Privacy Policy

Nimbus Forma Studio (SSM 202603095969) is a registered sole proprietorship based in Kuala Lumpur, Malaysia, providing web design, development, branding, and digital system services.

For any enquiries regarding this policy or your personal data, contact us at heyitsnimbus@gmail.com.

We collect personal data only when you voluntarily provide it:

Contact Form

When you submit an enquiry through our contact form, we collect your name, email address, project type, budget range, and project details. This data is transmitted to and stored by Formspree, our form processing service, and forwarded to our email for response.

Product Waitlist

When you join a product waitlist, we collect your email address and associate it with the product you expressed interest in. This data is processed through Formspree under the same conditions as the contact form.

Analytics

We use Vercel Web Analytics to understand how visitors use our site. This service collects aggregated, anonymised data including page views, referral sources, browser type, device type, and approximate geographic location (country level). Vercel Analytics does not use cookies and does not track individual users across sessions.

Font Delivery

We load typefaces from Fontshare and Google Fonts. When your browser requests these fonts, your IP address and browser information are transmitted to these services as part of standard HTTP requests. No additional tracking occurs through these services.

Local Storage

We store non-personal preferences on your device using your browser's localStorage:

• Theme preference — whether you selected light or dark mode
• Currency preference — MYR or USD for product pricing
• Intro animation state — whether the page intro has been shown

This data never leaves your device, contains no personally identifiable information, and can be cleared at any time through your browser settings.

In accordance with the Notice and Choice Principle under the PDPA, we process your personal data for the following purposes:

• To respond to your enquiries and project requests
• To notify you about product launches you have expressed interest in
• To improve our website performance and user experience through anonymised analytics
• To deliver content and services you have requested

We do not use your data for marketing purposes unless you have explicitly opted in. We do not sell, rent, or trade your personal data to any third party.

We never sell your personal data. We only share your information with trusted third parties where necessary to operate this website:

• Form processing service — to receive and deliver your contact enquiries and waitlist signups to us
• Website hosting & analytics — to serve this website and collect anonymised, aggregated performance data

Some of these services may process your data outside of Malaysia. We have assessed each provider and believe they maintain adequate safeguards for the protection of your data in accordance with the PDPA.

Contact form submissions and waitlist signups are retained for as long as necessary to fulfil the purpose for which they were collected:

• Contact enquiries — retained until the enquiry is resolved or for up to 24 months, whichever is sooner
• Waitlist signups — retained until the product launches and you are notified, or until you request removal
• Analytics data — aggregated and anonymised; no individual-level data is retained

We implement appropriate technical measures to protect your data, including HTTPS encryption for all data in transit, Content Security Policy headers, strict transport security (HSTS), frame protection, XSS protection, and restricted permissions for browser APIs. Our hosting provider (Vercel) maintains SOC 2 Type II compliance. However, no method of electronic transmission or storage is completely secure, and we cannot guarantee absolute security.

Under the Malaysia Personal Data Protection Act 2010 and its 2024 amendments, you have the right to:

• Access — request a copy of the personal data we hold about you
• Correction — request correction of inaccurate or incomplete data
• Withdrawal of consent — withdraw your consent for data processing at any time
• Deletion — request deletion of your personal data where it is no longer necessary for the purpose it was collected
• Data portability — request your data in a structured, commonly used format

To exercise any of these rights, email us at heyitsnimbus@gmail.com. We will respond to your request within 21 days as required by the PDPA.

Our services are not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will promptly delete it.

We may update this privacy policy from time to time to reflect changes in our practices or legal requirements. Any changes will be posted on this page with an updated revision date. We encourage you to review this policy periodically.

If you have questions about this privacy policy or wish to exercise your data rights, contact:

Nimbus Forma Studio
Kuala Lumpur, Malaysia
heyitsnimbus@gmail.com