Legal
Privacy Policy
Last updated: November 13, 2026
Corevato Solutions (Pvt.) Ltd ("Corevato", "we", "us" or "our") respects your privacy. This Privacy Policy explains what personal information we collect when you visit corevato.com, contact us, subscribe to our newsletter, book a call, apply for a job or work with us as a client. It explains why we use it, who we share it with, how long we keep it and the rights you have over it.
We have written it in plain English. If anything is unclear, email us at support@corevato.com and we will explain.
This policy replaces the version dated August 10, 2024.
1. Who we are
Corevato Solutions (Pvt.) Ltd is a private limited company registered in Pakistan, with its office at Office 201, Floor 2, Al Hafeez Executive, Block C3, Gulberg III, Lahore 54000, Pakistan. We also have a US address at 30 N Gould St, Sheridan, WY 82801, United States.
For the personal information described in this policy, Corevato is the data controller. That means we decide why and how it is used, and we are responsible for it.
We have not appointed a data protection officer. Our team handles privacy questions and requests at support@corevato.com.
When we work on a client's data
When we handle personal information on behalf of a client as part of a project (for example, data inside a client's app, website, CRM or automations), we act as a processor for that client. We only use that data on the client's instructions. That processing is governed by our contract with the client and the client's own privacy notice, not this policy. If your data is in one of our clients' systems, please contact that client first. We will help them answer you.
2. Information we collect
Information you give us
- Inquiries: Your name, email address, company, the services you are interested in, your budget range and your message when you use our contact form. If you email us, call us or book a call, we also collect what you choose to share, such as your phone number.
- Newsletter: Your email address, when you subscribe on our website.
- Job applications: Your name, email address, phone number, city, work experience, current position and company, notice period, portfolio and LinkedIn links, cover letter, and the CV or other files you upload.
- Client work: Names and contact details of the people we work with, billing details, project information, files and the messages we exchange while delivering our services.
Please do not send us sensitive information we have not asked for, such as health details, religion, ethnicity, political views, national identity card numbers or photos of yourself. You do not need to include these in a CV to apply for a role with us. If we receive them, we will only keep what is relevant to your request.
Information collected automatically
- Website analytics: We use Plausible Analytics. It does not use cookies and does not store IP addresses. It gives us totals, such as page views, referring websites, country, browser and device type, that do not identify you.
- Error monitoring: If something on our website breaks, Sentry records technical details about the error, such as the page, browser, operating system and device. We have set Sentry up so that it does not collect your IP address.
- Security and spam protection: Our hosting and network providers process your IP address and basic request details to deliver the website and protect it from attacks. Our forms use Cloudflare Turnstile, which checks signals such as your IP address and browser details to tell people apart from bots.
Information from other sources
If someone refers you to us, they may share your contact details. When you apply for a role or contact us on behalf of a business, we may look at information you have made public on professional profiles such as LinkedIn or on your portfolio.
Do you have to give us your information?
No law requires you to give us personal information. Fields marked as required on our forms are the minimum we need to reply to you, consider your application or send the newsletter. If you leave them out, we cannot do those things. If you become a client, we need contact and billing details to deliver the services and invoice you under our contract.
3. How we use your information and our legal reasons
We only use personal information when we have a valid reason. Laws such as the EU and UK General Data Protection Regulation (GDPR) call these lawful bases. For each use, our reason is:
- Replying to inquiries and preparing proposals: To take the steps you ask for before entering into a contract, and our legitimate interest in replying to people and businesses who contact us.
- Delivering our services: To perform our contract with you or your organisation, including project management, support, invoicing and payments. Where our contract is with your employer, our reason is our legitimate interest in working with our client's team.
- Newsletter: Your consent. You can withdraw it at any time with the unsubscribe link in every email.
- Updates to existing clients and business contacts: Our legitimate interest in telling clients and business contacts about similar services of ours. You can opt out at any time.
- Recruitment: To assess your application and, if we make you an offer, to prepare your employment. This is based on the steps you ask us to take before a contract and our legitimate interest in hiring the right people.
- Keeping our website and forms safe: Our legitimate interest in protecting our website, forms and systems from spam, fraud and attacks.
- Fixing errors: Our legitimate interest in keeping our website working properly.
- Showing our work: Our legitimate interest in showing examples of client projects. We only publish a person's name, photo or quote, such as a testimonial, with that person's permission.
- Legal obligations and claims: To meet tax, accounting and other legal requirements, to respond to lawful requests from authorities, and our legitimate interest in establishing or defending legal claims.
Where we rely on legitimate interests, we have checked that our interests are not outweighed by your rights. You can ask us for details of that check.
We do not make decisions about you, including hiring decisions, using only automated means. A person on our team always reviews inquiries and job applications.
We only use your information for the purpose we collected it for, or for a closely related purpose you would reasonably expect. If we want to use it for something new, we will tell you first.
