Portal Privacy Policy

Who is responsible

Afilal Mohammed operates the MeedAgency client project portal and is the controller of the personal data described here.

What we collect

Account data: your name, e-mail address, password hash, chosen language, and the times you signed in.

Business and project data: your business name, industry, city and contact details, and your project's name, reference and scope.

Onboarding answers: your tagline, business description, goals, audience, what you offer, style preferences, the pages you want, your content notes, examples you point us to and any special requirements.

Media you upload: your logo and any images you give us for the website.

Commercial terms and acceptance: the project total, the deposit, the portal fee, the version of the terms you were shown, and the time and account that accepted them.

Payment and accounting records: each payment request, its amount and currency, and each credit or refund recorded against your project, with the date, the reference and the member of staff who confirmed it.

Delivery records: progress updates, the pages we build in your development preview, your feedback and its resolution, your final approval and the version it applies to, and your deployment record.

Hosting readiness information: your domain name, and any non-sensitive note you add about your hosting, such as the name of your hosting provider. We do not collect, and the portal refuses to store, passwords, keys or tokens.

Technical data: your IP address in hashed form for rate limiting, your browser type, and error logs.

What we do not collect

We never receive your card number, expiry date or security code.

We never store your hosting credentials. The portal rejects text that looks like a password, an FTP or cPanel login, an SSH key, an API token or a URL with a login in it, and there is no field anywhere in it that holds one.

Why we use it

To build the website you asked for, to run your project portal, to request and record payment, to deploy the finished website to your hosting, to provide support, to keep the portal secure, and to meet our legal and accounting obligations.

We do not sell personal data, and we do not use your content to advertise to your customers.

Payments

Payments for a client project are currently arranged directly with us. We record what was requested, what was credited, when, and who confirmed it. We do not process card payments in the portal.

If we later use a payment provider for client projects, it will be named in your commercial terms before you are asked to pay, and this policy will be updated to describe what it receives.

Who else processes data for us

Hosting and database infrastructure for the portal itself, and an outbound e-mail provider for account and project notifications.

Each is used only for what is necessary to run the portal, and under its own terms.

Cookies

The portal sets a session cookie so you stay signed in, and stores your language preference on your account rather than in a cookie. No advertising or third-party tracking cookie is set by the portal.

How long we keep it

Account, project, onboarding and delivery data: for as long as your account exists.

Your development preview stays available to you, behind your sign-in, for 30 calendar days after your website's production deployment, labelled as an archived development preview. During that time it stays private and is sent with instructions not to index or cache it. After those 30 days we may delete the archived preview and the temporary development files behind it. We are not required to keep it indefinitely.

Deleting the archived preview does not affect your live website, which runs on your own hosting and domain.

Temporary hosting credentials you share with us for deployment are never stored in the portal. We delete them from our systems after deployment.

Payment and accounting records: kept for as long as accounting and tax law requires.

Rate-limiting records and error logs: kept for security. They are not currently deleted on a fixed schedule.

We do not operate an automatic deletion schedule, and we do not claim one. If you want your data removed, ask us at support@meedagency.com and we will do what we are not legally required to keep.

Security

Access is over HTTPS. Passwords are stored as hashes and never in a readable form. Every database query is parameterised, every form is protected against cross-site request forgery, and each client's data is isolated from every other client at the data-access layer.

Your development preview requires a sign-in, is sent with instructions not to index or cache it, and is never reachable from the public internet.

Your rights

You can ask for a copy of your personal data, ask us to correct it, or ask us to delete it where we are not required to keep it.

Write to support@meedagency.com. We will ask you to confirm your identity before acting on a request.

Changes and contact

We will update this policy when what we do changes, and the date at the top will change with it.

Contact support@meedagency.com with any question about this policy.