Client data

What this page covers

When we build something for you, we may touch your code, accounts, content and sometimes your customers’ data. This page explains how we handle all of that.

It applies to direct projects. For orders through Fiverr, Upwork or Contra, we follow the same habits, and the platform’s terms also apply.

Questions or requests: support@srwebstudio.com.

Access: least privilege

We ask for the access we need and no more.

• We prefer your own accounts. Your code repository, hosting, Cloudflare account, and tools like Swoogo stay yours. We join as invited users with a role that fits the work.
• We do not ask for your personal logins. If a tool has no invite option, we agree another way with you first.
• Only the people working on your project get access. We keep that group small.
• Access is limited to the tools and environments the project needs. For example, we do not need your billing settings.

Credentials

• Credentials are kept in a password manager or shared vault. They are not sent in chat, email or code.
• If you send us a secret in the wrong place, we will tell you and ask you to change it.
• API keys and tokens live in environment settings or secret stores, never in the repository.
• When the project ends, we rotate or revoke the credentials we used. Where you gave us an invite, you can remove it, and we will also leave the account.

Where the code lives

• If you have a repository, we work in it.
• Otherwise the code lives in a private repository in our GitHub organisation, sr-web-studio, until handover.
• At handover, we move the repository to you, or give you a full copy, and show you how to run and deploy it.
• Local copies on our machines are temporary working copies.

Data we work with

• We use production data only when it is needed, for example to fix a bug we cannot reproduce another way.
• We prefer anonymised or made-up test data.
• If we must see personal data about your customers, we keep it to the people who need it. We do not copy it to places outside the project setup.
• We do not use your data for anything but your project.

Confidentiality and agreements

• We keep your non-public information private.
• We will sign an NDA on request.
• We will sign a data processing agreement (DPA) on request, if we process personal data for you. This is common when your customers are in the EU or UK.

After handover

Within 30 days of handover, we:

• delete local copies of your code and data
• remove our access to your accounts, or ask you to remove it
• remove your project from tools where we hold it

If you ask us in writing, we will confirm this in writing too.

Some things we may keep when the law requires us, or when we need them to settle a dispute: for example invoices, and the emails that make up our agreement. These do not include your production data.

If something goes wrong

If we find out that your data or access may have been exposed, we will:

• tell you promptly, and no later than 72 hours after we find out
• say what happened, what data or systems are affected, and what we know so far
• help you with the steps to contain it, such as rotating credentials
• tell you what we change to prevent it happening again

If you see something wrong on your side that involves our access, please email us right away.

AI tools

We do not paste client secrets, credentials, personal data or private code into AI tools without your permission. More in AI use.

Your side

You can help keep things safe:

• Give us only the access we ask for.
• Use invites, not shared passwords, when you can.
• Tell us when someone on your team leaves or when you change a key.
• Tell us in advance if your project has special rules, such as a regulated industry or a customer contract that limits who can see data.

How this page relates to the rest

This page describes our default practice. Your agreement may add stricter rules, and if it does, those apply. See also our Terms and Privacy policy.

Contact

SR Web Studio, Gazipur, Bangladesh support@srwebstudio.com