Privacy Policy

When you send a brief through the contact form, we collect your name, email, company (optional), project intent, budget, timeline, and the body of your message. When you email us directly, we receive whatever you choose to share.

Our hosting and email systems record standard request data (IP address, browser, referring URL, timestamps) for security and uptime. The site uses browser sessionStorage to remember whether you have seen the opening animation in the current session. There are no tracking cookies and no third-party analytics on this website.

To reply to your brief, send a confirmation email, deliver services if you become a client, prevent spam and abuse, and meet legal and accounting obligations. We do not use your data for advertising or profiling, and we do not sell it.

To run the site and reply to enquiries, we use a small set of service providers under standard confidentiality and security obligations: a cloud hosting provider for the website, and an email service for sending and receiving studio mail. Where required by law, we may share data with professional advisers under confidentiality, or with authorities. Some providers operate global infrastructure, so personal data may be processed outside Singapore. We take reasonable steps to ensure a comparable standard of protection. We can name our current providers on request.

Contact-form briefs are kept while a conversation is active and for up to 24 months after the last exchange. Engagement records, invoices, and email are kept for up to 7 years for accounting purposes. Server logs follow our providers' standard windows, typically 30 to 90 days.

You may request access to, and correction of, the personal data we hold about you, withdraw consent at any time, or ask us to delete data we no longer need to keep for legal or accounting reasons. Email privacy@ampersands.co and we respond within 30 days.

We use HTTPS in transit, access controls on internal systems, and spam filtering on inbound forms. No system is fully secure. If we become aware of a personal data breach likely to cause significant harm, we will notify the relevant authority and affected individuals as required by law.

The site is not directed at children under 16. We do not knowingly collect their personal data. If you believe a child has shared data with us, contact us and we will delete it.

We may update this policy. The current version is always at this URL, and the “Last updated” date reflects the most recent change.