Last updated: 1 September 2026

MMS Studio respects your privacy. This Privacy Policy explains how personal information is collected, used, stored, and shared when you visit our website, purchase digital products, use our payment verification and coupon services, contact us, or interact with supported applications connected to our platform.

In this policy, “MMS Studio,” “we,” “us,” and “our” refer to the operator of the MMS Studio website and related services. “Personal information” means information that identifies you or can reasonably be associated with you.

1. Scope of this policy

This policy covers personal information processed through:

The MMS Studio website, including our shop, portfolio, blog, and informational pages.
Project inquiries, support requests, and other communications with us.
Digital product purchases, payment verification, coupon issuance, and redemption.
Application user records received by the MMS Studio platform from connected applications.
Administrative accounts used to manage our website and services.

A separate application, client project, or external service may have its own privacy policy. This policy describes information handled by the MMS Studio platform; it does not automatically describe every permission, advertising feature, or data collection practice of every application featured in our shop or portfolio.

This policy explains our practices. Visiting the website or reading this policy does not, by itself, constitute consent to processing that legally requires your consent.

2. Information you provide to us

The information we receive depends on how you interact with our services.

Project inquiries and business communications

When you contact us about a software project or other service, we may receive:

Your name and email address.
Your telephone number, if provided.
Your inquiry subject or project type.
Your selected budget range, if provided.
Project requirements, business information, and other details included in your message.
Subsequent correspondence relating to your inquiry.

We use this information to understand your request, discuss potential work, prepare responses or proposals, and manage the resulting business relationship.

Customer support

When you use the Help Center or contact us directly, we may receive your name, email address, message, transaction ID, and any additional information you choose to provide.

Please share only information relevant to your request. Do not include passwords, payment PINs, one-time verification codes, private keys, or unrelated sensitive information.

Purchases and payment verification

When you purchase a digital product, we process the transaction reference you submit, the selected product or application, and information needed to check payment and deliver the associated entitlement.

You can generally browse our public website without submitting contact details. If you do not provide information necessary to answer a request or verify a payment, we may be unable to complete that particular service.

3. Payment records and transaction messages

Our payment verification process uses payment records associated with transactions received by MMS Studio.

Depending on the payment record, this information can include:

The transaction ID and payment amount.
Sender information, including a telephone number where included in the payment notification.
The original payment notification or SMS text.
The payment message source and relevant timestamps.
Metadata identifying the receiving device or account used by our payment collection system.
Whether the payment has already been used to issue a coupon.

An original payment notification may contain additional transaction details beyond the fields listed above. We use these records to reconcile payments, investigate discrepancies, prevent repeated use of the same payment, and resolve support requests.

The payment notification records described here are received through our payment collection system. The website checkout does not require access to your personal SMS inbox.

Payments are completed through the relevant payment service, such as bKash. The MMS Studio checkout asks for a transaction reference; it does not ask for your bKash PIN or one-time verification code. The payment provider’s handling of your payment account is governed by its own privacy notice.

4. Coupons, subscriptions, and digital entitlements

When a payment is verified or a coupon is created, we process information needed to issue and validate the digital entitlement. This can include:

The coupon code and its creation and expiration dates.
The applicable product or application package.
The number of coins or credits associated with the coupon.
Subscription or advertising-related entitlement settings.
Redemption limits, redemption counts, and processing status.
Related purchase descriptions or administrative notes.

A transaction ID may also serve as the coupon code. Treat transaction references and coupon codes as confidential because possession of a code may enable someone to attempt redemption.

Coupon expiration, successful redemption, and deletion of the associated record are separate events. A record may remain necessary after redemption to reconcile a payment, prevent duplicate use, or investigate a dispute.

5. Information received from connected applications

Where an application is integrated with our platform, MMS Studio may receive application user records containing:

A unique user identifier.
An email address.
Device information supplied by the application.
A Firebase Cloud Messaging registration token.
The most recent recorded login time.

These records support application account administration, troubleshooting, and related operational functions.

A messaging registration token identifies an application installation for message delivery. Its presence in our records does not mean that the website has access to your contacts, private messages, microphone, or photographs.

The originating application’s privacy notice should explain the device information it sends, its notification practices, and any additional permissions it requests. Notification permissions can generally be managed through that application or your device settings.

6. Information processed automatically

When your browser or application connects to our services, our infrastructure and service providers may process technical information such as:

IP address and request timestamps.
Browser, operating system, and device characteristics.
Requested pages or resources.
Referring page information, where transmitted.
Request outcomes, error information, and security-related events.
Session or device identifiers used by an enabled service.

This processing helps deliver pages, maintain sessions, diagnose problems, and operate the service.

When Google Analytics is enabled, additional usage information may be collected to help understand website visits and interactions. The information collected depends on the deployed configuration and the relevant browser and provider settings.

