Short version: we don't track you.
Sama runs a small studio website. We don't have an analytics platform, we don't have a marketing automation stack, and we have no commercial interest in your personal data. This page exists so you know exactly what that means.
Who we are (data controller)
Sama is a founder-led studio providing software services globally. For the purposes of data protection law, Sama is the data controller for personal data collected via sama.ink and our Telegram intake bot. Contact: hello@sama.ink.
What we collect when you visit sama.ink
Nothing trackable. The website sets no cookies. There are no analytics scripts, no advertising pixels, no third-party trackers, no fingerprinting. The only third-party requests the site makes are to fonts.googleapis.com to load typefaces and cdn.jsdelivr.net to render the QR code — your IP address may briefly be visible to those services as part of standard CDN operation. We don't see or store anything from this.
What we collect via our Telegram bot (@sama_sales_bot)
When you scan the QR code or open the bot link, you interact with Telegram's platform — Telegram's Privacy Policy governs that interaction. Within the bot conversation, we receive:
- Your Telegram display name and username (provided automatically by Telegram)
- Your Telegram user ID
- Your answers to our four intake questions (project description, timeline, budget range, type of work)
This data is held in memory only for the duration of your conversation (typically a few minutes) and then deleted. A summary of qualified enquiries is forwarded to the founder via Telegram. It is not stored in any database, CRM, or third-party service beyond Telegram's own message history.
Legal basis (GDPR / UK GDPR): Legitimate interests — responding to a business enquiry you have actively initiated.
What we collect when you email us
If you email hello@sama.ink, we receive your name, email address, and message. We keep that correspondence for as long as our working relationship requires it, plus an archival period of up to three years.
Legal basis: Legitimate interests (responding to a business enquiry) or, where a contract results, performance of that contract.
We don't add you to any newsletter, drip campaign, CRM, or remarketing list. We don't share your contact details with third parties. If we work together, client data is governed by the agreement we sign — typically including an NDA.
What we use it for
- Replying to your enquiry.
- Scoping or delivering work you've engaged us for.
- Meeting our legal and accounting obligations.
No profiling, no automated decision-making, no behavioural advertising.
International data transfers
Sama serves clients globally. Some infrastructure we rely on processes data outside your country:
- Telegram — operated across multiple jurisdictions. See Telegram's Privacy Policy.
- Render.com — our bot is hosted in Oregon, USA. Render is SOC 2 Type II certified.
- Google Fonts / jsDelivr — CDN requests as described above.
Where EU/UK GDPR applies to transfers to non-adequate countries, those transfers rely on Standard Contractual Clauses or the recipient's own adequacy mechanism.
Your rights
Under GDPR, UK GDPR, India's DPDP Act, CCPA, and similar laws, you have rights over your personal data:
- Access — request a copy of what we hold about you
- Rectification — ask us to correct inaccurate data
- Erasure — ask us to delete your data
- Restriction — ask us to pause processing while a dispute is resolved
- Portability — receive your data in a machine-readable format
- Objection — object to processing based on legitimate interest
To exercise any of these, email hello@sama.ink with privacy request in the subject. We'll respond within 30 days (EU/UK GDPR), 45 days (CCPA), or sooner.
You also have the right to lodge a complaint with your local supervisory authority — for example the ICO (UK), your national DPA (EU), or the equivalent body in your jurisdiction.
Data we don't have
We never collect, request, or store: payment card numbers, government ID numbers, biometric data, precise location data, health data, or anything else qualifying as sensitive personal data under applicable law.
Children
Our site and services are directed at businesses and professionals aged 18 or over. We don't knowingly collect data from anyone under 18. If you believe we have done so inadvertently, contact us and we will delete it immediately.
Changes to this policy
Material changes will be reflected in the "Last updated" date above. Active clients will be notified directly.
Contact & complaints
Privacy questions or complaints: hello@sama.ink. If we can't resolve your concern, you have the right to escalate to your local data protection authority.