Privacy Policy & Confidentiality Statement

AK Imagination Studio works with unreleased editorials, unannounced product designs and campaigns under embargo. We treat everything you send as confidential by default, you do not have to ask.

• Your images are never published, shared, or shown in a portfolio, showreel or social post without your prior written consent.
• Consent for portfolio use is asked for separately, per project. Agreeing to these terms is not agreeing to that.
• An optional Non-Disclosure Agreement can be attached to any order. Once signed it is immutable, neither party can quietly rewrite the terms afterwards, and only an administrator can revoke it, which is recorded rather than erased.
• Access to a project is limited to the personnel working on it.

We collect the minimum needed to run an account and deliver an order. We never sell your data, and nothing you send us as a client brief is used for advertising or profiling.

• Account: your email address and name, held so you can sign in and so we know who an order belongs to.
• Orders: the project name, service type, image count and your brief, capped at 500 characters.
• NDA (only if you request one): your name, company name and mobile number, together with your signature and the timestamp our server recorded when you signed.
• Reviews: whatever name you choose to publish alongside your review. Reviews are submitted anonymously and are not linked to your account.
• Contact inquiries: the name, email, optional phone number and message you send through the contact form.
• Analytics, only with your consent: pages viewed, approximate location by country, and browser and device type, collected by Google Analytics. Never your brief, your images or your file links.

This is the part most studios get wrong, so it is worth being precise: at this stage we do not host your files at all. The order form takes a link, a Google Drive, Dropbox or WeTransfer URL, and your originals never leave the storage you already control. Finished work is returned the same way.

• We store the URL you give us, not a copy of the file behind it.
• That means you can revoke our access at any moment from your own storage provider, without asking us to do anything.
• If direct file hosting is added in a future phase, this page will be updated before it ships, not after.

Authentication is handled by Supabase Auth. We never see or store your password, it is hashed by the auth provider and never reaches our application code.

• Your session is held in an httpOnly cookie, which means page scripts cannot read it. We do not keep auth tokens in local storage.
• Strictly necessary cookies cover sign-in state and your language preference. Analytics and advertising cookies are optional, off until you accept them, and listed in full in the cookies clause below.
• Every record is protected at the database level by row-level security, so a request for another client’s orders is refused by the database itself, not merely hidden by the interface.
• You can ask us to close your account and delete your data at any time. Write to us and we will confirm when it is done. To withdraw cookie consent, use the Cookie Settings link in the footer, which takes effect immediately and needs no request to us.

Two of the cookies on this site are strictly necessary and carry no choice; the rest are off until you switch them on. We ask once, remember the answer for thirteen months, and you can change it whenever you like from the Cookie Settings link in the footer.

• Strictly necessary: your Supabase sign-in session, held in an httpOnly cookie that page scripts cannot read, and your language preference. Both are exempt from consent because the site cannot function without them.
• Analytics (optional, off by default): Google Analytics 4 sets _ga to count returning visitors and tell us which services people actually look at. Declining costs you nothing.
• Advertising (optional, off by default): if a Google Ads campaign is running, conversion cookies tell us which campaign brought a client to the studio. No advertising cookie is set unless you accept this category.
• Until you accept, Google's tags run in consent-denied mode and store no identifiers at all. We use Google Consent Mode v2, so this is enforced in the tag itself rather than promised in a policy.