Privacy Policy

Effective date: 23 September 2026
Last updated: 23 September 2026

This Privacy Policy explains how Suraket (“Suraket”, “we”, “us”, “our”) collects, uses, stores, shares, transfers, and protects personal information when you visit www.suraket.com (the “Website”), submit a form, email us, call or message the numbers we publish, or book a conversation through a calendar we offer.

Please read this policy before you send personal information. If you do not agree, do not use the Website or submit a form. Continued use after an update means the updated policy applies to information collected from that date forward.

This page is the public privacy notice for the Website. It is not our IT Security service page, not a client data-processing agreement, and not a substitute for a statement of work.

A–Z index

Section 02

Who we are

Suraket is a software studio. We design, build, rescue, and deliver software and AI-backed products for business clients. Commercial conversation is Canada-facing. Engineering is led from Islamabad, Pakistan. We work with companies in the United States, Canada, Saudi Arabia, Pakistan, and other markets.

For this Website, Suraket decides why and how personal information is processed. That makes us the organization responsible for the data described here (sometimes called a “controller”).

Privacy contact: info@suraket.com
Website: www.suraket.com
Phone / WhatsApp (as published on the site): +92 333 2777798

Section 03

Who this policy covers

This policy applies to personal information about:

Website visitors, including people who only read pages and do not send a form
People who use /contact/ or any other inquiry form
People who apply for work through /join-our-team/ or a careers page
People who apply for Paid Discovery, the 60-Day MVP program, the 8-Week AI Production Sprint, the 90-Day Dedicated Product Team, a rescue review, or any other offer form on the Website
People who book a call, request a feasibility conversation, or ask for an NDA
People who subscribe to Insights or another email list, if we later offer one and you opt in
People who email info@suraket.com or another published Suraket address

This policy does not apply to:

Employees and contractors of Suraket in their employment relationship (that is a separate internal notice)
Data inside a client’s product, cloud, or repository after a contract starts — that is governed by the NDA, statement of work, and any data-processing terms we sign
Third-party websites, app stores, payment providers, or products we only link to, including Postpoint when you use that product itself
Information that is not personal (for example, aggregated visit counts that cannot identify you)

Section 04

Definitions

Personal information means information that identifies you, or that can reasonably be linked to you — for example a name, email, phone number, IP address, CV, or a message that describes your company in a way that identifies you.
Process means any use of that information: collect, store, read, send, combine, archive, or delete.
Service providers (sometimes called processors) are companies that handle information for us, on our instructions — hosting, email, forms, analytics, and calendar tools.
Special category or sensitive information includes health, biometrics, religion, union membership, precise geolocation used as a sensitive category, government ID, and similar data. The Website is not designed to collect this. Do not send it in a public form.
Client project data means source code, credentials, customer records, and files inside a client system after we are engaged. It is not covered by this Website policy.

Section 05

What personal information we collect

We collect only what we need to reply, qualify work, run hiring, operate the Website, or meet the law. Categories:

A. Identity and contact

First name, last name, work email, phone or WhatsApp, city, country, company name, website, job title or role, and how you heard about Suraket.

B. Inquiry and project information

The problem you describe, who will use the software, platforms (web, iOS, Android), integrations, timeline, budget band, whether a vendor already failed, whether production is at risk, whether repository access is possible, and any specification, wireframe, or link you attach or paste.

C. Application and hiring information

CV or resume, LinkedIn URL, portfolio or GitHub, years of experience, ability to work in Islamabad, earliest start date, and the short note you write about a system you designed or shipped.

D. Technical and usage information

IP address, approximate location derived from IP (city or country, not a street address unless you type one), browser, operating system, device type, screen size, language, pages viewed, time on page, referring URL, click path, form start and submit events, error logs, and a unique cookie or similar identifier.

E. Communication records

Emails, WhatsApp or phone notes, calendar bookings, meeting recordings only if we tell you in advance and you agree, and our replies.

F. Marketing preferences

Whether you asked for Insights or a follow-up, unsubscribe choices, and bounce or complaint signals from our email tool.

G. What we do not collect through the Website as a practice

Payment card numbers, CVV, or bank logins. Invoices and payment run off this site.
Government identity numbers, passport scans, or national ID as a default field.
Health, genetic, biometric, or children’s data.
Passwords, production credentials, private keys, or full customer databases. Do not paste those into a form.
Precise GPS from your device, unless a future feature asks and you agree.

If you send something we did not ask for and should not hold (for example a spreadsheet of your customers), we will ask you to use an NDA channel or we will delete it when we notice it.

