hour and per day.

Your IP address

When you submit a form, our server reads your IP address. We do not store the IP address itself in our database. Instead we store a keyed one-way fingerprint of it (an HMAC-SHA-256 hash made with a secret key), which lets us recognise repeated submissions from the same network for rate limiting and duplicate detection, but cannot be turned back into the address without that key.

When you submit a form, our server also sends your IP address to Cloudflare to confirm the anti-spam check described below.

Anti-spam checks

Our forms use Cloudflare Turnstile to tell people from automated bots. Turnstile loads automatically when you open our homepage (which contains the review form) or our Contact page, even if you never fill in or submit a form. It runs in your browser and sends Cloudflare signals such as your IP address, browser and device characteristics and the website you are on. Usually this happens invisibly; occasionally you may be asked to click a checkbox. When you submit a form, our server asks Cloudflare to confirm the check.

The forms also include a hidden field that people do not see and a check of how quickly the form was completed. These are used only to reject automated submissions and are not stored.

Server logs

Like most websites, the provider that hosts this website may automatically log technical details of requests, such as IP address, browser type, the page requested and the time, to operate and secure its service.

Visitors. This website does not set its own cookies for visitors and does not use your browser’s local storage or session storage to track you. We do not use advertising or analytics cookies.

Cloudflare Turnstile. Turnstile loads on our homepage and Contact page whenever you open them. It is provided by Cloudflare, which may use cookies or similar technologies that are strictly necessary for detecting bots. These are controlled by Cloudflare; see the Turnstile Privacy Addendum (opens in a new tab) and Cloudflare’s Cookie Policy (opens in a new tab).

Administrators. When an administrator signs in, the website sets secure session cookies that keep them signed in. These cookies are used only in the administration area, cannot be read by page scripts and are not sent with requests from other websites. They expire about eight hours after the sign-in session was last refreshed; the session refreshes automatically while the administrator keeps using the administration area.

Do Not Track. We do not track visitors across other websites over time, and we do not allow other companies to do so through this website, apart from the bot-detection signals Cloudflare processes for Turnstile. For that reason the website does not respond differently to “Do Not Track” browser signals.

We use personal information only for these purposes:

• to read, answer and keep a record of your inquiry, and to discuss a possible project with you;
• to moderate reviews and publish approved reviews on the website;
• to protect the website and its forms against spam, bots, abuse and duplicate submissions;
• to run and secure the website and its administration area;
• to comply with legal obligations and to establish or defend legal claims.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.

If the EU or UK General Data Protection Regulation applies to our use of your information, we rely on these legal bases: taking steps at your request before entering into a contract, and our legitimate interest in responding to inquiries (contact form); your consent to publish the review you submit for publication (reviews); our legitimate interest in keeping the website secure and free of spam (anti-spam and security measures); and compliance with legal obligations where they apply.

We use the following service providers to run this website. They process personal information on our behalf:

• Supabase provides our database and administrator sign-in. It stores inquiries, reviews and administrator accounts. Our database is hosted in the United States (East US, North Virginia).
• Resend is our transactional email provider. It delivers the automatic inquiry notification emails that the website sends to our own inbox, so it receives the inquiry details listed in section 3. We do not use Resend to correspond with you.
• Google (Gmail) hosts our business email account. It receives the inquiry notifications delivered by Resend, and we use it to read and reply to your inquiry and any other emails we exchange with you.
• Cloudflare provides Turnstile bot detection on our forms. For detecting and blocking bots, Cloudflare acts on our behalf; Cloudflare states that it also uses Turnstile signals to improve its bot detection, for which it acts as an independent controller.
• The provider that hosts this website serves its pages and runs the code that processes form submissions.

If you agree to be contacted on WhatsApp, a service provided by Meta, we may contact you there from our business WhatsApp number about your inquiry while your consent is active. If you message our WhatsApp number yourself, we receive your number and your messages through WhatsApp. Messages you exchange with us on WhatsApp are also subject to WhatsApp’s own terms and privacy policy.

