Privacy Policy

1. Introduction

OVERCEPT (SMC-PRIVATE) LIMITED ("Overcept", "we", "us", or "our") is a software agency incorporated under the laws of Pakistan. We operate the website at https://overcept.com.

This Privacy Policy explains what personal information we collect when you visit our website or contact us, why we collect it, how we use and protect it, and the rights you have over your information. Please read it carefully.

By using our website, you acknowledge that you have read and understood this Privacy Policy.

2. Information We Collect

We collect only the information necessary to run our website and communicate with potential clients. This includes:

• Contact form data — your name, email address, and any message you voluntarily submit through our contact form.
• Usage and analytics data — depending on your consent choice, we collect either:
  • Cookieless analytics (privacy-preserving mode): pages visited, referral source, browser type, device type, and a pseudonymous identifier derived from a one-way hash — no cookies are set, and this identifier is never used to build an individual profile of you or to re-identify you.
  • Full analytics (cookie-based mode): the above plus cookie-stored identifiers, session recordings (mouse movements, clicks, scrolling), button interactions, form interactions, and feature flag evaluations — only when you explicitly consent.
• Cookie data — small text files placed on your device that help us understand how you navigate our site. See Section 5 (Cookies & Analytics) for details.

We do not collect payment information, government identification, or any sensitive personal data through our website.

3. How We Use Your Information

We use the information we collect for the following purposes:

• To respond to your enquiries and communicate with you about potential projects.
• To understand how visitors use our website so we can improve it.
• To maintain the security and performance of our website.
• To comply with applicable legal obligations.

We do not use your information for automated decision-making, profiling, or any purpose incompatible with those listed above.

4. Legal Basis for Processing

We process your personal information on the following grounds:

• Contractual or functional necessity (essential cookies) — strictly necessary cookies (session, CSRF token, consent preference) are required for the website to function. These are not subject to consent under the ePrivacy Directive and are set automatically.
• Legitimate interests (cookieless analytics) — when you accept only essential cookies, PostHog operates in cookieless mode. Data is pseudonymised via a server-side one-way hash before we ever see it, is never combined with other information to re-identify you, and is used only in aggregate. Even if this pseudonymised data were considered personal data under applicable law, we rely on our legitimate interest in understanding broad, non-identifying usage patterns to improve our services, and we have assessed that this interest is not overridden by any impact on your rights. You may object to this processing at any time by contacting us.
• Your consent — where you voluntarily submit your details via a contact form, or where you accept analytics cookies (enabling full PostHog tracking including cookie-based identifiers and session recordings). You may withdraw your consent at any time via the cookie preferences button or by contacting us.
• Legal obligation — where we are required by applicable law to retain or disclose information.

5. Cookies & Analytics

Our website uses PostHog, an open-source product analytics platform (Cloud US), to understand how visitors interact with our site. PostHog processes data as a data processor on our behalf and is contractually prohibited from using it for its own purposes. You can review PostHog's privacy practices at posthog.com/privacy and its GDPR compliance guidance at posthog.com/docs/privacy/gdpr-compliance.

How consent affects PostHog tracking

Our cookie banner gives you three choices. Here is what happens under each:

• Accept all — PostHog operates in full mode: cookies are stored, your browser is assigned a persistent identifier, and we can track page views, clicks, form interactions, scroll behaviour, and session recordings (mouse movements and page state snapshots). This helps us understand exactly how users navigate our site. No events are captured before you give consent.
• Accept essentials only — PostHog switches to cookieless privacy mode. No cookies are set, no data is stored in local storage, and no data is stored that identifies you individually. A privacy-preserving one-way hash is computed on PostHog's servers to count unique visitors in aggregate without identifying individuals. Reporting is limited to aggregate patterns (e.g., which pages are popular, what browser types visitors use) rather than any single visitor's activity.
• Customise — analytics declined — Same as essentials only: cookieless mode applies, with no cookies or persistent identifiers stored.
• Customise — analytics accepted — Same as "Accept all": full PostHog tracking enabled.

You can change your preference at any time using the cookie settings button in the footer of our website.