Section 06

How we collect information

Directly from you. Forms, email, phone, WhatsApp, uploads, and calendar bookings.
Automatically. Cookies, pixels if disclosed, server logs, and security tools when you load a page.
From you about a public profile. A LinkedIn, GitHub, or portfolio URL you submit. We do not scrape private profiles.
From our tools. Form, email, and hosting providers that pass us the submission and basic technical metadata.
From a colleague you name. If you list an approver or hiring reference, we use that only for the stated purpose.

We do not buy marketing lists to populate these forms. We do not require you to create an account to read the Website.

Section 07

Legal bases we rely on

Where a law asks us to name a legal basis (including GDPR and UK GDPR if they apply to you), we rely on one or more of the following:

Steps before a contract / contract. You asked for a conversation, a qualification, a proposal, or hiring review.
Legitimate interests. Running a secure website, understanding which pages work, keeping a record of what we promised, preventing fraud or abuse, and improving the studio. We balance this against your rights.
Consent. Optional cookies that are not necessary, a newsletter, a meeting recording, or keeping a CV for future roles after the live role closes. You can withdraw consent without affecting earlier lawful use.
Legal obligation. Tax, accounting, court orders, and regulatory requests we cannot lawfully refuse.
Vital interests. Only if we must protect a person’s safety. This is rare on a business website.

In Canada we also follow the principle that collection, use, and disclosure should be reasonable and limited to the purpose a person would expect, or a purpose we state clearly.

Section 08

How we use information

Reply to you and route the inquiry to the right person (commercial, technical, or hiring)
Qualify whether a project fits Paid Discovery, an offer program, rescue, or a custom engagement
Prepare a call, NDA, proposal, acceptance matrix, or a written decline
Review job applications against the posted role
Operate, secure, debug, and improve the Website and forms
Measure visits, form starts, and completions so we know what to fix
Send information you asked for; send marketing email only if you opt in or the law allows a soft opt-in to existing business contacts, with an unsubscribe in every message
Keep records for tax, dispute, and compliance
Detect spam, abuse, scraping, or attacks

We do not:

Sell personal information
Rent or trade applicant CVs or lead lists
Use Website form content to train a public AI model
Use client production data from a later engagement to market the Website
Make a solely automated decision that produces a legal or similarly significant effect about you (for example, an automated legal ban). A person reviews applications and project qualifications.

Section 09

Forms on this Website

Every form that collects a name or email must show a short privacy line and a link to this page. Submission is not a contract and is not acceptance into a program.

Contact and conversation forms

Typical fields: name, work email, phone, company, message. Use: reply and qualify. Line under the button: “We use the details you send only to reply and qualify the conversation. See our Privacy Policy.”

Offer and qualification forms

Includes Paid Discovery, 60-Day MVP, AI Production Sprint, 90-Day Product Team, and rescue review. Extra fields may include budget band, platforms, urgency, and whether production is at risk. Use: decide fit. Line: “We use this application to see whether the program is a fit. It is not an acceptance. Privacy Policy.”

Join Our Team

CV, LinkedIn, and your note are used only to review the live role (currently AI Solution Architect, Islamabad) unless you later agree to be considered for another role. Line: “We use your CV and note to review this role. We do not sell applications. Privacy Policy.”

Calendar booking

If you pick a time, the calendar tool will receive your name, email, and the notes you type. That tool’s own policy also applies.

Failed or partial submissions

If a form errors after you typed data, a copy may sit in your browser or in a temporary log. Clear the page if you do not want to finish. We try not to keep abandoned drafts longer than needed to debug the form.

Section 10

Job applicants

If you apply:

We share your materials with people involved in that hire (typically engineering and company leadership).
We may look at the public pages you linked.
We do not run a secret background check through this Website. Any later check would be explained first.
We do not require diversity, health, or family data on the form.

If you are not selected, we delete or archive the file after the retention period below, unless you ask us to keep it for a future role.

You may request deletion of an application that is still in review; we will confirm when the file is removed, except where we must keep a short record of the process.

Section 11

Marketing, Insights, and email

A sales reply to a form you sent is not marketing. It is the conversation you started.

Marketing email (Insights, events, unused offers) is sent only if you opt in, or where the law allows us to email an existing business contact about similar services, always with unsubscribe.

We do not add job applicants to a marketing list from the CV form. Unsubscribe: use the link in the email or write to info@suraket.com with the subject “Unsubscribe”.

Section 12

Cookies and similar technologies

A cookie is a small file stored on your device. We may also use local storage, pixels, or similar tools. Types:

Strictly necessary

Keep the site, a form, a security check, or load balancing working. These do not require consent in most places. Blocking them may break submit.

Preferences

Remember a dismissed notice or a language choice. Used only if we offer that feature.

Analytics

Help us see which pages are read and where forms fail. We use this to improve the Website, not to sell a profile.

Advertising / remarketing

Only if we later run ads that need them. If we add them, the cookie notice will name them. Do not install ad pixels silently.

