Privacy policy.

1. Who we are

Haxtiv Studio ("Haxtiv", "we", "our", or "us") is a digital studio offering website design, development, and care services. This policy describes how we collect, use, store, and disclose information when you visit https://haxtiv.com, contact us, brief a project, or engage us under contract.

The data controller for personal data we process is Haxtiv Studio. You can reach our privacy contact at [email protected].

2. Information we collect

We collect the following categories of information:

• Information you submit: name, email, company, phone, project brief content, and any details you choose to share through contact, brief, or booking forms.
• Engagement information: contracts, billing details, and communications related to active projects or care plans.
• Usage information: pages viewed, referring source, device and browser type, approximate location (city level), and aggregated interaction data — collected via first-party analytics.
• Cookies and similar: see our cookie policy for the specific cookies used and how to control them.

3. How we use information

We use the information we collect to:

• Respond to inquiries, briefs, and booked calls.
• Deliver contracted services, including invoicing and project communications.
• Improve the website experience and our content.
• Comply with legal, tax, and accounting obligations.
• Send occasional studio updates, only to people who opted in.

We do not sell personal data. We do not share personal data with third parties for their own marketing.

4. Legal bases (GDPR)

If you are in the EU/EEA, our legal bases for processing are:

• Contract — to deliver services we agreed.
• Legitimate interest — to operate the site, prevent abuse, and respond to inquiries.
• Consent — for non-essential cookies and marketing communications.
• Legal obligation — for tax and accounting record-keeping.

5. How long we keep information

We retain information for as long as needed to deliver the service or as required by law. Inquiry data: up to 24 months unless an engagement begins. Project records: up to 7 years for tax and accounting compliance. Marketing list: until you unsubscribe.

6. Sub-processors

We use a small number of trusted vendors to operate the studio. Each is bound by a data-processing agreement where applicable.

• Microsoft Graph — transactional and lead-notification email delivery.
• Cloudflare — CDN, WAF, edge hosting.
• Stripe — billing.
• Google Workspace — email and document storage.
• Notion — internal project documentation.

7. Your rights

You have the following rights, subject to local law:

• Access — request a copy of the personal data we hold about you.
• Rectification — correct inaccurate data.
• Erasure — request deletion of your data.
• Restriction — limit how we process your data.
• Portability — receive your data in a machine-readable format.
• Objection — object to processing based on legitimate interest.
• Withdraw consent — at any time, where consent is the basis.

Email [email protected] to exercise any of these rights. We respond within 30 days.

8. International transfers

Some of our vendors are based outside your jurisdiction. Where this involves transfer of personal data outside the EEA or UK, we rely on the standard contractual clauses or other approved transfer mechanisms.

9. Security

We use industry-standard safeguards (TLS in transit, encryption at rest where applicable, access controls, and audit logs) to protect personal data. No system is perfectly secure; we will notify affected users and regulators in line with applicable law if a relevant breach occurs.

10. Children

Our services are not directed at children under 16, and we do not knowingly collect personal information from them.

11. Changes to this policy

We may update this policy as our practices evolve. Material changes will be reflected by the "Last updated" date above and, where required, by direct notification.

12. Contact

Questions about this policy or your personal data? Email [email protected].