Privacy Policy

1. Who we are

The website 23stud.io and the 23studio brand are operated by Syncra Labs Sp. z o.o., Aleja "Solidarności" 68/121, 00-240 Warsaw, Poland ("23studio", "we", "us"). We are the controller of the personal data described in this policy under the EU General Data Protection Regulation (GDPR).

For any privacy question or request, email contact@23stud.io.

2. What we collect and why

• Contact form. Your name, email address, company (optional), the service you are interested in and your message. We use this to reply to you and to prepare an estimate or proposal. Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR) and our legitimate interest in answering business inquiries (Art. 6(1)(f)).
• Booked calls. When you book a call through zcal, we receive your name, email, the time you picked and anything you write in the booking form. Same purpose and legal basis as the contact form.
• Email correspondence. If you email us directly, we keep the conversation to handle your request and any project that follows.
• Analytics. Aggregated information about how the site is used: pages viewed, referrer, approximate country, device and browser type, and performance metrics. Vercel Web Analytics and Ahrefs Web Analytics work without cookies and do not identify you. Google Analytics runs only if you accept analytics cookies in the consent banner. Legal basis: our legitimate interest in understanding and improving the site (Art. 6(1)(f)) and, for cookies, your consent (Art. 6(1)(a)).
• Security. hCaptcha checks whether the contact form is submitted by a person and our hosting provider keeps short-lived server logs (IP address, request time, URL) to keep the site secure and available. Legal basis: legitimate interest (Art. 6(1)(f)).

We do not sell personal data, we do not use it for automated decision-making, and we do not add you to a newsletter unless you ask us to.

3. Cookies

Strictly necessary storage is used to remember your cookie choices. Analytics and marketing cookies (for example Google Analytics) are only set after you accept them in the consent banner. You can change or withdraw your consent at any time through the privacy settings link in the banner or by clearing cookies in your browser. Withdrawing consent does not affect processing that happened before it.

4. Who we share data with

We use the following service providers. They process data on our behalf under data processing agreements and only for the purposes listed:

• Vercel Inc.: Website hosting and privacy-friendly page view analytics (Vercel Web Analytics, no cookies). Privacy policy
• Google Ireland Ltd. / Google LLC: Google Tag Manager and Google Analytics (only with your consent), and Google Workspace email, which we use to receive and answer contact form messages. Privacy policy
• Ahrefs Pte. Ltd.: Aggregated website traffic analytics (Ahrefs Web Analytics). Privacy policy
• Usercentrics GmbH: Cookie consent banner and storage of your consent choices. Privacy policy
• Intuition Machines, Inc. (hCaptcha): Spam and bot protection on the contact form. Privacy policy
• zcal: Scheduling calls you book with us (your name, email and chosen time). Privacy policy

We may also disclose data where the law requires it, or to professional advisers (lawyers, accountants) bound by confidentiality.

5. Transfers outside the EEA

Some providers above are based in, or use infrastructure in, the United States or other countries outside the European Economic Area. Where that happens, transfers rely on the EU-U.S. Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses.

6. How long we keep data

• Inquiries that do not turn into a project: up to 24 months after our last exchange, then deleted.
• Client correspondence and project records: for the duration of the engagement and afterwards as long as required by tax and accounting law or to establish or defend legal claims.
• Analytics data: according to the retention settings of each tool, at most 14 months for Google Analytics.

7. Your rights

Under the GDPR you have the right to access your data, correct it, have it deleted, restrict or object to its processing, receive it in a portable format, and withdraw consent at any time. To use any of these rights, email contact@23stud.io. We reply within one month.

You also have the right to lodge a complaint with a supervisory authority. In Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl), or the authority in the EU country where you live or work.

8. Security

The site is served over HTTPS only. Access to inquiries and client data is limited to the people at 23studio who need it to do their work, and our accounts use two-factor authentication.

9. Changes to this policy

We will update this page when our practices or providers change and change the date at the top. Significant changes will be highlighted on this page.