Privacy & Terms

Who we are

Mestara ("we", "us") is a type foundry based in Riyadh, Saudi Arabia, and is the data controller for personal data processed through mestara.com. You can reach us at info@mestara.com for anything in this policy, including a request to exercise your rights.

This policy is written to meet the Kingdom of Saudi Arabia’s Personal Data Protection Law (PDPL) and its implementing regulations, and the EU and UK General Data Protection Regulation (GDPR), together with the ePrivacy rules on cookies.

What we collect

We collect four things, and nothing else:

• Contact form — your name, email address, chosen subject, and the message you write. Sent only when you submit the form.
• Technical data — your IP address, browser and device type, referring page, and the pages you request. Recorded automatically in server logs by our hosting provider so the site can be delivered and protected from abuse.
• Analytics — only if you accept the cookie banner: pseudonymous usage statistics such as pages viewed, approximate location at country or city level, device type, and how you arrived. Decline and none of this is collected.
• Browser storage — your colour theme choice and your answer to the cookie banner, saved in your browser’s local storage. These never leave your device and are not sent to us.

What we do not do

We do not operate user accounts, take payments, or process any downloads on this site. We do not collect special categories of data (health, religion, biometrics, and the like), we do not sell or rent personal data, we do not use it for advertising, and we do not make automated decisions or build profiles that produce legal or similarly significant effects.

Why we use it, and our legal basis

• To reply to your enquiry and, where relevant, to quote and discuss a project — necessary to take steps at your request before entering a contract, or our legitimate interest in answering people who write to us (GDPR Art. 6(1)(b) and 6(1)(f)). Under the PDPL, we process this data solely for the purpose you provided it.
• To keep the site available, fast, and secure — our legitimate interest in operating and defending the service (GDPR Art. 6(1)(f)).
• To understand how the site is used — your consent, and only your consent (GDPR Art. 6(1)(a); PDPL consent). You can withdraw it at any time, and withdrawal does not affect processing already carried out.

Cookies and browser storage

No analytics or advertising cookie is set when you arrive. Google Analytics is loaded only after you press "Allow all" on the banner; choosing "Allow essential only" loads nothing at all, and your choice is remembered so we do not ask again.

The two entries we keep in your browser’s local storage — your theme preference and your consent answer — are strictly necessary for the site to work as you asked and are not used to track you. To change or reset your choice, clear this site’s data in your browser settings and the banner will reappear.

Who else processes your data

We use a small number of service providers, each acting on our instructions and none permitted to use your data for their own purposes:

• Cloudflare — hosting and content delivery for the site, including the server logs described above.
• Web3Forms — receives your contact form submission and delivers it to our inbox. Nothing is stored for us beyond delivery.
• Google (Google Analytics) — usage statistics, loaded only with your consent.

International transfers

We are based in Saudi Arabia and our providers process data in the European Union, the United States, and other countries. Where personal data is transferred out of the EEA or the UK, we rely on an adequacy decision or on the European Commission’s Standard Contractual Clauses (with the UK Addendum where applicable). Transfers out of Saudi Arabia are made in line with the PDPL’s provisions on transfers abroad and the regulations issued under them.

How long we keep it

• Contact form messages and the correspondence that follows — up to 24 months after our last exchange, unless the enquiry becomes a commissioned project, in which case we keep it for as long as the engagement and our legal record-keeping obligations require.
• Analytics data — up to 14 months, then deleted by Google Analytics automatically.
• Server logs — a short retention period set by our hosting provider, typically measured in days, for security and diagnostics.

Your rights

Wherever you live, you can ask us to give you a copy of the personal data we hold about you, correct it if it is wrong, delete it, restrict or object to how we use it, or send it to you or another provider in a portable format. Where we rely on your consent, you can withdraw it at any time. Under the PDPL you also have the right to be informed of how your data is used and to request its destruction.

Email info@mestara.com and we will respond within 30 days. Exercising these rights is free, and we will never treat you differently for doing so.

If you are unhappy with our response, you can complain to a regulator: in the EEA or the UK, your national data protection authority; in Saudi Arabia, the Saudi Data & Artificial Intelligence Authority (SDAIA).

Children

This site is aimed at designers, studios, and businesses, and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has sent us data, write to us and we will delete it.

Security

The site is served entirely over HTTPS, and we apply technical and organisational measures appropriate to the small amount of data involved. No method of transmission or storage is completely secure, so please do not send us confidential material through the contact form.

Changes to this policy

If we change how we handle personal data, we will update this page and the date shown at the top. Where a change is significant, we will make that clear rather than relying on you to spot it.