4. Who we share your information with
We do not sell your personal information, and we do not share it for cross-context behavioural advertising. Our team in Pakistan accesses it only as far as their work needs. We also share it with the providers that help us run our business, only as far as they need it. They are bound by contract to keep it confidential and secure and to use it only for the service they provide to us.
- FunnelPool (built on HighLevel): Our CRM. It stores inquiries, newsletter subscriptions, job applications and call bookings, and sends our emails.
- Cloudflare: Domain, content delivery, security and spam protection (Turnstile) for our website and forms.
- Vercel: Website hosting.
- Plausible Analytics: Cookieless website analytics that does not identify you.
- Sentry: Error monitoring for our website.
- Google: The office maps on our Contact page are embedded from Google Maps. When a map loads, Google receives your IP address and may set or read its own cookies under Google's own privacy policy.
- Stripe: Payment processing for client invoices. Stripe handles card details directly, and we do not store full card numbers.
- Email and project tools: The email, file storage, communication and project management tools we use to talk to you and deliver your project.
We may also share personal information with our professional advisers (such as lawyers and accountants), with a buyer or successor if our business is merged, acquired or reorganised, when the law requires it or to protect our rights and safety, and with anyone else when you have asked us to or agreed to it.
5. Cookies and similar technologies
Our website does not use advertising or cross-site tracking cookies, and our analytics do not use cookies. The following may still store or read information on your device:
- Security checks: Cloudflare and Cloudflare Turnstile may use strictly necessary cookies or similar checks to protect our website and forms from bots. These are needed for the forms to work, so they do not need your consent.
- Google Maps: Google may set or read its own cookies when a map on our Contact page loads. Google decides how it uses them. You can read more in Google's privacy policy and manage Google cookies in your browser or Google account.
- Booking calendar: If you book a call through our booking calendar, the calendar provider may use its own cookies to run the booking.
You can block or delete cookies in your browser settings. If you block strictly necessary cookies, some forms or features may not work.
6. International transfers
We are based in Pakistan, and many of our providers process data in the United States and other countries. This means your personal information may be stored and used outside the country where you live, including in countries whose data protection laws differ from yours. Pakistan does not currently have an adequacy decision from the European Commission or the UK government.
When you send information to us through our website or by email, it comes to us directly. When we or our providers move personal information from the European Economic Area, the United Kingdom or Switzerland to another country, we rely on a recognised safeguard where one is needed. These include the EU-US Data Privacy Framework and its UK Extension where the provider is certified, the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, as included in our providers' data processing terms.
You can ask us for more information about these safeguards, or for a copy of them, by emailing support@corevato.com.
7. How long we keep your information
We keep personal information only for as long as we need it for the purposes in this policy, or for as long as the law requires. In general:
- Inquiries: Up to 3 years after our last contact with you, unless you become a client.
- Client records: For the length of our engagement, then for as long as tax, accounting and legal requirements apply, and as long as needed to deal with any claim.
- Newsletter: Until you unsubscribe. After that, we keep your email address on a do-not-contact list only so we never email you again by mistake.
- Job applications: Up to 12 months after the role is filled, so we can consider you for future roles, unless you ask us to delete your application sooner. If you join our team, your application becomes part of your staff record.
- Error logs: For a limited period, typically no more than 90 days.
- Security logs: For the short periods our hosting and security providers set.
- Privacy requests and complaints: As long as needed to show we handled them properly.
When we no longer need personal information, we delete it or anonymise it so it can no longer identify you.
8. How we protect your information
We use technical and organisational measures to protect personal information. Our website is served only over encrypted connections (HTTPS), access to personal information is limited to team members who need it for their work, and we use established providers that maintain recognised security standards.
No method of sending or storing information is completely secure, so we cannot guarantee absolute security. If a data breach is likely to put your rights at risk, we will act quickly to contain it and notify you and the relevant authorities where the law requires.
9. Your rights
Depending on where you live, the law may give you some or all of the rights below. We offer them to everyone, wherever you live, unless the law allows us to refuse a request (for example, where we must keep information to meet a legal obligation).
- Access: Ask whether we hold personal information about you and for a copy of it.
- Correction: Ask us to correct information that is inaccurate or incomplete.
- Deletion: Ask us to delete your information, unless we need to keep it to meet a legal obligation or to establish or defend a legal claim.
- Restriction: Ask us to pause using your information while a concern is being looked at.
- Portability: Ask for the information you gave us in a structured, machine-readable format, or ask us to send it to someone else.
- Withdraw consent: Where we rely on your consent, such as for the newsletter, withdraw it at any time. This does not affect what we did before you withdrew it.
- Automated decisions: Not be subject to a decision based only on automated processing that has legal or similarly significant effects on you. We do not make decisions like this.
- Non-discrimination: Not be treated differently for using any of these rights.
