Last updated: 17 June 2026

1. Who We Are

Spitfire 4D is a creative technology studio based in Dar es Salaam, Tanzania. We build websites, mobile applications, 3D visualizations, motion graphics, and digital business systems for clients across Tanzania and beyond. This Privacy Policy explains how we collect, use, store, and protect your personal information when you interact with our website, use our AI Project Builder, request a quotation, or otherwise engage with our services.

Your privacy is important to us. We are committed to being transparent about what data we handle, why we need it, and how we keep it safe. If you have any questions after reading this policy, you can reach us at hello@spitfire4d.com or call +255 696 916 160.

2. Information We Collect

We collect only the information that is necessary to provide you with accurate project quotations, communicate effectively about your project, and improve our services. Here is exactly what we collect and why:

2.1 Information You Provide Directly

AI Project Builder conversations: When you use our AI-powered quote builder, every message you send is stored so the AI can maintain a coherent conversation with you. This includes any details you share about your business, project requirements, budget preferences, and contact information. These conversations are tied to a random session identifier — not to any personal account — and are retained so we can review the quality of quotes generated by our system.

Quotation details: When our AI generates a formal quotation for you, we store the client name, company name, phone number, email address, and location you provided. This information populates your PDF quotation and allows us to reference your quote later if you decide to proceed.

Contact form submissions: If you reach out via our contact page, we collect your name, email address, phone number, and the content of your message so we can respond to your inquiry.

2.2 Information Collected Automatically

Site visit logs: When you browse our website, we log the pages you visit, your IP address, your browser type (user agent), and the referring URL if you arrived from another site. This is standard web analytics — it helps us understand which pages are most useful and how visitors discover us.

API call logs: Each interaction with our AI Project Builder is logged with the HTTP status code, response time, and token usage. These logs contain no personal message content — they are purely operational, helping us monitor the health and cost of our AI integration.

Cookies and sessions: We use a PHP session cookie to maintain your chat session state so the AI remembers your conversation as you browse. This cookie contains only a session identifier — no personal data. We do not use tracking cookies, advertising cookies, or third-party analytics scripts. We have no interest in building a profile on you or selling your attention to advertisers.

3. How We Use Your Information

We use the information we collect for the following purposes, and for nothing else:

  • To generate accurate project quotations — the AI Project Builder uses the details you provide about your business and requirements to assemble a precise quote from our pricing guide.
  • To communicate with you — if you share your contact details, we may follow up about your quotation, answer questions, or discuss your project further.
  • To improve our AI system — we review anonymized conversation patterns to refine our system prompt and ensure the AI is giving accurate, helpful responses that reflect our actual pricing.
  • To monitor service health — site visit logs and API call logs help us detect issues, measure traffic, and ensure the AI service is responsive and reliable.
  • To comply with legal obligations — in the unlikely event we are required by law to disclose information, we will do so only to the extent legally necessary.

We do not sell your personal information to third parties. We do not use your data to train machine learning models beyond improving our own internal quotation system. We do not send marketing emails unless you have explicitly asked to receive them.

4. Where Your Data Lives

All data is stored in a MySQL database running on our own server infrastructure in Tanzania. There is no cloud intermediary between your browser and our database. Your chat messages, quotation records, and site visit logs all reside on hardware we control.

Our AI Project Builder communicates with the DeepSeek API to generate responses. When you send a message, the conversation history (your messages and the AI's replies, up to the last 15 exchanges) is transmitted to DeepSeek's servers for processing. DeepSeek's privacy policy governs how they handle data in transit. We do not send your IP address, session identifier, or any personal metadata to DeepSeek — only the conversation content necessary to generate a reply.

5. How We Protect Your Data

We take practical, meaningful steps to secure your information:

  • Encryption in transit: All traffic between your browser and our server is encrypted via TLS (SSL). Our site forces HTTPS.
  • Parameterized database queries: All database operations use prepared statements with parameter binding, which prevents SQL injection attacks.
  • Input sanitization: User inputs are filtered and validated before processing. Off-topic queries to our AI are blocked at the server level.
  • Hashed credentials: Administrator passwords are stored using BCrypt hashing — they are never stored in plaintext.
  • Directory-level access control: Configuration files, database credentials, and the AI system prompt are stored outside the web-accessible document root and are protected by .htaccess deny rules.
  • No database exposure: Our database accepts connections only from localhost. It is not accessible from the public internet.

6. How Long We Keep Your Data

Chat conversations: Retained indefinitely for quality assurance and to maintain quotation reference records. Chat sessions are marked as active, completed, or expired but are not automatically deleted.

Quotations: Retained indefinitely as business records. Each quotation carries a unique reference number (e.g., SP4-240617-A1B2C3) and a 36-hour validity window. After expiry, the quotation is marked expired but remains in our system for reference.

Site visit logs: Retained for 90 days, then purged. These are lightweight records (URL, timestamp, IP address, user agent) used only for traffic analysis.

API call logs: Retained for 90 days for operational monitoring, then purged.

If you would like your data deleted before these retention periods, contact us at hello@spitfire4d.com and we will process your request within 14 business days.

7. Your Rights

You have the right to:

  • Access your data — request a copy of all personal information we hold about you.
  • Correct your data — if any information we hold is inaccurate, tell us and we will fix it.
  • Delete your data — request that we erase your personal information from our systems.
  • Withdraw consent — if you previously agreed to share information with us, you can change your mind at any time.
  • Ask questions — if anything in this policy is unclear, we are happy to explain.

To exercise any of these rights, email hello@spitfire4d.com with the subject line "Data Request" and describe what you need. We will respond within 14 business days.

8. Third-Party Services

We use the following third-party services as part of our operations:

  • DeepSeek API — powers the AI responses in our Project Builder. Conversation content is transmitted to DeepSeek for processing. Their privacy policy is available at api-docs.deepseek.com.
  • jsDelivr CDN — we load the Iconify icon library from jsDelivr's CDN. jsDelivr may log your IP address and browser type as part of standard CDN operation. Their privacy policy is at jsdelivr.com.

We do not embed Google Analytics, Facebook Pixel, or any advertising or tracking networks. We do not use social media share buttons that phone home. The only external requests made by our site are for the Iconify icon library (via jsDelivr CDN) and the DeepSeek API (when you actively use the AI Project Builder).

9. Children's Privacy

Our services are not directed at individuals under the age of 16. We do not knowingly collect personal information from children. If you are a parent or guardian and believe your child has provided us with personal data, please contact us immediately and we will delete it.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. If the changes are material, we will place a notice on our homepage. We encourage you to review this policy periodically — especially before using the AI Project Builder to share detailed business information.

11. Contact Us

If you have questions, concerns, or a data request, here is how to reach us:

Spitfire 4D
Creative Technology Studio
Dar es Salaam, Tanzania

Email: hello@spitfire4d.com
Phone: +255 696 916 160
WhatsApp: +255 672 333 538
Instagram: @spitfire4d


This policy was written specifically for Spitfire 4D and reflects our actual data practices — not a generic template. We believe in being direct and honest about what happens with your information.

Spitfire AI