Privacy policy.

curiousobjects.dev is operated by Curious Objects LLP (“Curious Objects”, “we”, “us”), a product studio at Sharjah Media City, Sharjah, Dubai.

For personal data described on this page we are the data controller — we decide what is collected and why. Privacy questions and requests go to hello@curiousobjects.dev.

This policy covers this website only. Our products have their own policies where their data handling differs — for the Parceler Shopify app, see the Parceler privacy policy. Use of this site is also subject to our terms of use.

Nothing you have to type. The site has no contact form, no newsletter signup, no login and no comments — every “get in touch” on the site is a plain email link. So the data we hold falls into three narrow categories:

We do not ask for and have no way to collect payment details, government identifiers, health data, or any other special-category data through this site. We do not use the site to infer characteristics about you, and there is no automated decision-making or profiling of any kind.

This site sets no cookies. Not essential ones, not analytics ones, not advertising ones. That is why you are not being asked to dismiss a consent banner.

There is one piece of on-device storage, and it is worth naming precisely. The intro animation you see on arrival writes a single sessionStorage flag so it does not replay on every page you visit. It holds one value, it never leaves your browser, it is not sent to us or to anyone else, and it is discarded the moment you close the tab.

The site loads no third-party scripts, trackers, embeds, pixels, ad tags or chat widgets. Fonts are self-hosted and served from our own domain, so simply visiting this site makes no request to Google Fonts or any other font service.

We do link out to our profiles on Instagram and Facebook. Those are ordinary links — nothing is loaded from them until you click, and once you do, that platform’s own privacy policy governs what happens next.

Each category has one purpose and one legal basis. Where the GDPR or UK GDPR applies, that basis is our legitimate interest in running and defending a website and in responding to people who contact us; where you have emailed us or applied for a role, processing is also necessary to take steps at your request.

• Server logs — to serve pages, keep the site available, and investigate abuse, errors and attacks. Never used to identify or follow individual visitors.
• Email correspondence — to read your message, reply to it, and keep the thread of a conversation or project.
• Job applications — to assess your application and to talk to you about it.

We do not use any of it for advertising, and we do not sell, rent or trade personal data. There is no third party paying us for access to it, because there is no arrangement of that kind.

Only the service providers needed to run the site and our email, each acting on our instructions as a processor:

Beyond that, we disclose personal data only where the law requires it — a binding legal request, or the need to establish or defend a legal claim.

We operate from the UAE and our providers run global infrastructure, so data may be processed outside the country you are in — including in the United States and the EU. Where data leaves a region that restricts such transfers, we rely on the safeguards our providers have in place, including the European Commission’s Standard Contractual Clauses.

• Server logs — retained briefly by our host for operational and security purposes, then rotated out. We do not copy them into long-term storage of our own.
• Email correspondence — kept for as long as the conversation or the relationship it belongs to is live, and for up to 24 months after, then deleted.
• Job applications — kept for up to 12 months so we can come back to you if a suitable role opens, unless you ask us to delete them sooner.

Ask us to delete something earlier and we will, unless we are legally required to keep it.

The site is served over HTTPS/TLS, so traffic between your browser and us is encrypted in transit. Access to studio email and hosting accounts is limited to the people who need it and protected by strong authentication.

One honest caveat: email is not a secure channel. Please do not send us passwords, card numbers, identity documents or anything else sensitive by email — ask us first and we will find a safer route.

Depending on where you live — under the GDPR and UK GDPR, the UAE Personal Data Protection Law, the CCPA/CPRA and comparable laws — you may have the right to:

• Access the personal data we hold about you.
• Correct it if it is wrong or incomplete.
• Have it deleted.
• Restrict or object to how we use it, including objecting to processing based on legitimate interests.
• Receive it in a portable, machine-readable form.
• Be free from discrimination for exercising any of these rights.

Email hello@curiousobjects.dev and we will respond within 30 days. There is no charge. If you believe we have handled your data badly, you can also complain to your local data protection authority — but we would rather you told us first, so we can fix it.

This site is aimed at people looking to work with a product studio. It is not directed at children, and we do not knowingly collect personal data from anyone under 16. If you believe a child has sent us personal data, email us and we will delete it.

If what we do changes — if we ever add a form, or analytics, or anything that touches your data — this page changes first, and the “last updated” date at the top changes with it. For anything material we will make the change obvious rather than quietly amending the text.

Privacy questions, requests to exercise any of the rights above, or a correction to something on this page — all go to the same place as everything else: hello@curiousobjects.dev. It is a small studio and a real person reads it.

Curious Objects LLP, Sharjah Media City, Sharjah, Dubai.