Privacy Policy

Sakura Agency (“Sakura,” “we,” “us,” or “our”) operates https://sakuragency.com (the “Site”) and provides product design, development, SEO, digital marketing, and AI automation services. This Privacy Policy explains what information we collect through the Site — most importantly through the project brief form on our Contact page — how we use it, who we share it with, and the choices and rights you have over it.

This policy covers the Site only. If you become a client, the specific data handling terms for a project (e.g. access to your product, credentials, or proprietary materials) are set out separately in that project's signed agreement, not here.

Information you provide directly

When you submit the project brief form, we collect:

• Your name and email address
• A one-sentence description of what you're building
• Project type, estimated budget range, and ideal timeline
• Any additional details you choose to share
• An optional file attachment (a spec or brief — PDF, Word document, plain text, or an image, up to 10MB)

If you email us directly or message us on Telegram or WhatsApp instead of using the form, we receive whatever information you choose to include in that message — those channels are operated by Telegram and WhatsApp/Meta under their own privacy terms, not ours.

Information collected automatically

We run basic, first-party analytics on our own infrastructure — we do not use Google Analytics or any third-party analytics or advertising network. When you browse the Site, we automatically record:

• The page path you viewed and the referring page
• Your browser's user-agent string
• A random session identifier generated in your browser (see Cookies and Local Storage below)
• Your IP address

We also log the IP address associated with a brief-form submission, separately from the analytics above, solely to detect and block spam and abuse (see Data Retention).

We set exactly one cookie on this Site, and it is not used for tracking, analytics, or advertising. That cookie (sakura_admin_session) is created only when a Sakura team member logs into the internal admin dashboard — it is strictly necessary to keep that login session secure, is marked httpOnly and secure, and is never set for ordinary visitors browsing the Site.

For the first-party analytics described above, we do not use a cookie at all — we generate a random session identifier and store it in your browser's localStorage (not sent automatically with every request the way a cookie is). This identifier lets us tell repeat pageviews within the same browser apart from each other; it is not linked to your name or email unless you separately submit the brief form from that browser. You can clear it at any time by clearing your browser's site data for sakuragency.com.

Because we set no advertising or cross-site tracking cookies, this Site does not display a cookie-consent banner. If that changes — for example, if we later add third-party analytics or advertising — we will update this policy and add a consent mechanism before doing so.

• To respond to your project inquiry, scope your request, and send you a proposal
• To communicate with you about an active or prospective project
• To detect, investigate, and block spam, abuse, and fraudulent submissions
• To understand how visitors use the Site — which pages get read, where people drop off — so we can improve it
• To maintain the security and proper functioning of the Site and our internal tools

We do not sell your information, and we do not use it for targeted advertising, either our own or anyone else's.

If you are located in the European Economic Area or the United Kingdom, we process your information on the following legal bases under the GDPR:

• Contract / pre-contractual steps — processing your brief-form submission to respond to your inquiry and, if you engage us, to prepare and perform a services agreement.
• Legitimate interests — running first-party analytics to understand and improve the Site, and logging IP addresses to prevent spam and abuse, where these interests are not overridden by your rights and interests.
• Consent — for anything we ask you to opt into separately, such as an email newsletter, if we introduce one.

We do not sell or rent your information. We share it only with the following categories of service providers, each acting on our instructions to help us operate the Site and respond to your inquiry:

• Email delivery — we use Resend to deliver the internal notification email (containing your brief-form submission and any attached file) to our team.
• Hosting and database — the Site and its database run on standard cloud infrastructure (a managed Postgres provider and application hosting), which stores the information described in this policy on our behalf.

We may also disclose information if required by law, subpoena, or other legal process, or where we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others. If Sakura Agency is ever involved in a merger, acquisition, or sale of assets, information covered by this policy may be transferred as part of that transaction; we will notify you before it becomes subject to a different privacy policy.

We keep brief-form submissions and related correspondence for as long as reasonably necessary to respond to your inquiry, deliver a project, and maintain accurate business records afterward — and no longer than that. If your submission is identified as spam by our automated filter, it is discarded and never stored. First-party analytics records (page path, referrer, session identifier, IP address) are retained for a limited period sufficient for the purpose described above and are periodically purged. You may ask us to delete your information sooner at any time — see Your Privacy Rights below.

We apply reasonable technical measures appropriate to the information we hold: all traffic to the Site is encrypted in transit (HTTPS), our internal admin access is protected by a hashed password and a signed, httpOnly session token, and access to the underlying database is restricted to our infrastructure. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security — but we do not treat that as a reason to collect more than we need.

Sakura Agency is a remote-first team, and the infrastructure providers described above may process and store information in countries other than the one you are in, including the United States. Where we transfer personal data out of the EEA, UK, or Switzerland, we rely on the transfer mechanisms recognized under applicable law (such as standard contractual clauses) as offered by our providers.

If you are in the European Economic Area or UK

Under the GDPR, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Request erasure of your data (“right to be forgotten”)
• Restrict or object to certain processing, including processing based on legitimate interests
• Receive your data in a portable format
• Lodge a complaint with your local data protection authority

If you are a California resident

Under the CCPA/CPRA, you have the right to:

• Know what personal information we have collected about you and why
• Request deletion of your personal information
• Correct inaccurate personal information
• Opt out of the sale or sharing of personal information — we don't sell or share it, so there's nothing to opt out of
• Not be discriminated against for exercising any of these rights

Exercising your rights

Wherever you're located, you can exercise any of these rights, or ask us a question about this policy, by emailing hello@sakuragency.com. We'll respond within a reasonable time and may need to verify your identity first (typically by confirming the email address on file) before acting on a request.

The Site is intended for businesses and individuals evaluating or engaging our services, not for children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us with personal information, contact us and we'll delete it.

The Site links out to third-party destinations we don't control — Telegram, WhatsApp, LinkedIn, and Twitter/X among them. Those platforms have their own privacy policies, and this policy doesn't cover what happens once you leave our Site.

We may update this policy as the Site or our practices change. If we make a material change, we'll update the “Last updated” date at the top of this page. Continued use of the Site after a change means you accept the updated policy.

Questions about this policy or a request regarding your data: hello@sakuragency.com.