Privacy policy

Hemframe Studio services are offered under the business name Bifur, with business address Nenmini, Perinthalmanna, Malappuram, Kerala. For questions about information handled for your enquiry or project, use the studio’s contact details.

The enquiry form asks for your name, brand name, reply email, optional store or Instagram link, product-photo link, garment quantity, package interest, intended use and target launch date. Messages sent directly by email or Instagram may include other information you choose to provide.

Share only what is needed for a project review. Please leave out payment-card details, government identity documents, sensitive personal information and information about children.

Your details help us assess reference quality and feasibility, discuss the appropriate scope, prepare a quote and respond to your enquiry. If a project is booked, relevant correspondence can also support its agreed delivery and administration.

The form asks for your agreement to use the supplied details and photo link for the enquiry. You can email the studio to withdraw that agreement. This may prevent further review or follow-up, and does not undo processing already carried out or records that must be retained under applicable law.

We do not sell enquiry details or use this form to enrol you in marketing emails.

Submitting the form saves your details and product-photo link in the studio’s Supabase-hosted PostgreSQL database, together with the enquiry reference, receipt time, consent record and notification delivery status. Configured notification services also receive a copy so we can review the enquiry and reply.

Enabled services: Telegram (studio channel notification), Discord (studio channel notification), Brevo (transactional email to the studio inbox). Copies are visible to people with access to the receiving studio inbox or channels and are subject to those services’ privacy and retention practices. This does not subscribe you to marketing or send an automatic email to your address.

You can email hemframe.studio@gmail.com directly. Email and Instagram are external services with their own privacy practices.

The client workspace stores project briefs, reference files, source-sharing acknowledgements, quote scope and prices, acceptance names and times, payment references/status, review versions, comments and approvals. Drafts and submitted versions help us manage the agreed project and retain the context of changes. Internal studio notes are not shown in the client workspace.

References upload directly to Cloudinary using project-scoped upload permissions. Project records are held in the studio’s Supabase-hosted PostgreSQL database. Private file requests check project access before delivery. The studio can revoke access; a file or information already viewed or downloaded cannot be recalled.

A private invitation grants access to one project. Keep it with the intended recipient; opening an invitation does not independently verify a person’s email or legal identity. Invitations expire after 72 hours, and the resulting necessary browser session lasts up to seven days unless revoked earlier. No invitation email is sent automatically by this workspace.

Quote acceptance and review decisions retain the displayed version, typed name, acknowledgement and timestamp. These are operational records, not an independent identity verification or notarisation service. If Razorpay is used, it handles payment entry; the studio receives payment-link identifiers, amounts and status. Studio-recorded receipts are labelled separately from provider-verified status. No card number or card security code should be entered in a brief, comment or reference file.

Use a private share link where appropriate and provide only access needed for the review. The form collects a link; it does not upload your files or automatically download them. Share only photographs and other materials you are authorised to provide.

An enquiry allows review for that purpose. It does not authorise public portfolio use of your product photos or client work. Any portfolio permission and any AI-assisted processing for a commissioned project must be discussed separately as part of its scope.

You can revoke access at your file-sharing service and ask the studio to remove any enquiry copies it holds.

The website code includes no advertising pixels, analytics trackers or mailing-list integration. Site assets, fonts, portfolio images and videos are served with the website. External Instagram content is linked, rather than embedded.

When the site is hosted, its hosting and network services may process routine request information such as IP address, browser details, requested URL and access time for delivery and security. Email, file-sharing and any enabled enquiry-delivery service may also maintain their own operational records. Storage locations and retention depend on the services used; India-only storage is not promised.

When automatic submission is enabled, the website temporarily keeps a hashed email identifier, submission count and a submission reference with a hash of the submitted fields and delivery status in server memory for up to ten minutes to limit repeated submissions and reduce duplicate notifications on retries. Saved enquiry records are retained in Supabase separately from this temporary memory, with access restricted to the studio’s authorised server and operators.

If an enquiry becomes a booked project, correspondence may include the accepted quote, invoice, billing contact details and payment references needed to administer that engagement. These are handled with the project records described here.

The website does not have an integrated payment gateway and does not ask for card numbers, bank passwords or one-time codes. If online payment processing is introduced, the policy must describe the relevant payment-data handling before payments are accepted through this website.

Razorpay is the selected online payment provider. If an agreed project uses a Razorpay payment link or checkout, information entered there, such as payer/contact details and transaction information, is processed under Razorpay’s privacy policy. The studio may receive transaction references and payment status to reconcile its invoice. A project enquiry alone sends no information to Razorpay.

The restricted content desk uses Supabase to authenticate authorised studio staff and stores account roles, content drafts, captions, asset descriptions, revision history, schedules and operational activity in the studio’s PostgreSQL database. These are studio working records; visitors do not need an account to submit an enquiry.

New media uploaded through the content desk is stored and delivered using Cloudinary. Staff can keep drafts restricted, and selected work becomes publicly visible only when explicitly enabled. Previously public archive URLs and previously shared media links may remain accessible independently of a project listing. A Telegram handover sends the selected content and files to the studio’s configured channel when staff request or schedule it.

Loading Cloudinary-hosted media sends that provider the technical request needed to deliver it. Provider practices are described in Cloudinary’s privacy policy and Supabase’s privacy policy. Access to private studio records is restricted to authorised staff and server operations. Contact the studio about the handling or removal of material you supplied.

The website keeps form fields in the current browser session’s page memory. It does not save drafts to local storage or session storage. Sent enquiries may remain in the studio’s configured database, inbox and any configured delivery service while needed for the enquiry, a resulting project, record keeping or a dispute.

No fixed deletion period for inbox or provider records has been set here. Contact us to ask what records are held or request deletion. Where a record must be retained for an applicable legal obligation, we will explain that restriction when responding.

Email hemframe.studio@gmail.com to ask about your enquiry records, correct details, withdraw consent, request deletion or raise a privacy concern. Include the reply email used and enough context to locate the enquiry; avoid sending identity documents unless we discuss a necessary verification step.

We may need to verify that a request concerns your information. Requests are handled subject to applicable law and any record-retention requirements. You may also use any complaint or remedy available to you under applicable law.

We will update this page when the website’s handling of personal information changes and revise the date above. The cookie policy explains browser storage and external-site behaviour.