Privacy policy.

Last updated: 20 October 2026

This policy explains what personal information TechEsthete collects, why we collect it, who we share it with, and the choices and rights you have. In short: we collect what you send us, a small amount of technical data that our website host, and Google when it serves our fonts, receive when you visit, and analytics about how our website is used, measured with Mixpanel. We use it to reply to you, work with you and run our business. We don't sell it, and we don't use advertising cookies or trackers. When we work inside a client's systems, we handle that data only on the client's instructions. We also run an Amazon Ads application, and we explain how it handles Amazon data in its own section below.

Who we are

TechEsthete is an engineering firm, founded in 2013, that works on advertising data. We build pipelines from ad platforms into data warehouses in our clients' own cloud accounts. On top of that we build dashboards, AI insights and AI agents that act within rules our clients approve. Our clients are agencies, brands and ad-tech and SaaS platforms in the US, Canada, the UK, the EU, the UAE and Australia.

The website at https://www.techesthete.com is operated by Techesthete FZE, Business Centre, Sharjah Publishing City Free Zone, Sharjah, UAE. In this policy, "TechEsthete", "we", "us" and "our" mean Techesthete FZE and its affiliated offices:

• Canada (North America): 13387 Old Yale Rd, Surrey BC V3T 0V6, Canada. Phone +1 (778) 896-4353 (call or WhatsApp)
• UAE: Techesthete FZE, Business Centre, Sharjah Publishing City Free Zone, Sharjah, UAE. Phone +971 52 778 7715
• Pakistan (headquarters): 333, Block J1 Johar Town, Lahore 54000, Pakistan. Phone +92 321 6955844
• India: Commercial Street and Infantry Road, Bengaluru 560001, India

For website visitors, newsletter subscribers and prospects, Techesthete FZE is responsible for your personal information (the "controller" under EU and UK law). For clients, the controller is the TechEsthete entity named in your agreement.

You can reach us about anything in this policy at hello@techesthete.com.

What this policy covers

This policy covers personal information about:

• People who visit our website
• People who contact us, fill in our forms, book calls or sign up for our newsletter
• Business contacts at our clients, prospects, partners and suppliers
• People who use our Amazon Ads application through Login with Amazon (see "Our Amazon Ads application" below)

It does not cover data we process inside a client's systems as part of an engagement. In that work, the client decides what happens to the data and we act on their behalf. "Data we process for clients" below explains how that works. If your information is in one of our clients' systems, please contact that client first.

What we collect and where it comes from

Information you give us

• Contact form and "ad data plan" form: your name, work email, company, company type, the ad platforms you use, your ad spend band and currency, how many client accounts you manage, where your data lives today, your top priority, and anything you write in the message box.
• Newsletter signup: your first name and email address.
• Emails and calls: what you tell us when you email us, book a call or speak with us. This includes your contact details, job title and anything you choose to share about your business. We may take notes during calls.
• Client relationship records: names, work contact details and roles of the people we work with at clients, plus billing contacts and the details we need to invoice and get paid.

Please don't send us sensitive personal information (for example health data or government ID numbers) through our forms or by email. We don't need it.

Information collected automatically

Our website hosting and content delivery network (CDN) provider keeps standard server logs. They record your IP address, browser and device type (user agent), the pages you request and timestamps. These logs help keep the site running and secure.

Our pages load fonts from Google Fonts, a service run by Google (fonts.googleapis.com and fonts.gstatic.com). When your browser requests the fonts, Google receives your IP address and browser details, such as the user agent, so it can deliver them. Google Fonts does not set cookies. Google's use of this information is covered by Google's Privacy Policy.

Website analytics (Mixpanel)

We use Mixpanel, an analytics service run by Mixpanel, Inc. in the United States, to understand how our website is used: which pages and links help visitors and which ones lead to an enquiry. Your browser sends this data to our own web address (www.techesthete.com/bx/), which passes it on to Mixpanel's US data region. We don't use advertising cookies, tracking pixels or advertising trackers.

