1. Information we collect
We collect information you submit, including contact details, business context, project needs, budgets, timing, messages, review notes, and uploaded files. For invited accounts we also process identity, role, authentication, session, access, download, review, and activity records.
2. Security information
Passwords are stored as salted, computationally expensive hashes rather than readable passwords. One-time sign-in tokens are stored as hashes and expire. Session records may include a limited user-agent value and a hashed network address used for security, rate limiting, and investigation.
3. How we use information
We use information to evaluate inquiries; communicate about potential and active engagements; provide scoped client access; store and deliver project content; record reviews and approvals; protect accounts; enforce quotas and retention; investigate misuse; and operate, support, and improve the service.
4. Legal and operational basis
Depending on the relationship and applicable law, processing is based on your request or consent, steps toward an agreement, performance of an agreement, legal obligations, and legitimate interests in operating and securing the studio and platform.
5. Service providers
Hosting, database, object-storage, inbound email-routing, and transactional account-email infrastructure is provided through Cloudflare and the Sites hosting platform. Providers process information only for contracted services and under their own applicable terms and security commitments.
6. Cookies and analytics
The platform uses an essential, HTTP-only session cookie to keep signed-in users authenticated. The current site does not use nonessential advertising cookies or public behavioral analytics. If nonessential analytics are introduced, this policy and any required consent controls will be updated first.
7. Sharing
We do not sell personal information. We may share information with authorized A+Media staff, the client organization that controls a workspace, production collaborators who need it for the engagement, service providers, advisers, or authorities when legally required or necessary to protect rights and security.
8. Retention and deletion
Inquiry records remain until disposition and are then archived or deleted according to business and legal needs. Project records follow the applicable agreement. Managed files receive a default twenty-four-month retention marker unless adjusted. When stored bytes are deleted, limited metadata may remain for security, accounting, approval, or audit purposes.
9. Your choices
You may request access, correction, or deletion of appropriate personal information, object to certain processing, or change communication preferences. Some records must be retained for contracts, security, legal obligations, or the rights of other parties. Workspace access requests may also need authorization from the client organization.
10. Security and international processing
We use access controls, secure cookies, token hashing, file validation, integrity records, rate limits, audit trails, and role scoping. Information may be processed where our providers operate. No method is risk-free, so avoid submitting unnecessary sensitive information.
11. Contact and updates
Privacy requests and questions may be sent to a@aplusmediaonline.com. We may update this policy as the service changes; the effective date identifies the current version.