Trust & Security

Privacy Policy

How Softaculor protects client project confidentiality, technical credentials, database staging environments, and digital privacy.

Last Updated: October 2026 GDPR & Global Privacy Compliant Softaculor — Lahore, Pakistan

Privacy Highlights

Our Core Privacy Commitments

Designed to safeguard high-growth companies, sensitive codebases, and user data.

Zero Data Selling

We never monetize, rent, or sell your personal details, client rosters, or inquiry information to third-party advertisers.

Staging Data Sanitization

We use synthetic mock data during development and rigorously purge test credentials and staging dumps within 30-90 days of launch.

TLS 1.3 & MFA Protected

All communications and source code repositories are defended with mandatory multi-factor authentication and end-to-end encryption.

Full Subject Rights

Full access, rectification, deletion, and data portability rights honorably fulfilled within 30 business days free of charge.

Section 01Data Governance

Introduction & Scope of Policy

Who we are, our commitment to digital privacy, and how this policy applies across all Softaculor websites, services, and software projects.

At Softaculor (“Company”, “we”, “our”, or “us”), operating as a dedicated software house and digital agency located in Lahore, Pakistan, we recognize the vital importance of data privacy, confidentiality, and technical information security.

This Privacy Policy details how we collect, process, store, and safeguard your personal information and business data when you visit our website (softaculor.com), engage our software development, web engineering, SEO, graphic design, and Meta Ads services, or submit inquiries and project briefs.

Data Roles (Controller & Processor): For visitors to our website and direct project inquiries, Softaculor acts as the Data Controller. When developing custom web applications, configuring staging databases, or hosting systems for our clients, Softaculor acts as a Data Processor / Service Provider operating strictly under the instructions of our client.

Section 02Data Categorization

Information We Collect

Clear breakdown of information provided voluntarily, automatically captured telemetry, and project assets.

We collect only the minimum necessary data required to deliver high-performance software and professional agency services:

Voluntarily Submitted Data

Names, corporate email addresses, phone numbers, company names, budget indications, project roadmaps, and technical specifications submitted via our contact forms, email inquiries, or WhatsApp conversations.

Client Project Credentials

Domain registrar logins, DNS panel access, cloud hosting tokens (AWS, Vercel, VPS), staging credentials, and third-party API keys provided solely for development and deployment.

Technical & Telemetry Data

IP addresses, browser signatures, operating system details, device type, referring URL, time stamps, and navigation patterns on our site used to detect DDoS attacks and optimize site speed.

Commercial & Billing Records

Itemized invoices, signed Statements of Work (SOWs), payment confirmations, and transaction reference IDs (we never store raw credit card or banking details directly on our servers).

Section 03GDPR Alignment

Legal Bases for Data Processing

Lawful grounds including contractual necessity, legitimate business interests, legal compliance, and explicit consent.

Under global data protection standards (including the General Data Protection Regulation - GDPR), we only process personal and corporate information where a legitimate legal basis exists:

Contractual Performance: Processing required to draft estimates, execute Statements of Work, build code, deploy websites, and fulfill our service agreements.
Legitimate Interests: Operating and securing our digital infrastructure, maintaining code repositories, preventing fraudulent activities, and providing reliable technical customer support.
Legal Obligations: Compliance with statutory accounting regulations, corporate tax filings, and lawful governmental directives in Pakistan.
Explicit Consent: Where you have opted in to marketing communications, newsletter updates, or specific non-essential tracking cookies.

Section 04Purpose Limitation

How We Utilize Your Information

Software engineering execution, custom architectural roadmaps, communications, and system performance monitoring.

We use the collected information strictly for defined business and technical purposes:

Delivering Tailored Software: Designing UI/UX prototypes, developing bespoke web applications, integrating APIs, optimizing databases, and deploying production software.
Proposals & Client Onboarding: Reviewing project briefs, estimating engineering timelines, preparing itemized proposals, and drafting SOWs.
Search Engine Optimization & Paid Ads: Auditing website architecture, configuring Meta Pixel and Google Analytics tracking, and managing ad campaign strategies.
Service Communications: Providing milestone sprint updates, User Acceptance Testing (UAT) notifications, invoice reminders, and critical security alerts.
Infrastructure Security: Monitoring server health, preventing malicious brute-force attempts, and auditing developer access logs.