7. How we use personal information

We use personal information for the purposes relevant to your interaction with us:

Providing services: Operating the website, displaying products, and supporting connected application functions.
Fulfilling purchases: Checking payments, issuing coupons, and validating digital entitlements.
Responding to requests: Answering project inquiries, providing customer support, and communicating about transactions.
Managing business relationships: Discussing requirements, preparing proposals, and administering agreed work.
Maintaining reliability: Investigating technical failures and improving usability and performance.
Preventing misuse: Identifying duplicate payment claims, invalid redemptions, and other potentially abusive activity.
Keeping necessary records: Reconciling transactions, handling disputes, and meeting applicable legal obligations.

Information submitted for a support request or project inquiry is not, by itself, a request to subscribe to promotional communications.

8. Legal grounds for processing

Where applicable law requires a legal basis for processing personal information, the relevant basis depends on the purpose:

Contractual necessity: Processing information needed to provide a purchased service or take steps you request before entering into an agreement.
Legitimate interests: Operating and protecting our services, responding to business inquiries, maintaining appropriate records, and investigating misuse, subject to applicable balancing requirements.
Legal obligations: Processing records when required by applicable law or a binding legal requirement.
Consent: Processing based on your permission where consent is required, including relevant optional tracking or communications.

If we rely on consent, you may withdraw it. Withdrawal does not make earlier lawful processing unlawful and does not prevent processing that remains necessary on another valid legal basis.

The availability of these grounds and your associated rights depend on the law applicable to the particular processing.

9. Cookies, local storage, and analytics

Our website and integrated services may use cookies, browser storage, or similar technologies.

Authentication and session storage

Firebase Authentication may use browser storage to maintain a signed-in session. This is relevant to accounts used to access administrative functions.

Display preferences

Browser storage may remember preferences such as your selected theme. The dashboard also uses a cookie to remember its sidebar state, configured to expire after seven days.

Analytics

Our website includes an optional Google Analytics integration through Firebase. When enabled in the deployed configuration and supported by the browser, it can collect information about visits and interactions.

Embedded content

Embedded services may use their own cookies or identifiers when their content loads.

You can use browser controls to review, restrict, or delete cookies and site storage. Restricting storage may sign you out, reset preferences, or affect embedded functionality. Deleting browser storage does not delete payment records, support correspondence, or other information already held on our systems.

Where applicable law requires prior consent for a particular technology, that requirement applies independently of this policy.

10. Service providers and other recipients

Personal information may be processed by providers involved in delivering the relevant service.

Google Firebase and Google Cloud

We use Firebase for database storage and authentication. Google Analytics may also be enabled. These services process information according to the applicable configuration and provider terms. Further information is available in Firebase’s privacy and security documentation.

Web3Forms and email delivery

Our website inquiry and support forms send submissions to Web3Forms for processing and delivery. The fields you submit are therefore received by Web3Forms and may also be retained in the email systems used to receive and answer your message. See the Web3Forms Privacy Policy.

Payment services

The payment provider processes your payment through its own systems. We use the transaction information available to us to verify receipt and fulfill your purchase. See the bKash Privacy Notice for information about bKash’s practices.

Hosting and infrastructure providers

Providers supporting hosting, network delivery, databases, and operational services may process technical information and service data as necessary to perform those functions.

Professional advisers and legal recipients

Relevant information may be disclosed to professional advisers, regulators, courts, or other recipients where necessary to obtain advice, comply with applicable law, respond to valid legal process, or establish, exercise, or defend legal claims.

If a proposed business transfer would involve personal information, the applicable privacy obligations and any required notices or safeguards would need to be addressed as part of that transfer.

11. Embedded media and external links

Our pages may include YouTube videos, a location map, externally hosted images, and links to application stores, social platforms, or other websites.

When embedded content loads, your browser may connect directly to the provider. That provider may receive technical information and use cookies or other identifiers according to its own practices. Some connections can occur when the content loads, before you actively interact with it.

Google explains its handling of information across services, including YouTube and embedded Google services, in the Google Privacy Policy.

Following an external link takes you to a service with its own privacy practices. Review the relevant notice before providing personal information.

An application’s advertising practices are not established solely by its appearance in our shop or by a coupon’s advertising-related entitlement setting. Consult that application’s own disclosures.

12. International processing

Our service providers operate infrastructure in multiple countries. Personal information may therefore be processed outside the country where you live.

Processing locations depend on the service and its configuration. For example, Firebase states that its Authentication service processes data in the United States, while other Firebase services may use global infrastructure or selected regions. See Firebase’s information about processing locations.

International transfers remain subject to applicable legal requirements. You may contact us to request information about the providers, processing locations, and transfer arrangements relevant to your information.

