Privacy Policy
Last updated: 13 October 2026
This policy explains what personal data SupStudio ("SupStudio", "we") collects when you visit this website or contact us, why we collect it, and the rights you have over it. It is written with the EU/UK General Data Protection Regulation (GDPR) in mind and applies to visitors from any country.
Who is responsible for your data
The data controller is SupStudio, PLACEHOLDER — registered business address. For any privacy question or request, email [email protected].
What we collect
- When you browse the site — nothing that identifies you. The site has no analytics, no advertising pixels and no tracking cookies. Fonts and all other assets are served from our own domain.
- Server logs — our hosting provider, Cloudflare, processes technical data such as your IP address, browser type and the pages requested, to deliver the site and protect it from abuse. We do not use these logs to profile visitors.
- When you email us — your name, email address and whatever you choose to include in your message.
- When you book a call — booking happens on Calendly, which collects your name, email, chosen time and any answers you give. Calendly acts as our processor; its own privacy notice also applies.
- When you become a client — contact and billing details, and the access or data you share with us to deliver the agreed services.
Why we use it and on what legal basis
- To reply to your enquiry and run the call you booked — steps taken at your request before a contract.
- To deliver services and invoice for them — performance of a contract.
- To keep the site secure and working — our legitimate interest.
- To meet accounting and tax obligations — legal obligation.
We do not sell your data, use it for automated decision-making, or add you to marketing lists without asking.
Who we share it with
Only with service providers that help us run the business — hosting (Cloudflare), scheduling (Calendly), email and accounting tools — under contracts that limit their use of your data to our instructions. Some of these providers are based outside the EU/UK; where that applies, transfers are covered by Standard Contractual Clauses or an equivalent safeguard. We may also disclose data where the law requires it.
How long we keep it
- Enquiries that don't lead to a project — up to 12 months, then deleted.
- Client records — for the duration of the contract and as long as tax and accounting law requires afterwards.
- Server logs — for the short period set by our hosting provider.
Your rights
You can ask us to access, correct, delete or export your data, to restrict or object to how we use it, and to withdraw any consent you gave. Email [email protected] and we will reply within 30 days. You also have the right to complain to your local data protection authority.
Security
The site is served over HTTPS only. Client credentials and data are stored in access-controlled tools and shared only with the team members working on your project.
Changes
If we change this policy, we will update the date at the top of this page. Material changes affecting clients will also be communicated by email.