Privacy Policy
Plain-English summary of what we collect, why, how long we keep it, and how you can exercise your rights. This policy applies to mangobaz.com and all subdomains.
Last updated: 1 September 2026. Version 2.1. Previous versions available on request.
1. Who we are
Mangobaz IT Solutions ("we", "us", "our") is an independent web studio based in Lahore, Punjab, Pakistan. We operate the website mangobaz.com (the "Site"). For any privacy question, write to privacy@mangobaz.com — a human reads this inbox within five working days.
2. The short version
- We collect the minimum data needed to operate the Site, respond to you if you contact us, and count anonymous visits.
- We do not sell, rent, or trade your personal data to anyone, ever.
- We use one first-party cookie (
mb_vid) and, if you accept advertising, a small number of cookies set by Google AdSense. - You can ask us to delete any message you've sent us, and you can clear our cookies at any time.
- This site is not directed at children under 13. We do not knowingly collect data from children.
3. What data we collect, and why
| Category | What | Why (purpose) | Legal basis (GDPR) | Retention |
|---|---|---|---|---|
| Contact form | Your name, email address, message body | To reply to your enquiry | Contract / pre-contractual steps | Until you ask us to delete it, or 24 months of inactivity |
| Server logs | IP address, user-agent, requested path, status code | Security, debugging, abuse prevention | Legitimate interest | Rolling 14 days |
| Analytics | Random visitor ID (mb_vid), screen size, timezone, language |
Count visits and measure dwell time so we know what content works | Legitimate interest | Aggregated after 13 months; individual rows are kept for 24 months |
| Error logs | Error message, stack trace, request path | Diagnose and fix bugs | Legitimate interest | 30 days |
| Advertising (only if you accept) | Google AdSense cookies and similar identifiers | Show ads and measure their performance | Consent (opt-in for EU/UK visitors) | Controlled by Google; see Google's advertising privacy policy |
4. Cookies, pixels, and local storage
We use a small number of cookies. "Cookies" here means HTTP cookies, browser local storage, and similar client-side identifiers.
| Name | Provider | Category | Purpose | Expiry |
|---|---|---|---|---|
mb_vid | Mangobaz (first-party) | Analytics | Anonymous visitor identifier for visit counting | 13 months |
.AspNetCore.Antiforgery.* | Mangobaz (first-party) | Essential | CSRF protection on form submissions | Session |
mb_admin | Mangobaz (first-party) | Essential | Authenticates the admin user; only set if you log in at /admin/login | 8 hours |
__Secure-1PAPISID, __Secure-3PSID and similar _GA* / _GREC* cookies | Google (third-party) | Advertising | Personalised ads, ad measurement, fraud prevention | Up to 13 months |
Our full cookie inventory and consent controls live on the Cookies page.
5. Third-party data processors
We share data with the following processors under data-processing agreements:
- Hosting provider: the server that runs this website (in a jurisdiction we will publish on this page when the production host is finalised; at time of writing we run on a local dev server).
- Google AdSense & Advertising Partners — advertising delivery, measurement, and fraud prevention (only after user consent).
Third-party vendors, including Google, use cookies to serve ads based on a user's prior visits to this website or other websites. Google's use of advertising cookies enables it and its partners to serve ads to users based on their visit to this site and/or other sites on the Internet.
Users may opt out of personalized advertising at any time by visiting Google Ads Settings. Alternatively, users may opt out of a third-party vendor's use of cookies for personalized advertising by visiting www.aboutads.info. For additional details, see Google's Advertising Privacy & Terms.
- Google Fonts — web-font delivery. Google may log your IP address for serving the font file.
- Schema.org structured data — our JSON-LD is published on-page and not transmitted to a third party.
We do not use Google Analytics, Facebook Pixel, Hotjar, Mixpanel, or any third-party analytics beyond the first-party mb_vid counter described above.
6. International data transfers
Our servers are based in Pakistan. Some of our processors (notably Google AdSense and Google Fonts) are based in the United States and the European Union. Where data is transferred outside the country of the visitor, we rely on the processor's published safeguards (Google's Standard Contractual Clauses, EU adequacy decisions where applicable, and equivalent contractual terms).
7. Your rights
If you are in the European Economic Area, the United Kingdom, or California, you have the right to:
- Access — ask what personal data we hold about you.
- Rectification — ask us to correct inaccurate data.
- Erasure — ask us to delete your data ("right to be forgotten").
- Restriction — ask us to pause processing while a complaint is investigated.
- Portability — receive your data in a machine-readable format.
- Objection — object to processing based on legitimate interest.
- Withdraw consent — at any time, where processing is based on consent.
- Lodge a complaint — with your local data-protection authority. In the EU, the relevant authority is your country's DPA; in the UK, the ICO at ico.org.uk.
To exercise any of these rights, email privacy@mangobaz.com. We respond within 30 days. We may need to verify your identity before acting.
8. Children's privacy
The Site is not directed at children under 13. We do not knowingly collect personal data from anyone under 13. If you believe a child has provided data through the contact form, email privacy@mangobaz.com and we will delete it.
9. Security
We use HTTPS, bcrypt-hashed admin passwords, parameterized SQL queries, content-allow-list sanitisation on article bodies, and access logging to protect the data we hold. No system is 100% secure; if we discover a breach affecting your data, we will notify you and the relevant authorities within 72 hours.
10. Changes to this policy
We may update this policy. Material changes (changes to what we collect or how we use it) will be highlighted in the changelog at the top of this page for at least 30 days. Non-material changes (typo fixes, contact details) are made silently.
11. Contact & complaints
For privacy questions, data-access requests, or complaints, contact:
- 📧 privacy@mangobaz.com
- 📬 Mangobaz IT Solutions, Lahore, Punjab, Pakistan
12. Version history
- v2.1 (1 Sep 2026): expanded processor list, added ad-cookie inventory, added CCPA / GDPR cross-references.
- v2.0 (15 Jan 2026): rewrote for plain-English legibility and added table of data categories.
- v1.0 (2019): initial policy.