You can refuse or delete cookies in your browser. Where a consent banner is required, we will not set non-necessary cookies until you accept. The banner must link here and offer a way to change the choice later.

Log files on our host may still record an IP and user-agent for security even when analytics cookies are off.

Section 13

Analytics, tags, and advertising

If we use an analytics product (for example a privacy-respecting or standard web analytics tool), it will receive technical and usage information described above. IP addresses may be truncated where the tool allows it.

If we use advertising platforms later, they may set their own cookies. That will be listed in the cookie notice. You can use industry opt-outs where available, plus browser controls.

We do not allow analytics or ad tools to use Website form fields (your message, CV, or budget band) as an advertising audience.

Section 14

Video, maps, chat, and social embeds

The Website may embed or link to YouTube, Vimeo, a calendar, WhatsApp, LinkedIn, or similar services. If you play a video or open those services, they may collect information under their own policies. A CEO or explainer video on /about/ is an embed of that kind.

We are not responsible for those third-party practices. Prefer “click to load” embeds where the platform allows it so the third party does not run until you ask.

Section 15

Automated processing

We may use filters to block spam, obvious bot submissions, or malware in uploads. That is security, not a hiring or credit decision.

We do not use solely automated processing to decide whether you are hired or whether a project is accepted. A person reviews those decisions.

Section 17

International transfers

Personal information sent through the Website may be stored or accessed in Canada, Pakistan, the United States, and any country where a service provider operates. Laws in those places may differ from the laws where you live, including how governments can request data.

When we transfer information out of a region that requires safeguards (for example the EEA or UK), we use a lawful tool such as the provider’s appropriate contract clauses, an adequacy decision if one exists, or your informed request that we handle the inquiry even though a transfer will occur.

If you are in the EEA, UK, or Switzerland and need us to review special-category data, write first. We will say whether we can take the matter and on what terms.

Section 18

How long we keep information

We keep personal information only as long as the purpose requires, then delete or irreversibly archive it, unless a longer hold is required by law or a dispute.

Contact and offer inquiries

Active while we reply and qualify. Then up to 24 months after the last meaningful contact, unless a proposal, contract, or dispute is still open.

Job applications

Through the close of the live role, then up to 12 months, unless you ask us to keep the file for a future role or a legal claim requires a longer hold.

Server and security logs

Typically 30 to 90 days, longer if we are investigating an incident.

Analytics

In identifiable form only as long as the tool’s setting requires; then aggregated where possible.

Contracts, invoices, tax records

For the period company and tax law require in the relevant country (often six to seven years after the year of the transaction).

Marketing unsubscribe records

Long enough to honour the opt-out and prove we honoured it.

When we delete a file, backup copies may persist for a short technical period until the next backup cycle overwrites them.

Section 19

Security

We use measures that are reasonable for a studio of our size and the risk of the data:

HTTPS on the public Website
Access limited to people who need the record
Business email and form tools rather than personal inboxes as the system of record
Malware checks on uploads where the tool allows it
Revoking access when a person leaves a project or the company

No method of transmission or storage is perfectly secure. You send forms at your own residual risk. Do not put production credentials or regulated personal files in a public form.

Breach notice. If we become aware of a breach that is likely to affect your personal information, we will investigate, contain what we can, notify you at the email we hold when the law or the risk requires it, and notify any regulator the law requires, within the deadline that applies.

Section 20

Your rights

Depending on where you live, you may have some or all of the following rights:

Access. Ask whether we hold information about you and receive a copy.
Correction. Ask us to fix information that is wrong or incomplete.
Deletion. Ask us to erase information we no longer need, subject to legal holds.
Restriction. Ask us to pause certain uses while a dispute is reviewed.
Objection. Object to use based on legitimate interests, including some analytics or marketing.
Portability. Receive information you gave us in a common machine-readable format, where the law gives this right.
Withdraw consent. Where we relied on consent. Withdrawal does not undo earlier lawful use.
Complain. Lodge a complaint with a data-protection or privacy authority where you live or where you think the issue occurred.
Non-discrimination. We will not deny the Website or a form because you exercised a privacy right.

How to send a request. Email info@suraket.com with the subject “Privacy request”. Tell us your name, the email you used on the form, which right you want, and enough detail to find the record. We may ask for extra information to confirm it is you. We will not require a fee unless a request is clearly unfounded or excessive, and only if the law allows a fee.

We aim to respond within 30 days, or sooner if a local law sets a shorter clock. If we need more time, we will say why.

We may refuse a request when the law allows it — for example if we cannot verify you, if the request would expose someone else’s information, or if we must keep a record for tax or a dispute. We will explain the reason.

An authorized agent may write on your behalf if you give us proof of authority that we can reasonably accept.

