What We Ask For,
and Why.
The admission form asks for your CNIC, your date of birth and your home address. That is a lot to hand a stranger on the internet, so this page says plainly what happens to it — who can see it, where it is kept, and how to get it deleted.
Last updated 29 August 2026
Who we are
MashxLabz Academy & Studios, based in Khyber Pakhtunkhwa, Pakistan. For anything on this page, write to mashxlabz@gmail.com or message 0320 052 9249 on WhatsApp.
What we collect, and only when you give it
We do not collect anything until you fill in a form. Browsing the site anonymously stores nothing about you beyond the analytics described further down.
| When you… | We store | Why |
|---|---|---|
| Ask a question, request a syllabus, or enquire about a Studios project | Name, email, the track you picked, your message | To reply to you |
| Submit an admission application | The above, plus father’s name, CNIC, date of birth, mobile number, home address, highest qualification, total and obtained marks, and diploma if you list one | These are the details an academy needs on file to admit a student and issue a certificate in the right name |
| Reserve a seat with the Rs 2,000 advance | Name, email, track, the EasyPaisa transaction ID and the mobile number you paid from | To match your payment to your application. We never see or store your EasyPaisa PIN, password or account balance — only the receipt number you type in |
| Leave a review | Your Google display name and profile picture, your rating and your words, publicly. Your email address separately, privately | Reviews are public by design. The email is kept apart so it is never published — see below |
Who can see it
One person: the MashxLabz administrator, signing in with a verified account. Apart from the two exceptions below, everything is locked to that single account by the database’s own security rules, not merely by hiding a page — an unauthorised request is refused by the server before it returns anything.
Your review’s text, name, rating and picture are public, because that is the point of a review. Your email address is not: it is stored in a separate, administrator-only record precisely so that it can never appear in the public list.
The second exception is a technical one, stated plainly. When you submit an admission application, we also write a small marker record, keyed by your email address, that holds only the date you applied — no name, no CNIC, nothing else from your application. It exists so the seat-reservation step can confirm you have applied before showing anyone the payment details; without it, you could send the Rs 2,000 advance and only then discover there was no application to attach it to. Because that check has to run before you sign in, the marker can be looked up without a password: someone who already knows your email address could learn that you have applied, and when — and nothing more. The list of markers cannot be downloaded, so nobody can harvest email addresses from it, and the application itself stays administrator-only.
Who we do not give it to
- We do not sell your data. Not to anyone, at any price.
- We do not share it with other institutes, recruiters, or advertisers.
- We do not send you marketing you did not ask for.
- We would only ever hand it over if the law obliged us to.
Where it is kept
In Google Firebase (Cloud Firestore), on Google’s servers, encrypted in transit and at rest. Google processes it on our behalf as our hosting provider. Some services we use are Google’s and see limited technical data:
- reCAPTCHA / App Check — checks that submissions come from a real browser and not a script. Google receives technical signals about the request. Your form contents are not sent to it. Google’s Privacy Policy and Terms apply.
- Google Analytics — visit counts, which pages are read, which buttons are clicked. No personal data is ever sent to it: not your name, email, CNIC, phone, address, or anything you typed. When a form fails validation we record only which fields failed, never their contents. Advertising features and Google Signals are switched off.
- Google Sign-In — only if you choose to leave a review. We receive your name, profile picture and email. We never receive your password.
- EmailJS — sends your “thanks for applying” confirmation email.
How long we keep it
- Applications and payment records — for as long as you are a student, and for three years afterwards, so we can confirm attendance or reissue a certificate.
- Enquiries that never became applications — up to twelve months, then deleted.
- Reviews — until you remove them, or ask us to.
Deleting your data
Email or WhatsApp us and ask. We will delete your record and confirm when it is done — no form to fill in and no reason required. If you have paid the advance and want it back, that is covered by the refund promise on the payment screen: ask any time before your cohort’s first session and we return it.
You can also ask us for a copy of everything we hold about you, or to correct anything that is wrong. Applications cannot be edited from the website once submitted — that is deliberate, so nobody can alter a submitted record — so write to us and we will fix it.
Cookies and similar storage
We set no advertising or tracking cookies of our own. What the site does store in your browser:
- A count of how many forms you have submitted in the last hour, kept on your device, to slow down automated spam.
- If you sign in to leave a review, Google’s sign-in session, so you are not asked twice.
- reCAPTCHA and Google Analytics set their own cookies as described above.
Children
Some of our courses are aimed at school and college students. If you are under 18, please go through the admission form with a parent or guardian — the application asks for identity documents and a financial commitment, and it should be their decision as much as yours.
Changes
If this page changes in a way that affects what we do with information already collected, we will say so here and update the date at the top.
Plain-English summary. We ask for the details an academy genuinely needs to admit you. One person can read them. We do not sell them, share them, or send them to advertisers. Ask us and we delete them.