Section 05Software House Standard

Client Code, Staging Databases & Development Data

Rigorous sanitization protocols: mock data for testing, secured staging environments, and zero cross-client data contamination.

As a dedicated software house, we enforce specialized data hygiene measures during project development sprints:

Synthetic & Mock Data Protocol

Our engineering team adheres to a strict policy of utilizing synthetic, anonymized, or mock datasets in staging and local testing environments. We never copy raw, sensitive client customer databases (e.g. user passwords, personal records, credit histories) to developer local workstations.

Secrets & Environment Variable Security

All production secrets, payment gateway private keys, and cloud API tokens are managed via isolated environment variables and encrypted secret managers. API keys and passwords are never hardcoded or committed into public version control repositories.

Strict Client Data Isolation

Every client project is housed in dedicated, isolated git repositories and virtual container environments. Softaculor never mixes or cross-contaminates code, databases, or assets between different clients.

Section 06Meta & Analytics

Digital Marketing, Pixels & Tracking Technologies

Clear boundary between Softaculor’s own website tracking and the tracking tools configured on client sites on behalf of clients.

Because Softaculor provides specialized Meta (Facebook & Instagram) Advertising and SEO services, we clarify tracking boundaries:

Softaculor's Website Tracking: On our own website, we utilize privacy-focused, aggregated analytics to gauge page performance, visitor geographies, and inquiry funnels. We do not sell your personal data or profiling information to data brokers.
Tracking on Client Sites (As a Service): When commissioned to configure Meta Pixels, Conversions API (CAPI), or Google Tag Manager on a Client’s digital properties, Softaculor acts purely as a technical implementer. The Client remains the legal Data Controller responsible for posting their own privacy policies and obtaining cookie consent from their end users.

Section 07Transparency

Cookies & Browser Storage

Essential session cookies, performance optimization, and how to manage or disable cookies in your web browser.

Cookies are compact text files stored on your device that allow websites to function properly and remember user preferences:

Strictly Necessary Cookies

Essential for website security, routing navigation, CDN caching, and form submission anti-spam verification. Cannot be switched off.

Performance & Telemetry

Aggregated, non-personally identifiable metrics on page speed, Core Web Vitals, and browser compatibility to ensure smooth performance.

You can instruct your browser to refuse all cookies or notify you when a cookie is being sent. Please note that disabling certain essential cookies may affect the visual display or functionality of parts of the site.

Section 08Infrastructure Partners

Sub-processors & Third-Party Service Providers

Trusted cloud infrastructure, version control, and messaging services utilized to execute our operations.

Softaculor does not sell, rent, or monetize your information. We disclose data solely to vetted, high-security third-party service providers (sub-processors) under binding data protection terms:

Cloud Infrastructure & CDN: AWS, DigitalOcean, Vercel, and Cloudflare for secure web hosting, DDOS mitigation, and global asset delivery.
Code Versioning & CI/CD: GitHub and GitLab for private, encrypted source code repositories and automated deployment pipelines.
Business Communications: Google Workspace (Gmail, Drive) and WhatsApp Business for direct client correspondence.
Advertising Platforms: Meta Platforms, Inc. (Facebook & Instagram) when executing client-directed paid marketing campaigns.

Section 09Cross-Border Safety

International Data Transfers

Global cloud routing secured by standard contractual clauses, encrypted transit, and rigorous data residency safeguards.

Because Softaculor operates with international clients across the Middle East, Europe, North America, and Asia, information may be transferred to and processed in cloud data centers located outside your home country.

Whenever cross-border transfers occur, we ensure that adequate safeguards are enforced, such as utilizing cloud service providers adhering to Standard Contractual Clauses (SCCs), SOC 2 Type II certifications, and mandatory Transport Layer Security (TLS 1.3) data encryption in transit.