What PostHog collects in full (cookie-based) mode

With your consent, PostHog may collect:

• Page views and navigation — URLs visited, referrer, time on page.
• Interactions — clicks on buttons, links, and form elements; form submissions; input changes.
• Session recordings — recordings of mouse movements, clicks, scrolling, and DOM snapshots to diagnose usability issues. Sensitive elements (passwords, payment fields) are automatically masked and never recorded. You can opt out of session recording entirely by declining analytics cookies.
• Device and browser information — screen size, operating system, browser version, language.
• Feature flag evaluations — which A/B test variants or rolled-out features you see.

We do not pass your name, email address, or any identifiable personal data to PostHog unless you explicitly provide it via a contact form.

Data transmission

PostHog analytics data is transmitted through our own subdomain (e.overcept.com), acting as a reverse proxy. This prevents ad-blockers from blocking analytics requests while maintaining your privacy — no data is shared with third-party tracking networks.

Cookie summary

Most browsers allow you to control or delete cookies through their settings. Disabling analytics cookies will not affect your ability to use our website.

6. Sharing of Information

We do not sell, rent, or trade your personal information. We may share it only in the following limited circumstances:

• Service providers — such as our web hosting provider and PostHog (analytics). PostHog Inc. (based in the United States) processes analytics data as a data processor on our behalf under a Data Processing Agreement (DPA) that includes Standard Contractual Clauses (SCCs) for lawful international data transfers under EU and UK data protection law. These parties are contractually prohibited from using your data for their own purposes.
• Legal requirements — if required by Pakistani law, a court order, or a government authority with lawful jurisdiction.
• Business transfers — in the event of a merger, acquisition, or sale of our company, your information may be transferred as part of that transaction, subject to equivalent privacy protections.

7. Data Retention

We retain contact form submissions for as long as is reasonably necessary to respond to your enquiry and maintain a record of our communications — typically no longer than 2 years from the date of last contact, unless a longer retention period is required by law or an ongoing business relationship.

Analytics data is retained as follows:

• Cookieless mode (essentials only): aggregated, non-identifiable data is retained indefinitely because it cannot be linked to any individual. No data that could identify you is stored.
• Full mode (analytics consented): raw event data (including cookie-based identifiers) is retained for up to 2 years from collection. You may request deletion of your analytics profile at any time (see Section 9).

8. Data Security

We take reasonable and appropriate technical and organisational measures to protect your personal information against unauthorised access, loss, or disclosure. Our website is served over HTTPS, and access to any data we hold is restricted to authorised personnel only.

No method of transmission over the internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security and accept no liability for breaches beyond our reasonable control.

9. Your Rights

Depending on applicable law (including the GDPR for users in the European Economic Area, the UK GDPR, and the CCPA for California residents), you may have the following rights:

• Right of access — request a copy of the personal information we hold about you.
• Right to rectification — request correction of inaccurate or incomplete information.
• Right to erasure ("right to be forgotten") — request deletion of your personal information, including your analytics profile in PostHog (subject to legal obligations we may have).
• Right to withdraw consent — at any time, where processing is based on your consent. Withdrawing consent does not affect the lawfulness of processing before withdrawal.
• Right to object — object to processing based on legitimate interests (including cookieless analytics).
• Right to restriction — request that we restrict processing of your data in certain circumstances.
• Right to data portability — request a structured, commonly used, machine-readable copy of your data (where processing is based on consent or contract).

To exercise any of these rights, please contact us using the details in Section 13 below. We will respond within 30 days (or as required by applicable law). We may need to verify your identity before processing your request.

If you are in the EEA or UK, you also have the right to lodge a complaint with your local data protection supervisory authority if you believe we have not handled your data in accordance with applicable law.

10. Children's Privacy

Our website is not directed at individuals under the age of 18. We do not knowingly collect personal information from minors. If you believe we have inadvertently collected such information, please contact us and we will delete it promptly.

11. External Links

Our website may contain links to third-party websites. We are not responsible for the privacy practices or content of those sites. We encourage you to review the privacy policies of any external sites you visit.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. We encourage you to review this page periodically. Continued use of our website after changes constitutes your acceptance of the revised policy. Material changes that affect how we process your data will be communicated prominently on our website.

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal information, please contact us:

OVERCEPT (SMC-PRIVATE) LIMITED
Islamabad, Pakistan
Website: https://overcept.com
Email: contact@overcept.com