We may also disclose information when the law requires it, to protect our rights or the safety of others, or as part of a sale or reorganisation of our business. We do not otherwise share your personal information with third parties.

The fonts on this website are served from our own website, so loading a page does not send your information to a font provider.

Inquiries and reviews are stored in our Supabase database in the United States. Our measures include:

• database rules that let the public see approved reviews only. Inquiries can be accessed only by signed-in administrators who have completed two-factor authentication, by the website’s own server systems that store them and send notifications, and by people with access to our database hosting account;
• administrator sign-in that requires a password and a code from an authenticator app (two-factor authentication);
• administrator session cookies that page scripts cannot read and other websites cannot use;
• storing IP addresses only as keyed one-way fingerprints;
• bot detection, rate limits and input validation on both forms.

No website or storage system is completely secure, so we cannot guarantee the security of information you send us. Please do not send sensitive information through our forms.

The website does not delete inquiries or reviews automatically, and there is no automated retention schedule. Deletion is done manually.

• Inquiries. No fixed retention period is currently established. Inquiry records are retained while they remain necessary for legitimate business purposes and are manually deleted when they are no longer needed or when a valid deletion request is accepted, subject to applicable legal obligations. This includes each inquiry’s WhatsApp consent and withdrawal records.
• Reviews. Review submissions and their moderation history are retained while they are needed for moderation or while the review remains published. Where a reviewer requests withdrawal or deletion, the request will be handled manually, subject to applicable legal obligations. Reviews that are still pending a decision, and reviews that were rejected, are also stored privately for moderation purposes; they are never published. A review and its moderation history are deleted together: deleting a review also deletes its history.
• Emails. Inquiry notifications and the emails we exchange with you remain in our Gmail account until we delete them. Resend keeps delivery records under its own retention practices.
• Administrator session cookies expire about eight hours after the sign-in session was last refreshed.

We will update this section if we set fixed retention periods.

You can contact us to ask to:

• access the personal information we hold about you;
• correct information that is inaccurate;
• delete your information;
• withdraw your review from the website;
• withdraw your consent to be contacted on WhatsApp;
• object to or restrict our use of your information.

Please send requests to hasnatsaddam25@gmail.com. We handle each request manually; the website does not offer a self-service privacy tool.

Before acting on a request, we check that it comes from the right person. For an inquiry, we normally do this by writing to the email address stored with it. Reviews are submitted without an email address, so for a review we ask you to confirm details of the review you submitted, such as the name, company, rating and approximate date. We do not ask for identity documents unless there is no other reasonable way to confirm a request.

We cannot edit the wording of a review. To correct a review, we can withdraw it from the website so that you can submit a new one. We will respond as required by the law that applies to you. Some requests may be limited where we must keep information for legal reasons.

Depending on where you live, such as the European Economic Area, the United Kingdom or certain US states, you may have additional rights under local law, including the right to complain to your data protection authority. We will not discriminate against you for exercising any of these rights.

Because we do not sell personal information or share it for cross-context behavioural advertising, there is no sale or sharing for you to opt out of.

We operate from Pakistan. Inquiries and reviews are stored in our database in the United States, and our team accesses them from Pakistan. Our other service providers, listed in section 8, may process information in other countries.

These countries may not have data protection laws equivalent to those where you live. If you have questions about how your information is transferred or protected, please contact us using the details in section 15.

This is a general-audience business website. It is not directed at children under 13, and we do not knowingly collect personal information from children under 13 without the consent of a parent or guardian where the law requires it. We do not use an age-verification system.

If you are a parent or guardian and believe that your child under 13 has sent us personal information through this website, please contact us at hasnatsaddam25@gmail.com. We will check the request and delete the information, subject to any legal obligation to keep it.

We may update this policy when our practices or the law change. We will publish the updated version on this page and change the “Last updated” date at the top. If a change is significant, we will also describe it at the top of this page for a reasonable period.

For privacy questions or requests, contact Automatrix AI:

• Email: hasnatsaddam25@gmail.com
• WhatsApp: +92 300 5098499 (opens in a new tab)

You can also reach us through the form on our Contact page; only your name, email address, country and a short message are required.