Your right to object
You can object at any time to us using your information for direct marketing, and we will stop. You can also object to any use that relies on our legitimate interests. We will then stop unless we have strong legitimate grounds that override your interests, or we need the information for a legal claim.
How to use your rights
Email us at support@corevato.com. We may need to confirm your identity before we act on a request, and we will only ask for what we need to do that. You can also ask someone you trust, an authorised agent, to make a request for you. We may ask for proof that they act for you.
Using your rights is free. We will reply within one month. If a request is complex or we receive many, we may need up to two more months, and we will tell you why within the first month. If a request is clearly unfounded or excessive, we may charge a reasonable fee or refuse it, and we will explain why.
10. Complaints
If you are unhappy with how we have handled your personal information, please tell us first at support@corevato.com so we can try to put it right. We will confirm we have received your complaint within 30 days, look into it, and tell you the outcome without undue delay.
You also have the right to complain to a data protection authority at any time, for example:
- United Kingdom: The Information Commissioner's Office (ICO), at ico.org.uk.
- European Union: The data protection authority in the country where you live or work, or where you think the problem happened. The European Data Protection Board lists them at edpb.europa.eu.
- Australia: The Office of the Australian Information Commissioner (OAIC), at oaic.gov.au. The OAIC usually asks you to complain to us first and give us 30 days to respond.
- United States: Your state's attorney general or privacy regulator, such as the California Privacy Protection Agency.
11. Information for people in specific regions
United Kingdom and European Economic Area
If you are in the UK or the EEA, the UK GDPR or the EU GDPR applies to how we handle your information when we offer our services to you. The lawful bases, rights and complaint options above are the ones these laws give you.
Australia
The Australian Privacy Act 1988 does not apply to every business, and small businesses are often exempt. Whether or not it applies to us, we handle personal information of people in Australia in line with the Australian Privacy Principles as far as they are relevant to us, and we offer the access, correction and complaint rights above.
You can browse our website without telling us who you are. To reply to an inquiry or consider a job application, we need your name and contact details. As explained under International transfers, we hold your information in Pakistan and our providers hold it in the United States and other countries.
United States
Several US states, including California, have consumer privacy laws. Most of them apply only to businesses above certain revenue or data volume thresholds, and some do not cover business contact information. Whether or not a state law applies to us, we offer US residents the rights above, including the right to know what we collect and how we use it, and to access, correct and delete it.
In the last 12 months we have collected the categories of personal information described in Information we collect: identifiers and contact details, professional and employment information, commercial information about our services, and internet activity limited to the security and error details above. We collect them from you, from your device and from the sources described above, for the purposes in this policy. We disclose them only to the providers and others listed under Who we share your information with.
We do not sell personal information or share it for cross-context behavioural advertising, and we have not done so in the last 12 months. We do not knowingly sell or share the personal information of anyone under 16. We do not use sensitive personal information to infer characteristics about you. Because we do not sell or share personal information, there is nothing to opt out of, but we respect Global Privacy Control signals as a request not to sell or share.
Pakistan
Pakistan does not yet have a general personal data protection law in force. A Personal Data Protection Bill has been proposed but has not been enacted. The Prevention of Electronic Crimes Act, 2016 applies to us. Among other things, it prohibits using someone's identity information without authorisation and requires that people can opt out of marketing messages. We respect both. We also offer people in Pakistan the rights described in this policy, and we will update this policy if a new law comes into force.
12. Marketing emails
We send our newsletter only to people who have subscribed. We may also send updates about our similar services to existing clients and business contacts we have dealt with, where the law allows it. We do not buy email lists.
Every marketing email clearly identifies Corevato, includes our postal address and has an unsubscribe link. You can also email us to stop them. We act on unsubscribe requests promptly, and always within 10 business days. We will still send you messages about services you have with us, such as invoices and project updates.
We do not send marketing text messages unless you have separately agreed to receive them.
13. Children's privacy
Our website and services are meant for businesses and adults. They are not directed at children under 16, and we do not knowingly collect personal information from them. If you believe a child has given us personal information, contact us and we will delete it.
14. Links to other websites
Our website links to other websites and social media profiles. We are not responsible for how those sites handle your information, so please read their privacy policies.
15. Changes to this policy
We may update this Privacy Policy from time to time to reflect changes in our practices, providers or the law. When we do, we will post the new version on this page and update the "Last updated" date. If a change materially affects how we use information we already hold about you, we will also tell you by email or with a notice on our website before the change applies.
16. Contact us
If you have any questions about this Privacy Policy, want to use your rights or want to make a complaint, contact us:
- Email: support@corevato.com
- Phone (Pakistan): +92 42 37881557
- Phone (United States): +1 (307) 278-4549
- Lahore office: Office 201, Floor 2, Al Hafeez Executive, Block C3, Gulberg III, Lahore 54000, Pakistan
- US address: 30 N Gould St, Sheridan, WY 82801, United States