Privacy Policy | Almost Impossible

1. Who We Are

Almost Impossible DMCC (“we”, “us”, “our”) is a creative agency headquartered in Dubai, UAE. We operate the website almostimpossible.agency. We act as the data controller for personal information collected through this website.

2. Information We Collect

We may collect the following information:

Name and email address when you submit our contact form
Company name, budget range, and project timeline (optional)
Email address when you subscribe to our newsletter
Usage data through analytics (anonymised, with your consent)

3. How We Use Your Information

We use collected information to:

Respond to project inquiries and business communications
Send newsletter updates (only with your consent)
Improve our website and services through anonymous analytics
Comply with legal obligations

4. Data Storage & Security

Your data is stored securely using industry-standard encryption. We use the following infrastructure providers:

Supabase (database hosting) — encryption at rest and in transit
Vercel (website hosting) — edge network with TLS
Cloudflare (CDN and security) — DDoS protection, bot management

We do not sell, trade, or transfer your personal information to third parties for commercial purposes.

5. Cookies & Tracking Technologies

Our website uses cookies and similar technologies. You can manage your preferences at any time using the Cookie Settings link in our footer.

Essential (always active):

cookie_consent — Remembers your cookie preference (localStorage, persistent)
__cf_bm — Cloudflare bot detection (30 minutes)

Analytics (requires your consent):

_ga — Distinguishes unique visitors (2 years)
_ga_* — Maintains session state (2 years)

We use Google Analytics 4 with Consent Mode v2. For visitors in the EU/EEA/UK, analytics cookies are blocked by default until you provide consent. We do not use advertising, marketing, or third-party tracking cookies.

6. Third-Party Services

We use the following third-party services that may process personal data:

Google Analytics (Google LLC, US) — website usage measurement
Cloudflare (Cloudflare Inc., US) — CDN, security, bot protection
Vercel (Vercel Inc., US) — website hosting and delivery
Sentry (Functional Software Inc., US) — error monitoring
Supabase (Supabase Inc., US) — database and authentication

Each provider maintains their own privacy policy and data processing agreements.

7. International Data Transfers

Almost Impossible DMCC is based in the UAE. Your data may be processed in the United States, European Union, and Singapore by our infrastructure providers. For transfers from the EU/EEA, our providers maintain compliance through Standard Contractual Clauses (SCCs) and equivalent safeguards. For UAE residents, data is processed in accordance with Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL).

8. Data Retention

We retain personal data only as long as necessary for its purpose:

Contact form submissions: 2 years
Newsletter subscriptions: until you unsubscribe
Analytics data: 14 months (Google Analytics default)
Error logs: 90 days (Sentry)

9. Your Rights

Under GDPR and UAE PDPL, you have the right to:

Access the personal data we hold about you
Request correction of inaccurate data
Request deletion of your data
Withdraw consent for analytics cookies or marketing communications
Data portability
Object to processing based on legitimate interests
Lodge a complaint with a supervisory authority

To exercise these rights, contact us at possible@almostimpossible.agency.

10. Contact

For privacy-related inquiries, contact us at possible@almostimpossible.agency.

Almost Impossible DMCC
Dubai, UAE