Section 10Enterprise Security

Data Security & Technical Safeguards

End-to-end TLS encryption, Multi-Factor Authentication (MFA), role-based access controls, and periodic code audits.

We implement industry-grade technical and organizational safeguards designed to protect personal information and intellectual property against unauthorized access, loss, or alteration:

Encrypted In Transit

Strict HTTPS enforced across all web properties with modern TLS certificates and HSTS headers.

MFA & Access Control

Mandatory multi-factor authentication (MFA) and least-privilege role-based access for all engineer accounts.

Audit & Hygiene

Automated dependency vulnerability audits (npm audit, Snyk) and secure off-boarding protocols.

Section 11Data Minimization

Data Retention & Disposal Policies

Clear retention windows: inquiry records retained for business continuity, and temporary staging credentials purged within 30-90 days.

We preserve data only for as long as necessary to fulfill the purposes outlined in this policy:

Project Inquiries: Contact messages and consultation inquiries are retained for up to 24 months to assist with future project engagements, after which they are securely purged.
Staging Credentials & Test Data: Server passwords, temporary SSH keys, and staging database dumps are deleted within thirty (30) to ninety (90) days of official production launch.
Financial & Invoicing Records: Contracts, SOWs, and invoices are retained for up to 6 years to satisfy statutory tax, audit, and accounting regulations.

Section 12Global Rights

Your Data Subject Rights

Your rights to access, rectify, delete, restrict processing, or port your personal data without fee or penalty.

Regardless of your geographic location, Softaculor respects your rights over your personal information:

Right of Access: Request a copy of the personal records we hold regarding you or your organization.
Right to Rectification: Request correction of inaccurate, incomplete, or outdated information.
Right to Erasure ("Right to Be Forgotten"): Request deletion of your personal data where retention is no longer legally necessary.
Right to Restrict or Object: Object to processing for direct marketing or request restrictions on data handling.
Right to Data Portability: Request transmission of your data in a structured, commonly used machine-readable format.

To exercise any of these rights, please submit a written request to [email protected]. We respond to all verified requests within thirty (30) business days without fee.

Section 13COPPA & Minor Safety

Children's Privacy Protection

Softaculor delivers B2B commercial software and digital agency services; we never knowingly collect data from individuals under 18.

Softaculor operates as a professional business-to-business (B2B) digital agency. Our website, software tools, and services are exclusively intended for commercial enterprises, founders, and individuals aged 18 and older.

We do not knowingly collect, solicit, or maintain personal information from children or minors under the age of 18. If you believe that a minor has provided us with personal information, please contact us immediately at [email protected], and we will expeditiously remove such data from our records.

Section 14Policy Evolution

Revisions to This Privacy Policy

How updates and procedural revisions are communicated to visitors and clients with clear timestamping.

We may periodically update this Privacy Policy to reflect advancements in our technology stack, new regulatory statutes, or evolving software development methodologies.

When amendments are published, we will revise the “Last Updated” date at the top of this document. For substantial material modifications affecting active clients, we will provide direct notice via email or our client portal. We encourage you to review this page periodically to remain informed about our protective measures.

Section 15Direct Contact

Privacy Inquiries & Data Protection Contact

Official contact channels for privacy notices, data subject requests, and security disclosures.

If you have any questions, concerns, or requests regarding this Privacy Policy or our software data handling practices, our data protection and operations desk is readily available to assist you:

Data Protection Officer & Privacy Desk

Softaculor Software House & Digital Agency — Lahore, Pakistan

Privacy Email

[email protected]

Direct Desk / WhatsApp

0301 9736269

Physical Office

Lahore, Pakistan

Data Protection First

Ready to build secure, privacy-compliant software?

We sign Non-Disclosure Agreements (NDAs) and Data Processing Agreements (DPAs) before onboarding sensitive enterprise engineering projects.

Discuss Your Project [email protected]