Last updated: 9 August 2026
Effective 1 August 2026 · Last updated 9 August 2026
ShunyaHQ is a web engineering studio. We design, build and ship custom web applications for our clients, and we run this website to explain that work and to let people get in touch about it. This Privacy Policy explains what information we collect through both of those activities, why we collect it, how we protect it, and the choices you have.
It covers two distinct relationships, and the difference matters. For our own website and enquiries, we are the data controller - we decide what is collected and why. For data inside systems we build or maintain for a client, the client is the data controller and we act as a data processor, handling that data only on their documented instructions and under the contract we have signed with them.
Throughout this policy, "we", "us" and "ShunyaHQ" refer to Shunya Tech, the entity operating shunyahq.com, and "you" refers to any person who visits this site, contacts us, or works with us. If you do not agree with any part of this policy, please stop using the site.
Information you give us. When you submit the contact form, request an estimate, or email us, we receive your name, email address, phone number if you provide one, your company, and whatever you write in the message. When you subscribe to updates, we receive your email address.
Project information. During an engagement we receive whatever you share with us so we can do the work: requirements, designs, brand assets, existing documentation, and - where the project needs it - credentials or access tokens for your own systems.
Automatically collected data. Standard server and analytics data such as browser and device type, IP address, approximate location derived from that address, referring page, and which pages you viewed. This is aggregate usage measurement, not individual profiling.
What we do not collect. We do not collect card or bank details through this website. We do not run third-party advertising trackers. We do not buy contact lists or enrich your record with data bought from data brokers.
We use the information we collect only for purposes connected to running the studio:
We do not use client project data or the contents of your enquiry to train machine-learning models, and we do not sell or rent your information to anyone.
Anything you share with us for a project - source code, databases, designs, customer records, business plans, credentials - is treated as confidential. It is used solely to perform the work, shared only with the specific people on your team's engagement, and never disclosed to another client.
Where we are handling personal data that belongs to your users, you remain the controller and we act on your instructions. We will not use that data for our own purposes, will help you respond to requests from your users where we reasonably can, and will tell you without undue delay if we become aware of a breach affecting it.
Access to client systems is granted per person and per project, uses your own access-control tooling wherever possible, and is revoked when the engagement ends or when the person leaves the project. We ask for the least privilege that gets the job done, and we will push back on being given broader access than the work requires.
We apply the same standards to our own systems that we build into our clients':
No system is perfectly secure. If a breach ever occurs that is likely to affect your data, we will notify you without undue delay and tell you what happened, what we know, and what we are doing about it.
We keep enquiry data for as long as it takes to answer you and for a reasonable period afterwards in case you come back to the conversation, then delete it.
Project data is retained for the life of the engagement. After a project ends we keep a copy for 90 days so you can request a handover or a re-export, after which it is deleted from our systems unless you have asked us in writing to retain it for ongoing support, or unless we are required to keep it by law.
Invoices and accounting records are kept for as long as tax law requires. Anonymised, aggregated analytics that cannot identify anyone may be kept indefinitely.
Depending on where you live, you may have the right to:
To exercise any of these, email us using the address in the final section. We will respond within 30 days and we will not charge you, unless a request is clearly unfounded or excessive.
If your data sits inside a system we run for a client, send your request to that client - they are the controller, and we will support them in answering it.
We work with clients in several countries and our infrastructure providers operate globally, so your data may be processed on servers outside the country you live in.
Where data crosses a border, we rely on contractual safeguards with our providers requiring them to keep it confidential and secure to a standard consistent with this policy. If a project has a specific data-residency requirement, tell us before we start and we will architect for it rather than retrofit it.
To run the studio we rely on a small set of sub-processors, each engaged under terms requiring appropriate security and confidentiality. These typically include:
These providers may process data only on our instructions and only to support the service. We review them periodically and update our practices as our infrastructure changes.
We may update this Privacy Policy from time to time. When we make a material change we will post the updated policy here and refresh the "Last updated" date, and where the change meaningfully affects you we will tell you by email.
Your continued use of the site after an update takes effect means you accept the revised policy.
If you have a question about this policy or about how we handle your data:
We respond to data-related requests within 30 days.
