Your data,handled with care.

1. Who we are

Little Mecha Labs (“we”, “us”, “our”) is an independent digital product studio based in Cairo, Egypt. We design and build websites, mobile apps and digital products for clients.

Location: Cairo, Egypt Privacy contact: contact@littlemechalabs.com

We are the data controller for the personal data described here. This policy covers the website at littlemechalabs.com and the email address above. It does not cover the products we build for clients, which have their own policies, and it does not cover the internal tools our team uses.

2. The short version

• We collect what you type into our contact form, and the email you send us.
• We use analytics — Google Analytics, Vercel Web Analytics and Vercel Speed Insights — to understand how the site is used and how fast it loads.
• We use the Meta Pixel and Meta's Conversions API to measure our own ads on Facebook and Instagram. This is the only advertising-related tracking on the site, and it only runs if you accept "marketing" in our consent card.
• We never sell your data.
• Our contact form does not store your IP address. Analytics providers process it as described in section 5.
• Your data is stored in the European Union.
• You can ask what we hold about you, have it corrected or deleted, and object to analytics, at any time.

3. What we collect, and why

3.1 When you contact us

Through the contact form or by email, you give us:

If you accepted marketing cookies, a successful submission is also reported to Meta as a "Lead" so we can tell which of our ads brought you here. Your email address and name are sent to Meta only as SHA-256 hashes (one-way fingerprints Meta uses for matching, never readable as text), together with your IP address, browser details and Meta's own cookies. If you declined marketing, nothing about your submission goes to Meta.

Rate limiting. To stop automated spam, the contact form derives a one-way, salted hash of your IP address and keeps it alongside your submission. The hash cannot be turned back into your IP address, and the IP address itself is never stored. The form also contains a hidden field that only automated scripts fill in; submissions that trigger it are discarded.

3.2 When you email us

Email sent to contact@littlemechalabs.com is delivered through Resend and stored in our mailbox system, together with the usual message metadata — sender address, subject, timestamps and attachments. We keep it so we can follow up and keep a record of what was agreed.

3.3 When you browse the site

We use analytics services to learn which pages are visited, where visitors come from, and how the site performs. They are described in section 5. We do not collect your name or contact details through analytics, and we do not build profiles of individual visitors.

3.4 What we don't collect

We don't ask for or store payment details, government identifiers or passwords on this site. The only advertising-related tool is the Meta Pixel described in section 5, and it stays off until you accept it. We don't buy data about you from anyone.

4. How we use your data

We use the data above to:

• reply to your enquiry and discuss a possible project;
• prepare proposals and, if we work together, deliver the work;
• keep a record of our correspondence;
• protect the site against spam and abuse;
• understand which parts of the site are useful and how fast it loads, so we can improve it;
• meet legal obligations, such as accounting and tax records where a project goes ahead.

We don't use your data for automated decision-making, and we don't send marketing email unless you've asked for it.

5. Analytics and cookies

We use the services below. Our consent card offers two categories: analytics (Google Analytics) and marketing (the Meta Pixel). Vercel's tools set no cookies and need no consent. Nothing in either category sets a cookie until you accept it, and you can change your choice at any time from the "Cookie settings" link in the footer.

5.1 Google Analytics (GA4)

Provided by Google LLC. It sets cookies (_ga and _ga_*, lasting up to two years) that give your browser a random identifier so repeat visits can be counted. It records the pages you view, how you arrived, approximate location (country and city, derived from your IP address, which Google does not store), device and browser type, and interactions such as clicks. We set data retention to 14 months, after which Google deletes user-level data. Google may process this data in the United States and other countries.

You can opt out with Google's browser add-on at tools.google.com/dlpage/gaoptout, or by declining analytics in our consent banner. Google's own policy: policies.google.com/privacy.

5.2 Google Search Console

Provided by Google LLC. Search Console places nothing on your device and collects nothing from you on our site. It shows us aggregated information Google already holds about how our pages appear in Google Search — the queries that led to us, impressions and clicks. We cannot identify individual searchers from it.

5.3 Vercel Web Analytics

Provided by Vercel Inc., which also hosts the site. It is cookieless and does not track you across sites. To count visitors it creates a temporary identifier from a hash of your IP address and browser details, discarded every 24 hours; your IP address is not stored. It records page views, referrers, country, and device and browser type. Vercel's policy: vercel.com/legal/privacy-policy.

5.4 Vercel Speed Insights

Also provided by Vercel Inc. It measures how quickly pages load and respond (Core Web Vitals) and reports them with the page URL, connection type, device and browser category, and country. It sets no cookies and does not identify you.

