Privacy policy.

Last Door Solutions Pvt. Ltd. is a design and engineering company registered in Kathmandu, Nepal with the Office of the Company Registrar, company number 79606. It was registered on 13 January 2011 (2067-09-30 in Nepal's Bikram Sambat calendar), and its status on the register is approved. You can check that yourself on the registrar's public data portal at company.ocr.gov.np.

Last Door Solutions Pvt. Ltd. is the only LastDoor company. We no longer have a company registered in the UK. The Australian business of the same name is independent and no longer part of LastDoor. Our team works from several countries; the company is in Nepal.

This policy covers lastdoorsolutions.com and its subdomains. It does not cover client products we build, which have their own policies.

The information you submit includes:

• Contact form: name, work email, company and message. We also collect your enquiry type and the service, budget, timeline, company type or expected volume of work you provide.
• Case study access request: name, company, company email, company website, phone number, what you are evaluating us for, and your agreement to keep the case studies confidential. We check whether your company website is reachable.
• Newsletter sign-up: the email address you submit.
• Email you send us: whatever you include.

We do not run analytics, advertising pixels, session recording or social media trackers on this site, and we have decided not to add any. We do not buy or enrich data about you.

• To reply to your enquiry and, if you ask, to prepare a proposal.
• To send the newsletter when you sign up.
• To decide whether to grant access to confidential case studies, and to send you a personal access link.
• To keep a record of who has seen material shared under a non-disclosure agreement (NDA).

The legal basis under the GDPR and UK GDPR, the data protection laws of the EU and the UK, is our legitimate interest in responding to business enquiries and protecting confidential material. For case study access, it is your consent to the confidentiality terms.

• Contact forms and access requests are emailed to our mailbox through Google Workspace.
• Our former travel questionnaire also sent answers and attachments to that mailbox. It now redirects to idealaya. Saved answers may remain in your browser; see our browser storage page.
• Newsletter addresses are sent to our Sendy installation at lastdoor.email. You can ask us to remove your address from the mailing list.
• The website is hosted on Vercel, on servers in the United States and in other countries close to visitors. Vercel keeps standard server logs, including IP address, for a limited time.
• Access links are generated on our server and sent to the email address you gave. Each link is recorded in a database hosted by Turso: your name, company and email address, which case study it opens, who issued it, when it was issued and when it ends, and whether it has been opened or disabled. The record also holds a scrambled form (a hash) of the link and of the browser that opened it, never the link itself. We use it to open the case studies for you and to disable a link that has been forwarded.
• To limit how often the access forms can be used, the same database counts attempts by IP address, email address and link over the last hour or day. It stores a keyed hash of each (a scrambled form that cannot be turned back into the address), never the address itself.

We do not sell personal data. The service providers described above process information for these website functions; we may also disclose information when the law requires it.

We keep enquiry emails in our mailbox indefinitely, with no deletion schedule. A business conversation can resume years later, and some of these emails carry invoices, quotes and agreements that we are required to keep as accounting records.

You can have yours deleted at any time by asking. Email hello@lastdoorsolutions.com and we will remove the correspondence, except anything we are legally obliged to retain as a financial record, which we will tell you about if it applies to you.

The email of a case study access request is kept in our mailbox for as long as the material it unlocks is confidential.

The access database keeps this:

• An access link record is kept indefinitely, as the record of who was sent material shared under NDA. It holds your name, company and email, which case study the link opened, who issued it, when it was issued, opened and ended, and whether it was disabled because it was opened in a second browser. It never holds the link itself or your browser's id, only hashes of them.
• You can ask us to delete your access record. We will, unless we still need it as evidence under the confidentiality undertaking you accepted, in which case we will tell you.
• The record that an approval was used is deleted 30 days after the approval link expires, which is 37 days after the request.
• A rate-limit count is deleted one day after its hour or day is over.

Deletion runs automatically when the access forms are next used, so a record can stay past these dates while nobody uses them.

You can ask what we hold about you, ask for a copy, ask us to correct it or delete it, and object to our using it. Email hello@lastdoorsolutions.com. We will respond to your request and explain any information needed to handle it. If you are in the EU or UK you can also complain to your data protection authority.

This section is about personal data about you. Client business data and subscription data are covered on the terms page.

This site is for businesses. We do not knowingly collect data from anyone under 16.

We are a Nepali company and we operate under Nepali law. This policy, and any dispute about the personal data it describes, is governed by the laws of Nepal, and the courts of Kathmandu have jurisdiction. Anything about using this site or the work we build sits on the terms page, which says the same.

That does not take away rights you hold where you live. If you are in the EU or the UK, the protections of your own data protection law still apply to you, and you can still complain to your own data protection authority, as the section above says.

We update this page when the website’s data practices change, and note the date at the top.