• What is measured: the pages you view and how you arrived (the referring website and campaign tags such as utm_source), clicks, including on our phone, WhatsApp and email links and our buttons, how far you scroll and read articles, the questions you open in our FAQs, use of the hours-saved calculator, and whether you start or send one of our forms and whether it went through. Mixpanel also records general device information (browser, operating system, screen size) and uses your IP address to work out your approximate location (country, region and city); it doesn't keep the IP address itself.
• What is never sent: what you type into our forms, including your name, email address, phone number, company and message. Automatic click tracking doesn't capture the text of what you click, and clicks inside forms aren't captured at all.
• A random identifier: Mixpanel gives your browser a random ID, kept in your browser's local storage (not in a cookie), so visits from the same browser can be counted together. We don't link it to your name or email address, and we don't build profiles about you.
• Session replay: visits we measure are also recorded as an masked replay of page movement, scrolling and clicks, so we can see where pages are confusing. Our forms and the privacy notice are replaced by blank blocks in the replay, and anything typed anywhere on the site is masked.
• When it starts: if you're in the European Union, the European Economic Area (Iceland, Liechtenstein and Norway), the United Kingdom or Switzerland, or if our site can't tell where you are, analytics starts only after you press Accept in the privacy notice. Everywhere else it starts when you open the site, and the notice lets you turn it off. Your browser asks our hosting provider (Cloudflare) for your country only to make this check.
• Your choice: pressing Decline stops analytics at once, stops any replay recording and deletes the random ID from your browser, and nothing is measured on later visits. You can change your choice at any time with the "Privacy choices" link at the bottom of every page. Your choice is remembered in your browser's local storage.
• When you send a form: our server records in Mixpanel that an enquiry or newsletter sign-up was received, with its reference number, the form type, the ad platforms you ticked, the ad spend band and currency (on the ad data plan form) and the address of the page you sent it from. That record never contains your name, email address, phone number, company or message, and it is sent without your IP address. It is made whether or not you pressed Accept, because it is how we count enquiries. If analytics was running in your browser, the record is linked to your browser's random ID, so we can see which pages led to the enquiry.

• If we go on to work together: we also record the later steps of an enquiry in Mixpanel (for example that it was qualified, that a quote was sent or viewed, whether it was won, and project milestones), using only categories, dates and amounts in US dollars, under the same random ID or a reference number. These records never contain your name, contact details, company or messages. When we send a proposal through a tracked link, opening it is recorded once, without your IP address.

Our Cookie Policy lists everything our website stores in your browser: the analytics items above, your privacy choice and your light or dark mode setting.

Spam protection on our forms

Our forms use Cloudflare Turnstile to check that a person, not a bot, is sending them. Turnstile reads technical signals from your browser (such as IP address and browser details) for that check only. We also screen messages for link spam; messages flagged as spam are kept for our review and not answered. Our legal basis is our legitimate interest in keeping the forms free of abuse.

Information from other sources

Sometimes we get your business contact details from someone else, such as a colleague who introduces us or a client who adds you to a project. We may also look up publicly available business information, such as your company's website, to prepare for a conversation.

How and why we use your information

EU and UK data protection law requires us to explain the legal reason, or "lawful basis", for each use. Where other laws apply, we use your information for the same purposes.

• To reply to your inquiry and prepare proposals. When you fill in a form or contact us, we use what you send to answer you, scope your needs and suggest a plan. Lawful basis: taking steps at your request before entering a contract, and our legitimate interest in responding to business inquiries.
• To deliver our services and manage the client relationship. This covers communicating with your team, scheduling, project management, invoicing and collecting payment. Lawful basis: performing our contract with you or your organization, and our legitimate interest in running client relationships well.
• To send our newsletter and occasional updates. Lawful basis: your consent when you sign up. For existing business contacts, our legitimate interest, where the law allows it. See "Marketing emails" below.
• To run, secure and improve our website. We use server logs to keep the site available, prevent abuse and investigate security issues. Lawful basis: our legitimate interest in a secure, working website.
• To understand how our website is used. We use Mixpanel analytics and session replay (see "Website analytics (Mixpanel)") to see which pages and links help visitors and which lead to enquiries, and to fix pages that confuse people. Lawful basis: your consent if you're in the EU, the EEA, the UK or Switzerland; elsewhere, our legitimate interest in improving our website, which you can object to at any time by pressing Decline.
• To meet legal obligations. This includes keeping accounting and tax records, responding to lawful requests and meeting regulatory requirements. Lawful basis: legal obligation.
• To protect our rights. We may use information to enforce our agreements, resolve disputes and defend legal claims. Lawful basis: our legitimate interest in protecting our business.

Where we rely on legitimate interests, we have weighed our interests against your rights and expectations. You can ask us for more detail, and you can object (see "Your rights").

Where we rely on consent, you can withdraw it at any time. Withdrawing doesn't affect anything we did before you withdrew.