Section 21

Region-specific notes

Canada

We handle Website personal information in line with Canadian federal private-sector privacy principles (PIPEDA) where they apply, and with any applicable provincial law. You may contact us at info@suraket.com. You may also complain to the Office of the Privacy Commissioner of Canada or your provincial commissioner if you are not satisfied.

United States, including California

We collect the categories listed in Section 5 for the purposes in Section 8. We do not sell personal information. We do not share it for cross-context behavioural advertising as those terms are used in the California Consumer Privacy Act (as amended), unless we update this policy and give you an opt-out. California residents may request access, deletion, and correction using the method in Section 20. We will not discriminate against you for that request. If we later offer a “Do Not Sell or Share” link, it will sit in the footer next to this policy.

European Economic Area and United Kingdom

If GDPR or UK GDPR applies to a particular use, our legal bases are in Section 7, transfers are in Section 17, and rights are in Section 20. You may complain to your lead supervisory authority or the UK Information Commissioner’s Office. We do not maintain an EU or UK representative unless we later appoint one and name them here.

Pakistan

We will follow applicable Pakistani personal-data rules as they come into force, including any requirement to keep certain records in-country or to honour access and correction requests. Islamabad engineering staff may access Website inquiries when the work is technical or the inquiry is a job application.

Saudi Arabia and other Gulf markets

If Saudi or other Gulf data-protection law applies to your inquiry, we will honour access, correction, and deletion requests through info@suraket.com and will not use your Website data for a purpose incompatible with this policy without a new notice or your agreement, as that law requires.

Section 22

Children

The Website is for business use. We do not knowingly collect personal information from anyone under 16, and we do not target children. If you believe a child submitted a form, write to info@suraket.com. We will delete the record.

Section 23

Links to other sites and featured work

The Website may link to client sites, cloud vendors, calendars, or articles. Their policies apply once you leave suraket.com.

Featured work such as Postpoint is described as delivery evidence. Using Postpoint or another product is covered by that product’s own terms and privacy notice, not by this page.

Section 24

Client project data is separate

After you hire Suraket, source code, credentials, environments, and your customers’ data are handled under:

the NDA, if one is signed
the statement of work and acceptance matrix
any data-processing addendum
your instructions on access and region

This Privacy Policy does not give us a right to use that project data for Website marketing, model training, or an unrelated product. Least-privilege access and off-boarding at handover are part of delivery, not part of this public notice.

Section 25

Do Not Track and global privacy controls

Some browsers send a Do Not Track signal. There is no common standard for how sites must respond. We honour cookie-banner choices and, where we reasonably detect a Global Privacy Control or similar opt-out signal for sale/share, we will treat it as an opt-out of sale or sharing if we ever engage in that activity.

Section 26

Changes to this policy

We may update this page. The “Last updated” date will change. For a material change — for example a new advertising cookie, a new use of CVs, or a sale of the company — we will post a short notice at the top of this page and, where we have your email and the law requires it, send a message. The new text applies to information collected after the update. Older information stays under the rules that applied when we collected it, unless the law lets us apply the new rule or you agree.

Section 27

How to contact us

Privacy and data-rights requests: info@suraket.com · subject line “Privacy request”
Unsubscribe: info@suraket.com · subject line “Unsubscribe”
General inquiries: /contact/ or info@suraket.com
Phone / WhatsApp: +92 333 2777798
Website: www.suraket.com

If we appoint a data-protection officer or an EU/UK representative, we will name them here.

Privacy Policy

Who we are

Who this policy covers

Definitions

What personal information we collect

A. Identity and contact

B. Inquiry and project information

C. Application and hiring information

D. Technical and usage information

E. Communication records

F. Marketing preferences

G. What we do not collect through the Website as a practice

How we collect information

Legal bases we rely on

How we use information

Forms on this Website

Contact and conversation forms

Offer and qualification forms

Join Our Team

Calendar booking

Failed or partial submissions

Job applicants

Marketing, Insights, and email

Cookies and similar technologies

Strictly necessary

Preferences

Analytics

Advertising / remarketing

Analytics, tags, and advertising

Video, maps, chat, and social embeds

Automated processing

Who we share information with

Inside Suraket

Service providers

Professional advisers

Legal and safety

Business change

With your direction

International transfers

How long we keep information

Contact and offer inquiries

Job applications

Server and security logs

Analytics

Contracts, invoices, tax records

Marketing unsubscribe records

Security

Your rights

Region-specific notes

Canada

United States, including California

European Economic Area and United Kingdom

Pakistan

Saudi Arabia and other Gulf markets

Children

Links to other sites and featured work

Client project data is separate

Do Not Track and global privacy controls

Changes to this policy

How to contact us

Related pages on this site