5.5 Meta Pixel and Conversions API (marketing)

Provided by Meta Platforms, Inc. We use them to measure whether our advertising on Facebook and Instagram works — which ads lead to visits and enquiries — and to show our ads to people who have visited the site. If you accept marketing cookies, the pixel sets _fbp (lasting 90 days) and, when you arrive from a Meta ad, _fbc; it records the pages you view and case studies you read, and sends a "Lead" event when you submit our form. Our server sends the same Lead event to Meta directly with the hashed details described in section 3.1, so the count is accurate even where browser tracking is blocked. If you decline marketing, the pixel loads in a revoked state: no cookies, and nothing is sent.

Meta may combine this data with your Meta account if you have one, and processes it in the United States. You can control how Meta uses data from other sites in your Facebook and Instagram ad settings at facebook.com/ads/preferences. Meta's policy: facebook.com/privacy/policy.

5.6 Hosting logs

Vercel keeps short-lived server logs of requests to the site, which include IP addresses, for security and to operate the service. They are retained for a limited period under Vercel's terms.

5.7 Strictly necessary storage

The site stores your consent choices in your browser and in a first-party cookie (lml-consent, one year), so every page — and our server, when it decides whether to report a Lead to Meta — respects them. These don't identify you and are not shared.

6. Who we share data with

We share personal data only with the providers we need to run the site and reply to you:

Each processes data on our instructions under its own data-processing terms. We may also disclose data where the law requires it, or to professional advisers (accountants, lawyers) bound by confidentiality.

We do not sell personal data and never have.

7. International transfers

We are in Egypt; our database and hosting are in the European Union; Google and Meta, and in some cases Resend, process data in the United States. Where data crosses borders we rely on the provider's standard contractual protections — the EU Standard Contractual Clauses for Google, Meta, Vercel, Supabase and Resend. If you are in the EU or UK, your data may therefore be processed outside your country under those safeguards. If you are in Egypt, Saudi Arabia or the UAE, your data is transferred to the EU and, for analytics, to the United States, on the same basis.

8. How long we keep it

You can ask us to delete your enquiry earlier at any time.

9. Your rights

We honour the following rights for everyone, wherever you live:

• Access — ask what we hold about you and get a copy.
• Correction — have inaccurate data fixed.
• Deletion — have your data deleted, unless we must keep it for a legal reason.
• Objection and restriction — object to analytics or to processing based on our legitimate interests, or ask us to pause processing while a dispute is resolved.
• Portability — receive the data you gave us in a common machine-readable format.
• Withdrawing consent — where processing rests on consent (analytics cookies), withdraw it at any time; this does not affect what happened before.

European Union and United Kingdom (GDPR / UK GDPR). The rights above apply in full. You may also complain to your supervisory authority — a list is at edpb.europa.eu; for the UK, ico.org.uk.

Egypt (Personal Data Protection Law No. 151 of 2020). You have the rights of access, correction, erasure, restriction and objection described above, and may lodge a complaint with the Personal Data Protection Centre.

Saudi Arabia (Personal Data Protection Law). You have the rights to be informed, to access, to obtain a copy, to correct, and to request destruction of your data as described above, and may complain to the Saudi Data & AI Authority (SDAIA).

United Arab Emirates (Federal Decree-Law No. 45 of 2021). You have the rights of access, correction, erasure, restriction, objection and portability described above, and may complain to the UAE Data Office.

To exercise any right, email contact@littlemechalabs.com with the subject "Privacy request". We respond within 30 days and may ask you to confirm your identity first. There is no charge unless a request is plainly unfounded or repetitive.

10. Security

The site is served over HTTPS. Contact-form data is stored in a database that is reachable only from our server-side code with a secret key, never directly from the browser. IP addresses are hashed with a secret salt before storage, so a copy of the database cannot reveal them. Access to enquiries and email is limited to the studio's team. No system is perfectly secure; if we learn of a breach affecting your data, we will tell you and any authority we are required to notify without undue delay.

11. Children

This is a business site for adults. It is not directed at anyone under 16, and we don't knowingly collect their data. If you believe someone under 16 has sent us personal data, email us and we will delete it.

12. Links to other sites

The site links to our social profiles and to products we've built, such as quorumqr.app. Those sites have their own privacy policies, and this one doesn't cover them.

13. Changes to this policy

We update this policy when our practices change — for instance if we add an analytics provider. The "Last updated" date at the top tells you when. Material changes are flagged on the site for a period after they take effect.

14. Contact

Little Mecha Labs Cairo, Egypt contact@littlemechalabs.com