Privacy notice

• We collect what you give us when you book a consultation or send a message: a name, an email address, and a description of what you want built. Everything else on the booking form is optional.
• We do not sell data, we do not run advertising trackers, and we do not add you to a mailing list because you contacted us.
• Our site analytics are cookieless and count visits, not people. This site shows no cookie banner because it is designed not to need one.
• The computer-vision demo runs entirely on your device. Your camera feed is never uploaded, never recorded, and never leaves the browser tab.
• You can ask us to delete everything we hold about you, at any time, and we will do it.

The rest of this page is the detail. If anything here contradicts what our software actually does, the software is the bug — tell us and we will fix it.

Mehnga Technologies operates this website and is responsible for the personal data described here. Registered entity name and address: legal entity and registered address to be confirmed.

Data protection contact: named privacy contact or DPO to be appointed if required.

We only collect data in four situations, and each one is something you deliberately did.

a. Booking a free consultation

The booking form is served by Cal.com and asks for your name and email address (required, so we can send the invite), plus phone or WhatsApp number, project type, a short description and a budget range, all optional. Cal.com also records the slot, your timezone and the meeting link. We use this to hold the meeting, prepare for it, and follow up about your project.

b. The contact form

Three fields: name, email address and your message. We do not ask for anything else. Our server also records the time of the submission and technical request metadata such as an IP address, for the sole purpose of blocking abuse and spam.

c. Emails and messages you send us

If you email us, reply to one of our emails, or message us on WhatsApp, we keep that correspondence so the next person who picks up your enquiry has the context. WhatsApp messages are also processed by WhatsApp under its own terms, which we do not control.

d. Simply visiting the site

Our hosting provider and CDN process the technical information every web request carries — IP address, browser, requested page — in server logs, to serve the page and to defend against attacks. We also count the visit in our analytics, described next.

Legal basis for each of the above: legal basis to be set per jurisdiction — see section 07.

We want to know which pages help people and which ones waste their time. We do not want to know who you are. So the site uses privacy-friendly, cookieless analytics: aggregate counts of page views and a small set of product events — a page was viewed, a booking form was opened, a demo was used, a message was sent.

• No advertising or cross-site tracking pixels are loaded on this site.
• No analytics cookie is set, no advertising identifier is created, and nothing is persisted in your browser to recognise you on a later visit.
• Analytics events carry the page path and a short label such as which section you reached. They never carry your name, your email address or anything you typed.
• This is why you are not being asked to dismiss a cookie banner. We would rather remove the tracking than add the banner.

Analytics providers currently planned: final provider configuration to be confirmed with counsel.

This site includes a live computer-vision demo that can use your camera. It exists because claiming we do computer vision is cheap and showing it is not.

• Your camera never starts on its own. The browser only asks for permission after you press the button that says so. There is no silent permission probe and no warm-up stream.
• Video is processed entirely on your device. Frames go from the video element into a model running inside your browser tab and are drawn straight back to the screen. No frame is encoded, uploaded, stored or sent to us or to anyone else. We never receive your video, and there is nothing for us to keep.
• Stopping means stopping. When you press stop or leave the page, the camera track is released and the model is closed — the camera indicator light goes out.
• We receive one analytics event recording that a demo was interacted with. It contains the name of the demo and nothing about what the camera saw.

One honest caveat: to run the model in your browser we currently download it, and the runtime it needs, from third-party content delivery networks (jsDelivr and Google storage). Downloading a file reveals your IP address to the host serving it, exactly as visiting any website does. We plan to serve both files from our own domain so that stops being the case: self-hosting of demo assets to be completed before launch.

The 3D board viewer and other interactive elements load only assets from our own site and collect nothing.

Bookings and messages become a record in our own internal system, hosted in a database we control. That record holds your contact details, what you told us about your project, and the history of our conversation — which meetings happened, which demo we built, what was quoted. Access is limited to the people at Mehnga who work on enquiries, and changes to records are logged.

We do not sell this data, share it with advertisers, or use it to train models.

Retention: retention periods to be set with counsel. Our intent is to keep enquiry records only for as long as there is a realistic prospect of working together or a legal obligation to keep them, and to delete or anonymise them after that. The exact periods will be stated here once they are agreed.

If you ask us to delete your data before then, we do it — see section 08.

We use a small number of service providers to run the site and the business. They process data on our instructions and for no other purpose.

• Cal.com — the booking calendar. Receives whatever you enter in the booking form, and creates the calendar invite.
• Resend — sends our transactional email: booking confirmations, reminders and replies. Receives your email address and the content of those messages.
• Our hosting and database providers — run the site and store the enquiry records described above.
• Our CDN and security provider — sits in front of the site, serves assets and filters malicious traffic. Processes request metadata.
• Our analytics provider — receives the aggregate, cookieless events described in section 03.
• Our error-monitoring provider — receives technical diagnostics when something on the site breaks, so we can fix it.
• Third-party CDNs used by the browser demo — see section 04.

The named providers behind each role, and the data-processing agreements with them: provider list and DPAs to be finalised before launch.

We will also disclose data where the law requires it, and to our professional advisers where necessary — for example if an enquiry becomes a dispute.

Mehnga works from Pakistan, and several of the providers above operate outside it. That means your data may be processed in more than one country.

Applicable law, lawful bases and international transfer mechanisms: jurisdiction analysis to be completed by counsel. Until that is published, our practical commitment stands regardless of regime: we collect the minimum, we do not sell it, and we delete it when you ask.

Whatever the applicable law turns out to require, we will honour all of the following on request:

• Access — a copy of what we hold about you.
• Correction — fix anything that is wrong.
• Deletion — erase your enquiry record and correspondence, except where we are legally required to keep something.
• Portability — your data in a machine-readable file.
• Objection — tell us to stop contacting you. One line is enough and we do not ask why.

To exercise any of these, email us with the address you used and what you want done. We will confirm the request, act on it, and tell you when it is finished — within 30 days at the outside, usually much sooner. We do not charge for this, and we do not make you argue with a retention specialist first.

Send requests to team.outreach@mehngatechnologies.com.

Right to complain to a supervisory authority: authority to be named once jurisdiction is settled.

The site is served over HTTPS only. Internal systems are behind authentication with two-factor available, sessions expire, access is limited by role, and every change to an enquiry record is written to an audit log. Databases are backed up. Dependencies are checked for known vulnerabilities as part of our release process.

No system is perfect. If we ever discover a breach affecting your data, we will tell you what happened, what it means for you, and what we did about it — promptly, and without burying it in a status page.

This site sells engineering services to businesses and is not directed at children. We do not knowingly collect data from anyone under the age at which consent is required in their country. If you believe a child has sent us personal data, tell us and we will delete it.

When this notice changes we update the review date at the top of the page. If a change materially affects how we handle data you have already given us, we will tell the people affected directly rather than relying on you to re-read the page.

Questions about any of this are welcome, including the awkward ones. The contact page lists every way to reach us, and our terms cover the commercial side of working together.