Privacy Policy

1. Who we are

Symorpha ("we", "us") is a digital agency based in Pakistan. Symorpha SMC Pvt. Ltd., Suite 701-703, Fortune Tower, Shahrah-e-Faisal, PECHS Block 6, Karachi, Pakistan, is the legal entity operating symorpha.com. You can reach us at info@mail.symorpha.com.

This policy explains what personal data we collect when you use symorpha.com, why we collect it, where it goes, and what you can do about it.

2. What we collect and why

2.1 Site analytics (no cookies, always on)

We use PostHog (EU cloud) to count page views and understand which pages and features are useful. Until you accept analytics in our consent banner, PostHog runs in cookieless mode: it sets no cookies and stores only your consent choice, and visits are counted with a privacy-preserving hash calculated on PostHog's servers, so you are not identified across days or sites. In this mode we also record anonymous events such as "opened the assistant" or "booked a call".

A language cookie (sym.lang) stores the site language you chose or your browser asked for, so we do not have to ask again. It lasts one year, contains only a language code and no identifier, and is strictly necessary for serving the page in your language.

2.2 Session recordings and heatmaps (only with your consent)

If you accept analytics in the consent banner, PostHog switches to normal mode: it sets first-party cookies and local storage (names starting with ph_) to recognise your browser across visits, and records how you interact with pages (clicks, scrolls, mouse movement) to produce heatmaps and session replays. Recordings also include the page's network requests (addresses, timing and content), browser console messages and errors, so we can find what broke. Text you type into form fields, the assistant conversation and booking details are masked in recordings, and the content of requests that carry them (the assistant, contact, plan and booking forms) is not recorded.

When you give us your email in the contact form, the plan form, the assistant or a booking, and you have accepted analytics, we give your PostHog profile a pseudonymous ID derived from your enquiry, attach that email (and your name) to it, and link your assistant conversation to it, so we can see the visit that led to your enquiry. Without consent nothing is attached.

You can withdraw consent at any time from the cookie settings link in the footer; we stop recording, return PostHog to cookieless mode and delete its cookies. PostHog's privacy policy applies to the data it processes: https://posthog.com/privacy

2.3 The AI assistant

Our site includes a chat assistant that helps scope and plan projects and books calls. The text you type (or say, in voice mode) is sent through Vercel AI Gateway to a third-party language model provider (currently Z.ai's GLM models, with DeepSeek and OpenAI as fallbacks) to generate responses. Voice mode sends your recorded speech to OpenAI for transcription and the reply text to OpenAI for speech; we do not store the audio. When the assistant offers a written plan or a call, it asks for your name and email and says why; a phone number is optional. After six messages without contact details, it asks for them before it continues; up to ten taps on its suggested questions do not count toward the six. We use Cloudflare Turnstile to check that you are a person; Cloudflare processes your IP address and browser signals for that check. To monitor quality, cost and errors, each assistant conversation (your messages, the replies and tool steps, under a random conversation ID) is also sent to PostHog (EU cloud), whether or not you accept analytics cookies. It is linked to your PostHog profile and session recording only if you accepted analytics (see 2.2).

Please do not share sensitive personal data (health, financial account numbers, government IDs) in the chat.

If you give the assistant your name, email or phone number to request a plan or a call, we store the chat transcript together with those details as a "lead" in our content database (see 2.5). We do this so the founder can read what you discussed before replying. If you chat without leaving contact details, the conversation is not linked to you and is not stored by us beyond the session, although the model providers may retain API logs under their own policies.

2.4 Bookings

Calls are booked through Cal.com. When you pick a time, Cal.com collects your name, email, optional notes and timezone, and sends calendar invites. Cal.com's privacy policy applies: https://cal.com/privacy. If you arrive at the booking from the assistant, we prefill your name, email and a summary of the chat so you don't have to retype them.

2.5 Contact forms and leads

When you send a brief via the contact form, book a call, or leave details with the assistant, we store:

• your name, email and (if given) phone or WhatsApp number;
• the message, brief or chat transcript;
• which service you asked about and any budget range you selected;
• the site language of your enquiry, so we can reply in it;
• the date and the page you were on.

This is stored in Sanity, the content platform that also runs our site content. We also send ourselves a notification containing the same details by email (via Resend) and to an internal chat channel and, where you have opted in, a WhatsApp alert to the founder. These notifications are for us only; we do not add you to any marketing list.

Legal basis (where GDPR applies): performance of pre-contractual steps at your request, and our legitimate interest in responding to enquiries.

2.6 Server logs and hosting

The site is hosted on Vercel. Vercel's infrastructure processes your IP address and request headers to serve pages and to protect the site from abuse (including rate-limiting the assistant). When something fails on our servers, the error is reported to PostHog (EU cloud) without identifying you. Vercel's privacy policy: https://vercel.com/legal/privacy-policy

2.7 Email

If you become a client, we email you about your project. Transactional email is sent via Resend. We do not send newsletters unless you explicitly sign up for one, and we currently do not have one.

3. Where your data goes

Our providers are in the United States (Vercel, Sanity, Cal.com, Resend, Cloudflare, OpenAI), the European Union (PostHog EU cloud), and China/Singapore (Z.ai, DeepSeek) for assistant replies. By using the assistant or sending us data you understand it will be processed outside Pakistan and, if you are in the EU/UK, outside the EEA. Where required, our providers rely on standard contractual clauses or equivalent safeguards.

4. How long we keep it

Data	Retention
Analytics events (PostHog)	Per PostHog's retention for our plan; cookieless events are not linked to you
Session recordings (PostHog, with consent)	Per PostHog's recording retention for our plan
Leads, briefs, chat transcripts	24 months from last contact, or until you ask us to delete them
Client project records	Duration of the engagement plus 7 years for accounting and tax purposes under Pakistani law
Booking records	Per Cal.com's policy; our copy follows the lead retention above

5. Your rights

Wherever you are, you can ask us to:

• tell you what data we hold about you;
• correct it;
• delete it (we will, unless we must keep it for tax or legal reasons);
• stop using it for a particular purpose;
• give you a copy in a portable format.

Email info@mail.symorpha.com with "Privacy request" in the subject. We respond within 30 days. If you are in the EU/UK and are not satisfied, you may complain to your local data protection authority.

6. Children

The site and services are for businesses and adults. We do not knowingly collect data from anyone under 18.

7. Security

Data is transmitted over HTTPS. Access to Sanity, Vercel and our inboxes is limited to the founder and named team members with two-factor authentication where the provider supports it. No system is perfectly secure; if we discover a breach that affects you, we will tell you without undue delay.

8. Changes

We will post changes here and update the date at the top. Material changes to how we use leads or the assistant will be flagged in the consent banner.

9. Governing law

This policy and any dispute about it are governed by the laws of the Islamic Republic of Pakistan, including the Prevention of Electronic Crimes Act 2016 and applicable data-protection legislation as enacted. Courts in Karachi, Pakistan have exclusive jurisdiction, without prejudice to any mandatory consumer protections you have in your own country.