How we handle your data.

01Data controller

The controller of personal data collected on studio-8.dev is STUDIO8, a simplified joint-stock company (SAS) with share capital of €8,000, registered with the Évry Trade and Companies Register under number 107 125 700, whose registered office is at 17 rue Pierre, 91230 Montgeron, France.

For any question about your data, write to privacy@studio-8.dev.

02Data we collect

We only collect what we need. Depending on how you use the site:

• Contact requests: your name, email address, company, the topic you choose and your message, when you write to us through the contact form or the assistant.
• Conversations with our AI assistant: the messages you exchange with it. If you choose to send the conversation to us, we receive the full transcript and a short summary.
• Browsing data, only if you accept analytics: pages viewed, clicks, approximate location, and device and browser type, collected by PostHog.
• Technical data needed to run the site securely: your IP address and request details, used for example to limit repeated form submissions.
• Atelier client portal: your email address, sign-in links, your activity on proposals (opening, time spent on chapters, scope selection) and, when you sign, your signature and the signed PDF. Session replay on proposal pages masks proposal text, signatures and comments: we see how you navigate, not the content.

03Purposes and legal bases

Each use of your data relies on a legal basis under the GDPR:

Answering your request and preparing a first conversation

Steps taken at your request before a contract (Art. 6(1)(b))

Measuring audience and improving the site

Your consent, which you can withdraw at any time (Art. 6(1)(a))

Running client engagements on Atelier

Performance of our contract with you (Art. 6(1)(b))

Keeping signature records

Our legal obligations (Art. 6(1)(c))

Securing the site and preventing abuse

Our legitimate interest in protecting our services (Art. 6(1)(f))

04Recipients

Your data is only accessible to the Studio 8 team members who need it. We never sell or rent it, and we do not share it for marketing purposes.

The following providers process data on our behalf:

Fly.io

Application hosting, Amsterdam (Netherlands)

Supabase

Database and file storage, Ireland

PostHog

Audience measurement, EU Cloud (Frankfurt, Germany)

Anthropic

AI model behind the assistant and the summary of contact requests

Google

Email (Google Workspace)

Slack

Internal notification of new contact requests

Anthropic, Google and Slack may process data outside the European Union, particularly in the United States. These transfers rely on the safeguards provided by the GDPR, such as the European Commission’s standard contractual clauses or the EU–US Data Privacy Framework.

05Retention periods

• Contact requests and assistant conversations: three years from our last exchange, unless they lead to an engagement.
• Client engagement data: for as long as the engagement is active. Archived engagements are kept for seven years to meet tax and legal requirements, then deleted.
• Sign-in links: 15 minutes. Session replays: 30 days.

Cookie durations are listed below. At the end of these periods, data is deleted or anonymised. You can ask us to delete it sooner at any time.

06Cookies

On your first visit, a banner asks whether you accept analytics. Declining has no effect on your visit. Cookies the site needs to work are set without consent.

s8_language

Remembers the language you choose. Essential, 12 months.

cookie_consent

Remembers your answer to the banner. Kept in your browser’s local storage and never sent to us.

ph_…_posthog

PostHog audience measurement. Only if you accept, 12 months.

sb-access-token, sb-refresh-token

Keep you signed in to the Atelier client portal. Essential, 24 hours and 30 days.

The public website’s fonts are hosted on our own website. Loading them does not connect your browser to Google Fonts.

To change your choice, clear this site’s data in your browser settings: the banner will appear again. On Atelier proposal pages, signing in counts as consent to the masked session replay described above, as set out in the engagement letter accompanying your proposal.

07Your rights

Under the GDPR and the French Data Protection Act, you have the following rights:

• Access: obtain a copy of the data we hold about you.
• Rectification: have inaccurate data corrected.
• Erasure: have your data deleted.
• Objection and restriction: ask us to stop or limit processing.
• Portability: receive your data in a machine-readable format.
• Withdrawal of consent: at any time, without affecting processing already carried out.
• Instructions after death: tell us how your data should be handled after your death.

To exercise them, write to privacy@studio-8.dev from the address concerned. We reply within one month. If we have reasonable doubts about your identity, we may ask you to confirm it.

If you believe your rights are not being respected, you can lodge a complaint with the CNIL, the French data protection authority.

08Security

We take appropriate technical and organisational measures to protect your data against loss, alteration and unauthorised access: encrypted connections (HTTPS), access restricted to the team members who need it, sign-in links that expire after 15 minutes, and a separate test environment in which client contact details are replaced.

09Changes to this policy

We may update this policy as our services evolve. The date at the top of the page shows the latest version. We will announce significant changes on the site or by email to the clients concerned.