Privacy Policy & Confidentiality Statement

AK Imagination Studio works with unreleased editorials, unannounced product designs and campaigns under embargo. We treat everything you send as confidential by default, you do not have to ask.

• Your images are never published, shared, or shown in a portfolio, showreel or social post without your prior written consent.
• Consent for portfolio use is asked for separately, per project. Agreeing to these terms is not agreeing to that.
• An optional Non-Disclosure Agreement can be attached to any order. Once signed it is immutable, neither party can quietly rewrite the terms afterwards, and only an administrator can revoke it, which is recorded rather than erased.
• Access to a project is limited to the personnel working on it.

We collect the minimum needed to run an account and deliver an order. There is no advertising, no profiling and no third-party analytics sale.

• Account: your email address and name, held so you can sign in and so we know who an order belongs to.
• Orders: the project name, service type, image count and your brief, capped at 500 characters.
• NDA (only if you request one): your name, company name and mobile number, together with your signature and the timestamp our server recorded when you signed.
• Reviews: whatever name you choose to publish alongside your review. Reviews are submitted anonymously and are not linked to your account.
• Contact inquiries: the name, email, optional phone number and message you send through the contact form.

This is the part most studios get wrong, so it is worth being precise: at this stage we do not host your files at all. The order form takes a link, a Google Drive, Dropbox or WeTransfer URL, and your originals never leave the storage you already control. Finished work is returned the same way.

• We store the URL you give us, not a copy of the file behind it.
• That means you can revoke our access at any moment from your own storage provider, without asking us to do anything.
• If direct file hosting is added in a future phase, this page will be updated before it ships, not after.

Authentication is handled by Supabase Auth. We never see or store your password, it is hashed by the auth provider and never reaches our application code.

• Your session is held in an httpOnly cookie, which means page scripts cannot read it. We do not keep auth tokens in local storage.
• Cookies are strictly functional: sign-in state and, once multi-language support ships, your language preference. There are no advertising or tracking cookies.
• Every record is protected at the database level by row-level security, so a request for another client’s orders is refused by the database itself, not merely hidden by the interface.
• You can ask us to close your account and delete your data at any time. Write to us and we will confirm when it is done.