Privacy Policy

Information We Collect

What you give us. When you contact us through our website form, we collect your name, email address, selected service interest, and project details. This is used solely to respond to your enquiry and discuss potential photography projects. Nothing on this site asks for payment details, identity documents, or a password.

What is collected automatically. Loading any page sends your IP address and standard request metadata (browser, device type, referring page) to Cloudflare, who host the site. Google Analytics records which pages you view and roughly where you are, at country and city level. Neither of these is linked to your name or email unless you also send us the form.

How We Use Your Information

• To respond to your inquiries and provide quotes
• To communicate about photography sessions and deliverables
• To send project-related updates and final images
• To improve our website and services

Third-Party Services and Sub-Processors

We use a small number of third-party providers to run this website and answer your enquiries. Each one is listed below with what it receives and why. We do not sell your data, and we do not share it with anyone outside this list.

Contact form submissions are handled by our own code running on Cloudflare Workers — the data is not stored in a database. It is verified by Turnstile, emailed to us through ZeptoMail, and then exists only in our email inbox.

Where Your Data Is Processed

Sorot Studio operates from Kuala Lumpur, but the providers above run on global infrastructure. Your data is therefore processed on servers outside Malaysia — Cloudflare routes requests through the nearest edge location, and Google and Zoho process data in their own international regions. By using this site or sending us an enquiry, you consent to that transfer.

How Long We Keep It

Enquiries arrive as email and are not written to any database. We keep them while your enquiry is active and for up to 24 months afterwards, so we can pick up a conversation you return to. Where we go on to work together, contracts, invoices and related records are kept for 7 years to meet Malaysian tax and business record-keeping requirements. Google Analytics retains its own data according to the retention period set in our Analytics account.

You can ask us to delete your enquiry sooner at any time — see Your Rights below.

Analytics

We use Google Analytics 4 to understand which pages visitors use, how long they stay, and roughly where they are (country and city level). We never send your name, email address or enquiry details to Google. Analytics does, however, identify a returning browser by a random identifier stored in a cookie, so it is not fully anonymous — it simply is not tied to anything that identifies you personally. We use it only to improve the site. See Google's privacy policy for details.

Cookies and Local Storage

This site sets two cookies, both from Google Analytics: _ga and _ga_NX93BNFBY7. They distinguish one browser from another so a repeat visit is not counted as a new one. No cookies are used for advertising, profiling or cross-site tracking, and we do not sell or share what they record.

We also store one value in your browser's local storage, sorot-theme, which remembers whether you chose the light or dark version of the site. It never leaves your device and is never sent to us or to anyone else.

When you submit the contact form, Cloudflare Turnstile runs a bot check that may set its own cookie from challenges.cloudflare.com for that purpose. Clearing your browser data removes all of the above.

Your Photography

Photos taken during our sessions remain our intellectual property unless otherwise agreed in writing. We may use selected images in our portfolio with your consent. You will always be asked before any images are published publicly.

Data Security

Every connection to this site is encrypted with HTTPS and forced to stay that way. The contact form is protected by Cloudflare Turnstile against automated abuse. Because enquiries are emailed rather than stored in a database, there is no customer database on this website to breach. Sorot Studio is a one-person studio: only Zahid Aramai has access to the inbox, the hosting account and the analytics account.

Your Rights

Under Malaysia's Personal Data Protection Act 2010, and equivalent rights if you contact us from elsewhere, you may ask us to:

• Tell you what personal data of yours we hold
• Correct anything that is wrong or out of date
• Delete your enquiry and any data we hold about you
• Stop using your data for a particular purpose, including withdrawing consent to use your photographs

Email hello@sorot.studio and we will respond within 21 days. There is no charge. To opt out of Google Analytics across every site that uses it, install Google's opt-out browser add-on.

Children's Privacy

This website is not directed at children and we do not knowingly collect personal data from anyone under 18 through it. Where a shoot involves children — family, maternity, graduation or school work — we take direction and consent from a parent or guardian, and no image of a child is published without their explicit written permission.

Contact

For privacy-related questions, contact us at:

• Email: hello@sorot.studio
• Phone: +60 19-527 9249

Sorot Studio is operated by KLCube Network Enterprise (SSM: 002580717-P), Kuala Lumpur, Malaysia.

Updates

This privacy policy may be updated from time to time. If we change how we handle your data in a material way, we will update the date below. Last updated: 6 September 2026.