Privacy Policy

Last updated: 26 September 2026.

Controller: Devify (entity in formation), registered address: Provided on formation, [email protected]. For this site the operator is a controller, not a processor. Client-site processing is covered by a separate DPA.

What we collect

From the contact form, quiz and email: name, email, company, website, message, quiz answers. From the server, for security and diagnostics: page requested, referrer, approximate country, browser family, and a hashed identifier derived from the IP address. We do not store raw visitor IP addresses after hashing at the edge. Hashes are kept for 30 days for rate-limiting and then deleted.

We do not intend to collect special-category data. Please do not put it in the message field.

Purposes and legal bases (GDPR art. 6)

• Reply to a request for information or a proposal — art. 6(1)(b) pre-contractual steps, and art. 6(1)(f) legitimate interests in running a studio.
• Quiz answers used to scope a proposal — same bases. If we later use quiz answers for marketing beyond that reply, we will ask for consent (art. 6(1)(a)).
• Security, rate-limiting, fraud prevention — art. 6(1)(f).
• Legal obligations (tax, bookkeeping) — art. 6(1)(c).

Processors

Cloudflare, Inc. (hosting, DNS, database, R2 backups). Resend (transactional email). These processors act on our instructions. We do not use a personal Gmail account as the operational mailbox for leads.

Transfers

Cloudflare and Resend may process data in the United States. Transfers rely on Standard Contractual Clauses and, where valid, the Data Privacy Framework. A copy of the relevant clauses is available on request.

Retention

• Lead records: 24 months after last contact, or longer if a contract follows (then for the contract term plus 6 years for accounting).
• Security hashes: 30 days.
• Backups: expire on rotation, not more than 90 days after production deletion.

Rights

You may request access, rectification, erasure, restriction, objection and portability, and you may withdraw consent where consent was the basis, by writing to [email protected]. You may complain to the Agencia Española de Protección de Datos (aepd.es) or to your local supervisory authority. We will not sell your personal information. If you are a California resident you have the CPRA rights of know, delete, correct and opt out of sale or share; we do not sell or share as those terms are defined.

Cookies

The site uses strictly necessary cookies or equivalent storage to operate and to remember a cookie preference. Analytics or marketing cookies, if introduced, will load only after consent. A separate cookie banner will then apply.