We don't make decisions about you based solely on automated processing that have legal or similarly significant effects.

Marketing emails

We send marketing emails only where the law allows. That means when you've signed up for our newsletter, or when you're an existing business contact and the law where you are permits us to email you.

Every marketing email includes an unsubscribe link. You can also email hello@techesthete.com and ask us to stop. When you unsubscribe, we keep your email address on a suppression list so that we don't email you again by mistake. Unsubscribing from marketing won't stop service emails about an engagement you're part of.

Who we share your information with

We share personal information only as described here.

• Service providers (processors). We use companies that provide services to us. Our main categories are website hosting and CDN, email, customer relationship management (CRM), and video-call and scheduling tools. They may use your information only to provide their services to us and must protect it.
• Mixpanel. Mixpanel, Inc. receives our website analytics and session replays as our service provider, stores them in its US data region and uses them only to provide its service to us (see "Website analytics (Mixpanel)"). Mixpanel's Privacy Policy explains how it handles data.
• Google Fonts. When you visit our website, your browser requests our fonts from Google, which receives your IP address and browser details to serve them (see "Information collected automatically"). Google handles that information under its own privacy policy.
• Our own offices. Our team works from the UAE, Pakistan, India and Canada. People in any of these offices may access your information when they need it for their work.
• Professional advisers. These include lawyers, accountants, auditors and insurers, under duties of confidentiality.
• Legal requests and protection. We share information with authorities or others when the law requires it, or when we believe in good faith that it's needed to protect our rights, your safety or the safety of others, or to investigate fraud or security problems.
• Business transfers. If we're involved in a merger, acquisition, financing or sale of assets, personal information may be transferred as part of that deal. If that happens, we'll require the recipient to handle it in line with this policy.
• With your direction. We share information with others when you ask us to, or when you agree to it.

We don't sell personal information. We also don't "share" it, as California law defines that term, for cross-context behavioral advertising.

International transfers

We're an international team, so your information may be accessed or stored outside the country where you live. That includes the UAE, Pakistan, India and Canada, where our offices are, and the countries where our service providers operate. Data protection laws in those countries may differ from those where you live.

When we transfer personal information out of the UK or the European Economic Area to a country without an adequacy decision, we protect it with the European Commission's Standard Contractual Clauses and, for UK data, the UK International Data Transfer Addendum. Where those don't apply, we use another lawful transfer mechanism. You can ask us for more information about these safeguards.

For transfers that involve client data, see "Data we process for clients" below.

How long we keep your information

We keep personal information only as long as we need it for the reasons in this policy, or as long as the law requires. Typically:

• Inquiries that don't become engagements: up to 24 months after our last contact, so we have context if you get in touch again
• Client and business contact records: for the life of the relationship, plus up to 6 years for legal, accounting and tax purposes
• Newsletter subscribers: until you unsubscribe. After that, we keep only your email on our suppression list.
• Website server logs: typically up to 90 days, unless we need them longer to investigate a security issue
• Website analytics (Mixpanel): analytics events are kept in our Mixpanel project for as long as we use Mixpanel, under Mixpanel's standard data retention. Session replays are deleted automatically when Mixpanel's replay retention period ends (30 days by default). The random ID stays in your browser until you press Decline or clear your browser's site data
• Amazon Ads application data: see "Our Amazon Ads application" below

When we no longer need information, we delete it or anonymize it so that it no longer identifies you.

How we protect your information

We use technical and organizational measures designed to protect personal information. They include encrypted connections (HTTPS), access controls that limit access to people who need it, and security monitoring. In client work, engineers access systems only through the client's own sign-in and permission controls, as described below.

No method of transmission or storage is completely secure, so we can't guarantee absolute security. If we become aware of a breach that affects your personal information, we'll notify you and the relevant authorities where the law requires.

Data we process for clients

Most of our work happens inside our clients' own systems. We build and run data pipelines, warehouses, dashboards and AI agents in the client's own cloud account (such as AWS, Google Cloud or Azure) and their own data warehouse (such as Snowflake, BigQuery or Redshift). That data can include advertising, sales and customer data from platforms the client uses.

