Privacy Policy

1. Introduction & Scope

Welcome to the digital portfolio and professional services website of Tompa Akter Oishey ("we", "us", or "our"), operating under Kinetic Growth Lab. We specialize in high-precision performance marketing, full-stack web development, and enterprise artificial intelligence automations.

We are committed to safeguarding your privacy and ensuring your personal information is handled in accordance with global data protection regulations, including the European Union General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA/CPRA), and applicable international privacy frameworks. This Privacy Policy outlines our practices regarding data collection, tracking telemetry, data storage, and your legal rights.

2. Information We Collect

We collect information that you provide directly to us, as well as data gathered automatically when you navigate our website:

• Voluntary Inquiries & Consultations: When you submit a growth audit request, fill out our consultation form, or email us, we collect your full name, business email address, company URL, phone number, estimated ad spend or development budget, and project requirements.
• Client Account & Billing Data: For contracted client engagements, we collect invoicing details, business tax IDs, billing addresses, and authorized representative contact details. Payment transactions are processed directly via secure PCI-DSS compliant gateways (Stripe, PayPal, wire transfers); we never store raw credit card numbers.
• Automated Device & Usage Telemetry: When you access our platform, our servers automatically log technical metadata including your IP address, browser type and version, operating system, language preferences, referring URLs, pages viewed, time spent per page, and interaction timestamps.

3. Tracking Technologies, Cookies & Server-Side Telemetry

As a performance engineering practice, we implement cutting-edge first-party tracking technologies to analyze traffic quality and measure advertising attribution without violating user consent:

• Google Analytics 4 (GA4): We utilize GA4 to track aggregated user engagement, session velocity, and conversion events. IP addresses are anonymized, and predictive analytics metrics are calculated in aggregate.
• Meta Conversions API (CAPI) & Server-Side Tracking: To overcome browser cookie degradation and ensure deterministic attribution, we utilize server-side Google Tag Manager (sGTM) containers hosted in private cloud environments. Personal data (such as emails) sent for event matching is cryptographically hashed with SHA-256 before transmission.
• Google Consent Mode v2: Our tracking architecture dynamically adapts based on your cookie consent selection. If consent is denied, cookieless pings are transmitted to measure conversions without storing persistent identifiers on your device.
• Cookie Management: You may modify your browser settings to refuse cookies or alert you when cookies are being sent. Note that certain interactive features of the website may function with limited efficiency if cookies are disabled.

4. How We Use Collected Information

We process personal and technical information strictly for lawful business purposes:

• To prepare bespoke project proposals, technical roadmaps, and growth audit diagnoses.
• To deliver, execute, and maintain contracted web development, paid advertising campaigns, and AI automation pipelines.
• To diagnose server performance anomalies, debug code, and harden our infrastructure against malicious attacks or DDoS threats.
• To analyze advertising campaign effectiveness and optimize blended Return on Ad Spend (ROAS).
• To fulfill contractual obligations, process financial invoices, and satisfy legal and tax compliance mandates.

5. Third-Party Processors & Data Disclosure

We strictly do not sell, rent, monetize, or trade your personal information to data brokers. We share information only with trusted third-party service providers bound by strict confidentiality and data protection agreements:

• Cloud & Hosting Infrastructure: Cloudflare (CDN, DNS, and Web Application Firewall) and secure server environments.
• Analytics & Attribution: Google Cloud Platform (BigQuery), Google Analytics 4, Meta Business Platform.
• CRM & Workflow Automations: HubSpot, Make.com, n8n, Slack (for real-time lead routing and notifications).
• Legal Authorities: We may disclose information if required by law, subpoena, or government regulation, or to protect the safety, rights, and property of our business, clients, or the public.

6. International Data Transfers

We serve enterprise clients globally across the United States, United Kingdom, European Union, United Arab Emirates, and Bangladesh. Your data may be processed on servers located outside your jurisdiction. For data transfers originating from the European Economic Area (EEA) or UK, we enforce Standard Contractual Clauses (SCCs) and robust technical safeguards to ensure an equivalent standard of protection.

7. Data Retention & Security Architecture

We maintain rigorous technical and administrative security measures:

• Encryption Standards: All data in transit is encrypted using Transport Layer Security (TLS 1.3). Data at rest is encrypted using AES-256 bit algorithms.
• Access Controls: Access to client data and internal systems is restricted via Role-Based Access Control (RBAC) and mandatory Multi-Factor Authentication (MFA).
• Retention Duration: Consultation form submissions are retained for up to 24 months for business continuity. Contracted client records and financial transactions are retained for 7 years to comply with statutory accounting and tax regulations.

8. Your Rights & Choices

Depending on your location, you hold specific statutory rights regarding your personal data:

• Right of Access & Portability: You may request a copy of the personal data we hold about you in a structured, machine-readable format.
• Right to Rectification: You may request the correction of inaccurate or incomplete personal records.
• Right to Erasure ("Right to be Forgotten"): You may request that we delete your personal data, subject to legal retention obligations.
• Right to Restrict or Object: You may object to the processing of your data for direct marketing purposes at any time.
• CCPA "Do Not Sell or Share My Personal Info": California residents have the right to opt-out of the sharing of personal information for cross-context behavioral advertising. We do not sell personal data.

To exercise any of these statutory rights, please submit a formal request to our designated privacy officer at the contact details below. We verify identity and respond within 30 days.