Privacy Policy

Origami 99 ("we", "us", "our") is an AI-enabled creative and digital agency operating internationally, with team members in Pakistan, Saudi Arabia, Germany, Canada and the United States. This policy explains how we collect, use, disclose and protect personal data when you visit ai-spark-engine-11.lovable.app, contact us, or engage us for services.

For any privacy question, contact engage@origami99.com.

We only collect what we need to run the site and deliver our services:

• Contact details you submit through forms (name, email, phone, company, message).
• Usage data such as pages viewed, referrer, device, browser and coarse geolocation, collected only if you accept analytics cookies.
• Marketing signals (ad clicks, retargeting IDs) collected only if you accept marketing cookies.
• Client-project data that engaged customers share with us to deliver work. This is governed by our master services agreement, not this website policy.

• Respond to your inquiries and deliver proposals.
• Provide and improve the site (uptime, performance, bug fixes).
• Measure marketing effectiveness (only with analytics consent).
• Comply with legal, tax and accounting obligations.

We do not sell personal information. We do not use your data to train third-party AI models without your explicit consent.

If you are in the EU, EEA or UK, we rely on one or more of the following legal bases under GDPR Article 6:

• Consent, for analytics and marketing cookies (Article 6(1)(a)).
• Contract, to respond to a request or deliver a signed engagement (Article 6(1)(b)).
• Legitimate interests, to secure the site and prevent abuse (Article 6(1)(f)).
• Legal obligation, for tax, accounting and required record-keeping (Article 6(1)(c)).

Depending on where you live, you have some or all of the following rights:

• GDPR (EU/EEA/UK). Access, rectification, erasure, restriction, portability and objection (Articles 15 to 22). You may also lodge a complaint with your national data-protection authority.
• CCPA / CPRA (California). Right to know, right to delete, right to correct, right to opt out of sale or sharing, right to limit the use of sensitive personal information, right to non-discrimination.
• Other jurisdictions. We honour equivalent rights under Canada (PIPEDA), Brazil (LGPD), UAE (PDPL), Saudi Arabia (PDPL) and Australia (Privacy Act).

To exercise any right, email engage@origami99.com. We respond within 30 days.

We use a small number of cookies, grouped into four categories: strictly necessary, preferences, analytics and marketing. Non-essential categories are off by default and only fire after you consent. You can review and change your choice any time on our Cookie Policy page, or by clicking "Manage cookie preferences" in the footer.

• Contact form messages: 24 months from last contact, then deleted or anonymised.
• Analytics data: 14 months, aggregated after.
• Financial records: 7 years, per tax law.
• Client-project data: retained per the master services agreement, then deleted on request.

We use vetted third parties to run the site and our business. Current sub-processors:

Google Analytics and marketing pixels are loaded only if you accept the matching consent category.

Because our team and infrastructure span multiple regions, personal data may be transferred outside your country. Where required, we rely on the European Commission's Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum, and adequacy decisions.

We follow industry-standard practices: TLS in transit, encryption at rest for stored records, least-privilege access, audit logging, and mandatory two-factor authentication for the internal team. No system is 100% secure, and we do not claim to be an audited certification holder.

Our services are intended for businesses. We do not knowingly collect personal data from anyone under 16.

We update this policy when our practices change. The "Last updated" date at the top always reflects the current version.