For this data:

• The client is in charge. The client is the controller (or "business" under US state laws) and decides what data is processed and why. We act as their processor or service provider. We process the data only on the client's documented instructions, under a data processing agreement (DPA).
• Agreements come first. We sign a non-disclosure agreement (NDA) before discovery and a DPA before we get access to any data.
• Access is limited. Only named TechEsthete engineers get access, through the client's own single sign-on (SSO) or identity and access management (IAM). Access is read-only by default.
• AI agents act within the client's rules. If a client chooses to let an AI agent make changes (write access), that's opt-in. It runs with limits and approvals that the client sets, and every action is logged and can be rolled back.
• The data stays where the client puts it. Data is stored in the cloud region the client chooses. Our engineers in Pakistan, the UAE, India and Canada access it remotely and don't move it out of the client's environment except as the client instructs.
• International access is covered. For UK and EU personal data, remote access from outside the UK and EU is a restricted transfer. Our DPA covers it with the EU Standard Contractual Clauses and the UK Addendum.
• Access ends when the work ends. At the end of an engagement, our access is removed.

If you're an individual whose data is in one of our clients' systems, please send privacy requests to that client. If you contact us instead, we'll pass your request to the client and help them respond.

Our Amazon Ads application

TechEsthete operates an application that connects to the Amazon Advertising API (Amazon Ads API) using Login with Amazon. It lets users securely connect their Amazon Advertising accounts. Once a user authorizes access, the application retrieves advertising reports from the Amazon Ads API, processes the data and presents it through customized dashboards and analytics.

This section explains how that application handles your information. It applies in addition to the rest of this policy.

What the application collects

Account information: your name, email address and company or business name (if provided).

Information from Login with Amazon: when you sign in with Amazon, Amazon verifies your identity and gives us only the information you authorize it to share. That may include:

• Your name
• Your email address
• Your Amazon account identifier
• OAuth access tokens
• OAuth refresh tokens

Amazon Advertising data: after you authorize access, we may retrieve advertising information through the official Amazon Ads API, including:

• Advertising profile ID
• Campaign information
• Advertising reports
• Performance metrics, including impressions, clicks, conversions and sales data
• Advertising spend and budget information
• Historical reporting data

How the application uses it

We use this information to:

• Authenticate users securely
• Connect your Amazon Advertising account
• Retrieve Amazon Ads reports
• Process campaign data and generate analytics, dashboards and historical reports
• Improve reporting accuracy
• Respond to support requests
• Maintain platform security and detect fraud or unauthorized activity

Authentication tokens are used only to access the Amazon Advertising data you have authorized and to keep your account connected to our services.

We use your Amazon Advertising data only to provide the services you have requested. We do not sell or rent your Amazon Advertising data, and we do not use it for advertising or marketing purposes.

Sharing, security and retention

We don't share Amazon Advertising data except with service providers who help us operate the platform, when the law requires it, to protect our legal rights or investigate fraud, or as part of a merger, acquisition or asset transfer. Anyone who processes this data for us must protect it appropriately.

We protect application data with secure HTTPS connections, encrypted communication, access controls, secure database storage and regular security monitoring.

We keep application data only as long as we need it to provide the service and maintain your account, to comply with legal obligations or to resolve disputes. When we no longer need it, we securely delete or anonymize it.

If you connect your Amazon account as part of a client engagement with us, we handle that data as your processor under your agreement, as described in "Data we process for clients."

Deleting your account and data

You can ask us to delete your account and associated data at any time by emailing hello@techesthete.com. Once we've verified your request, we will:

• Delete your account
• Remove stored authentication tokens
• Delete stored Amazon Advertising data, where applicable
• Remove associated personal information, unless the law requires us to keep certain records

Your rights

You have rights over your personal information. Which ones apply depends on where you live. To use any of them, email hello@techesthete.com (see "How to contact us and make a request"). We won't treat you differently for using your rights.

UK and EU

If UK or EU data protection law applies to you, you have the right to:

• Access the personal information we hold about you and get a copy
• Correct information that's inaccurate or incomplete
• Delete your information in certain circumstances
• Restrict how we use your information in certain circumstances
• Object to our use of your information based on legitimate interests, and to direct marketing at any time
• Data portability: receive information you gave us in a structured, machine-readable format, or have it sent to another organization, where technically feasible
• Withdraw consent at any time, where we rely on consent

You also have the right to complain to a data protection supervisory authority. In the UK, that's the Information Commissioner's Office (ICO). In the EU, it's the authority in the country where you live or work, or where you think a breach of your rights happened. We'd appreciate the chance to sort out your concern first, so please contact us.

If you're in the UK or EU and want to reach us about privacy, email hello@techesthete.com.