13. How long information is retained

Retention depends on the type of information, the purpose for which it was collected, applicable legal requirements, and whether an unresolved issue requires continued preservation.

The relevant considerations include:

Project inquiries: Whether discussions remain active, whether an agreement results, and whether the correspondence is needed to address a subsequent question or dispute.
Support correspondence: Whether the issue is resolved and whether the information remains necessary for related follow-up or transaction support.
Payment and coupon records: Reconciliation, entitlement administration, duplicate-use prevention, accounting requirements, and dispute resolution.
Application user records: Whether the connected account remains active and whether records remain necessary for the relevant service.
Technical information: Operational troubleshooting, security needs, and provider retention settings.

Providers may apply separate retention periods. Web3Forms currently states that form submission data is retained for a maximum of three years unless a shorter plan period applies or it is deleted earlier. This does not determine how long a separately delivered email remains in our correspondence records. See its data retention notice.

Uninstalling an application, clearing browser storage, or redeeming a coupon does not automatically remove related server records.

Where deletion is appropriate, it may require separate action across active records, correspondence systems, and provider services. Backup copies may remain until the applicable backup retention cycle ends.

14. Security and account protection

We use Firebase’s storage and authentication services as part of our technical infrastructure. Provider security features are one part of protecting information; appropriate application configuration and operational practices are also necessary.

No website, communications channel, or storage system can guarantee absolute security. Please protect your account credentials, transaction references, and coupon codes, and avoid including unnecessary sensitive information in messages.

If you suspect unauthorized account activity, misuse of a transaction reference, or another privacy or security issue, contact us through the contact methods published on our website.

Where a personal information incident creates a notification obligation under applicable law, the relevant notification requirements apply.

15. Your privacy rights and choices

Depending on your location and the applicable law, you may have rights to:

Request access to personal information held about you.
Ask for inaccurate information to be corrected.
Request deletion of personal information.
Request restriction of certain processing.
Receive eligible information in a portable format.
Withdraw consent where processing relies on consent.
Challenge certain automated decisions where the relevant legal protections apply.
Complain to the competent data protection authority.

These rights are subject to applicable conditions and exceptions. For example, a deletion request may not require removal of records that must be retained by law or remain necessary for a legal claim. The ICO’s privacy transparency guidance explains these disclosures in the UK context.

Your right to object

Where applicable law provides this right, you may object to processing based on legitimate interests because of your particular circumstances. You may also object to the use of your information for direct marketing.

To make a request, use the contact details published on our website and identify the relevant service or account. We may need proportionate information to verify your identity before disclosing or changing records.

Do not send your password, payment PIN, or one-time verification code as proof of identity. We will address requests within the period required by applicable law and explain any applicable limitation or refusal.

16. Automated payment and coupon checks

Our services use automated rules to evaluate payment and coupon requests.

Depending on the transaction or integration, these checks may assess whether:

A matching payment record exists.
The recorded payment amount meets the relevant requirement.
The payment has already been used.
A coupon exists, remains valid, and is within its redemption limit.
An application package restriction is satisfied.

The outcome may determine whether a coupon is issued or a redemption request succeeds. These checks can be affected by delayed payment records, incorrect references, or inconsistent information.

If you believe an outcome is incorrect, contact the Help Center with the relevant transaction reference and an explanation. Do not make another payment solely because an earlier verification attempt failed without first checking the transaction status.

17. Children’s information

Different digital products may have different age requirements. Review the terms and privacy notice of the specific application before allowing a child to use it.

Please do not submit personal information about a child unless you are authorized to do so and any permission required by applicable law has been obtained.

If you believe a child’s information has been provided to MMS Studio inappropriately, contact us so the circumstances can be reviewed and any necessary action taken.

18. Client projects and public portfolio content

Our website may display project descriptions, client names, author names, images, and links as part of published portfolio or editorial content. Published material is publicly accessible and may be indexed by search engines or copied by others.

Private project inquiries are separate from published portfolio content. Submitting an inquiry does not itself authorize publication of your message.

Where MMS Studio processes personal information on behalf of a client while developing or supporting software, the respective responsibilities depend on the applicable agreement and law. Individuals using a client-operated service should consult that service’s privacy notice and contact its operator about information controlled by that operator.

19. Changes to this policy

We may update this policy to reflect changes in our services, providers, information practices, or legal obligations.

The revised version will be published on this page with an updated date. Where applicable law requires additional notice or consent for a change, we will address that requirement separately.

20. Contact us

For privacy questions, access or deletion requests, corrections, or concerns about how your information is handled, contact MMS Studio through the email address or contact methods listed in our Contact section.

Please identify your message as a Privacy Request and include the relevant service, account email or user identifier where applicable, and a clear description of your request.

For payment-related privacy questions, include the relevant transaction reference only where necessary. Never include payment PINs, passwords, or one-time verification codes.