Privacy Policy

1. Introduction

This Privacy Policy explains what information NexaStack Technologies collects through this website, why, and what is done with it. It applies to anyone browsing the public site, and to anyone who submits the Contact form or the Quotation form. NexaStack Technologies is a founder-led web development studio based in Dhaka, Bangladesh, working with clients both in Bangladesh and internationally.

This policy covers this website only. It does not cover any external site you reach by following a link from here, including the third-party services listed in Third-Party Services, each of which has its own privacy policy. See also our Terms and Conditions for the terms governing use of this website and its services.

2. Information We Collect

The only personal information collected is what you choose to submit through one of this site’s two forms, plus standard technical information every website receives as part of normal server operation.

Contact form

• Full name
• Email address
• Phone or WhatsApp number (optional)
• Company name (optional)
• Subject and message
• Your preferred contact method (email, phone, or WhatsApp)

Quotation form

• Full name, email address, telephone number, company name (optional), country
• Project details: project type, the services you’re interested in, your business objectives, who the project is for, and whether it’s a new or existing project
• Project requirements: required features, approximate number of pages, design requirements, whether you need an admin dashboard or user authentication, any third-party integrations (optional), and links to reference websites (optional)
• Budget range, preferred start date, target completion date (optional), and maintenance preference
• Any file attachments and an additional message you choose to include (both optional)

Technical information

Like virtually any website, the infrastructure that serves this site automatically logs standard technical information for every visitor as part of normal server operation — such as IP address and browser type. This is generated by the hosting providers themselves, not collected through any code on this site, and is not linked to your name unless you separately submit a form.

What is not collected

• No tracking or advertising cookies
• No analytics or behavioural-tracking tool of any kind
• No third-party advertising pixels
• Personal information is never sold or rented to third parties

3. Purpose of Data Collection

Information submitted through this site is used only to:

• Respond to a message sent through the Contact form
• Review a project request and prepare a quotation in response to the Quotation form
• Operate, secure and troubleshoot the website itself

Information is never used for advertising, profiling, or any purpose beyond what you submitted it for.

4. Contact and Quotation Submissions

Both forms are validated on the server before anything is stored — the check that runs in your browser is a convenience, not the real safeguard. Once validated, a submission is stored directly in NexaStack Technologies’s database and reviewed from there to respond to your inquiry or quote request.

[Open item] No automatic confirmation or notification email is sent yet — a transactional email provider for this hasn’t been chosen. Until one is, every submission is still reliably stored and reviewed directly; you just won’t receive an automated email receipt in the meantime.

Both forms are rate-limited per connection to reduce automated spam and abuse — see Security Practices.

5. Cookies and Analytics

This website does not set any cookies for visitors browsing the public site, and does not use any analytics, behavioural-tracking, or advertising tool. Your choice of light or dark theme is remembered using your browser’s local storage, which stays on your device and is never sent to NexaStack Technologies or anyone else.

[Open item] A password-protected admin area is planned for a later phase of this site, for NexaStack Technologies’s own internal use, and is not built yet. When it exists, it will use a single session cookie, readable only by this site’s own server, solely to keep that internal login signed in — never for tracking visitors, advertising, or analytics. This section will be updated if that changes, or if any analytics tool is ever added.

6. Data Storage

Form submissions are stored in a MongoDB Atlas database. This site’s specific hosting region isn’t published here.

Quotation file attachments are designed to be stored with Cloudinary, a media-hosting service. [Open item] That integration is not active yet, so file attachments aren’t currently being transmitted anywhere — the Quotation form can still be submitted in full without one. Once Cloudinary is active, this section will describe exactly what it can access.

7. Third-Party Services

This site is built to use a small number of third-party services. Each is listed below with what it’s used for and a link to its own privacy policy.

• MongoDB Atlas — stores Contact and Quotation form submissions. MongoDB’s privacy policy
• Cloudinary — intended for storing Quotation file attachments; not active yet, see Data Storage. Cloudinary’s privacy policy
• Cloudflare Turnstile — a spam-prevention check designed to run on the Contact form; not active yet. Cloudflare’s privacy policy
• Vercel — hosts the public website. Vercel’s privacy policy
• Render — hosts a backend service used by this site. Render’s privacy policy

This site does not currently use any analytics, advertising, or tracking service — see Cookies and Analytics.

8. Data Retention

Information submitted through the Contact or Quotation form is kept for as long as necessary to respond to your inquiry or to discuss and deliver a project, unless a longer period is required by law. [Open item] A specific retention schedule — for example, automatic deletion after a fixed number of months of inactivity — has not been finalised yet. If you’d like your information deleted sooner, you can request that directly at any time; see Your Rights.

9. Security Practices

The following measures are actually in place today:

• Every form submission is validated on the server before being stored — this, not the in-browser check, is the real safeguard
• A second layer of validation at the database level
• Per-connection rate limiting on both forms, to reduce automated abuse
• Quotation file attachments are checked by their actual file content, not just the file name or the type your browser reports
• The site is served over HTTPS by its hosting providers

[Open item] A password-protected admin area, with bcrypt-hashed credentials and an HTTP-only session cookie, is planned for a later phase and is not built yet — see Cookies and Analytics. No part of this site currently holds any third-party security certification, and this policy does not claim one.

10. Your Rights

You can contact NexaStack Technologies at any time to ask what information you’ve submitted, to correct it, or to have it deleted. NexaStack Technologies will respond directly and act on that request — see Contact Details below. [Open item] Which specific data-protection law applies to you depends on where you’re located and on decisions NexaStack Technologies hasn’t finalised yet, so this section describes a practice NexaStack Technologies follows for everyone, rather than citing a specific regulation.

11. Contact Details

Questions about this policy, or about any information you’ve submitted, can be sent to:

12. Last Updated

This policy was last updated on September 18, 2026. It will be revised as the practices it describes change — in particular the items marked [Open item] above, once those are actually built or decided.