California and other US states

Several US states, including California under the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), give residents rights over their personal information. This section is our notice for those laws.

What we collect. In the past 12 months, we have collected these categories of personal information:

• Identifiers: name, email address, IP address and, for our Amazon Ads application, Amazon account identifier
• Professional or employment-related information: company, company type, job title and role
• Commercial information: ad platforms used, ad spend band and currency, number of client accounts, and, for our Amazon Ads application, Amazon Advertising data
• Internet or other electronic network activity: server log data such as browser type, pages requested and timestamps, and website analytics such as pages viewed, clicks, scrolling, session replays (with forms blanked and typing masked) and a random browser ID
• Geolocation data: approximate location (country, region and city) worked out from your IP address for website analytics
• Other information you choose to give us: for example, what you write in a message or tell us on a call

We get this information from you, from your device when you visit our site, from people who introduce you to us, from public business sources, and from Amazon when you use our Amazon Ads application. We use it for the purposes in "How and why we use your information." We disclose each category for business purposes to the recipients in "Who we share your information with," mainly our service providers. We keep it for the periods in "How long we keep your information."

We don't collect sensitive personal information for the purpose of inferring characteristics about you. We don't knowingly collect personal information from anyone under 16.

No sale or sharing. We don't sell personal information, and we don't share it for cross-context behavioral advertising. We haven't done so in the past 12 months. Because we don't sell or share, there's nothing to opt out of. If that ever changes, we'll update this policy first, offer an opt-out, and honor Global Privacy Control signals.

Your rights. Depending on your state, you have the right to:

• Know and access what personal information we have collected about you, where it came from, why we use it and who we disclose it to, and get a copy
• Delete personal information we collected from you, subject to legal exceptions
• Correct inaccurate personal information
• Not be discriminated against for using your rights. We won't deny you services, charge you a different price or give you a different quality of service because you made a request.

Authorized agents. You can ask someone else to make a request for you. We'll need proof that they're authorized, such as signed written permission. We may also ask you to verify your identity directly with us, unless the agent holds a valid power of attorney.

Appeals. If we decline your request, you can appeal by replying to our decision. If we deny your appeal, you can contact your state attorney general.

Canada

Under the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial laws, you have the right to:

• Access the personal information we hold about you
• Ask us to correct it if it's inaccurate or incomplete
• Withdraw your consent to our use of your information, subject to legal or contractual limits

If you're not satisfied with how we handle your information, please contact us first. You can also complain to the Office of the Privacy Commissioner of Canada (OPC).

United Arab Emirates

If the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) applies to you, you have the right to:

• Get information about how we process your personal data, and a copy of it
• Ask us to correct or delete your personal data
• Ask us to restrict, or object to, certain processing
• Ask us to transfer your data to another organization, where technically feasible
• Withdraw your consent at any time, where we rely on consent

You may also be able to complain to the UAE Data Office.

Australia

We handle personal information in line with the Australian Privacy Principles (APPs) in the Privacy Act 1988. You can ask to access and correct the personal information we hold about you.

As explained in "International transfers," we may disclose personal information to our offices and service providers outside Australia, including in the UAE, Pakistan, India and Canada.

If you have a complaint about how we've handled your personal information, please contact us first, and we'll respond within 30 days. If you're not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC).

Children

Our website and services are for businesses. They aren't directed at children under 16, and we don't knowingly collect personal information from them. If you think a child has given us personal information, contact us and we'll delete it.

How to contact us and make a request

To ask a question or exercise any of your rights, email hello@techesthete.com. Tell us what you're asking for and where you live, so we know which laws apply.

Verifying your identity. To protect your information, we'll check that a request really comes from you before we act on it. Usually we'll ask you to confirm details we already hold, or to reply from the email address we have on file. We'll use the information you give us for verification only for that purpose.

Response times. We'll respond within the time the law requires, typically within 30 days, or 45 days for California requests. If we need more time, where the law allows, we'll tell you why and how long it will take.

Techesthete FZE
Business Centre, Sharjah Publishing City Free Zone, Sharjah, UAE
Email: hello@techesthete.com
Phone: +1 (778) 896-4353 (North America, call or WhatsApp)
Website: https://www.techesthete.com

Changes to this policy

We may update this policy when our services, our practices or the law change. We'll post the new version on this page and change the "Last updated" date at the top. If we make significant changes, we'll take reasonable steps to let you know, such as a notice on our website or an email to clients.