Privacy Policy

This Privacy Policy explains what personal data SORA37 Studio (the “studio”, “we” or the “site owner”) may receive from visitors to sora37.studio, for what purpose, how that data is stored and protected, and what rights every user has.

We process personal data in accordance with the Law of Ukraine “On Personal Data Protection” and, for visitors from the European Union, with regard to the principles of the EU General Data Protection Regulation (GDPR).

By sending us an enquiry through the site, you confirm that you have read this Policy. If you do not agree with it, please do not send your data through the site’s forms — you can write to us directly at [email protected].

We only collect the data we need to answer your enquiry or keep the site running:

• the name you enter in the form;
• your phone number;
• your preferred way to be contacted (Telegram, Instagram, WhatsApp, Viber, email or other) and your username, number or address on that channel;
• details about your project that you share in an enquiry, a brief or correspondence with us;
• technical details of the request: the page the form was sent from, the site language, campaign tags (UTM) if they were in the page address, the browser type (user agent) and an irreversible hash of your IP address.

We do not ask for or collect payment details, health data, religious or political views or other special categories of data through the site, and we do not knowingly collect data from children.

We receive personal data in three ways:

• directly from you — when you fill in the contact form or a brief;
• when you write to us yourself by email, in a messenger or on social media linked from the site;
• automatically — technical details your browser sends with each request to the server, and settings in your browser’s storage (see the Cookie Policy for details).

We use your data only for the following purposes:

• to get in touch with you the way you chose and answer your enquiry;
• to assess the project, its timeline and cost, and prepare a proposal;
• to sign and perform a contract if we start working together;
• to protect the site’s forms from spam and abuse — limiting how often requests can be sent and filtering out automated submissions;
• to understand where enquiries come from (by UTM tags) and improve the site.

We do not sell your data, use it for profiling or automated decision-making, or send you marketing emails without your separate consent.

We process personal data on the following grounds:

• your consent — when you voluntarily send the form or write to us;
• steps taken at your request before entering into a contract, and the performance of a contract with you;
• our legitimate interest — the security of the site, protection from spam and basic statistics on enquiries;
• compliance with legal obligations where they apply to us.

An enquiry sent through the form is stored in the site’s secured admin panel, which only authorised members of the studio’s team can access. At the same time, the site’s server sends a notification about the enquiry to the team’s work chat in Telegram so that we can reply quickly.

A brief is a questionnaire about your project: goals, scope, budget, timeline and contacts. We use this information only to assess the project and prepare a proposal.

Please do not include other people’s data in the forms or the brief without their consent, or confidential information that is not needed to assess the project.

The site does not set advertising, marketing or tracking cookies for visitors. To make the interface work, your browser keeps a few technical settings — for example, the language you chose.

No analytics services are connected to the site at the moment. If we connect them in the future, they will load only after you consent in the cookie banner, and this Policy and the Cookie Policy will be updated.

The full list of entries the site keeps in your browser, and how long they are kept, is in the Cookie Policy.

We do not sell or pass your personal data to third parties for marketing. Data may only be processed by providers the site cannot work without:

• Telegram — the site’s server sends notifications about new enquiries to the team’s work chat;
• the hosting provider whose servers host the site and the enquiry database;
• services you choose yourself to contact us (Instagram, WhatsApp, Viber, email providers) — under their own privacy policies.

Some of these services may process data outside Ukraine; in that case the data is protected under their policies and safeguards.

We may also disclose data where the law or a lawful request from a public authority requires it.

We take organisational and technical measures to protect data from loss, unauthorised access or alteration:

• connections to the site are encrypted (HTTPS);
• the admin panel is password-protected and only the studio’s team has access to it;
• the IP address of an enquiry’s sender is not stored in plain form, only as an irreversible hash;
• the forms are protected from automated submissions and excessive requests.

No method of transmitting or storing data over the internet is completely secure, but we do everything we can to keep the risks to a minimum.

We keep data from enquiries and briefs for as long as we need to answer your request and for any work that follows, but no longer than three years from our last contact with you, unless a longer period is required by law or a contract.

Technical settings in your browser are kept until you close the tab or clear the site’s data — the periods are listed in the Cookie Policy.

You can ask us to delete your data sooner at any time — see “Your rights”.

Under the law, you have the right to:

• know what data of yours we process, for what purpose and who has access to it;
• receive a copy of your data;
• have inaccurate or outdated data corrected;
• have your data erased or its processing restricted;
• withdraw your consent at any time — this does not affect the lawfulness of processing before the withdrawal;
• object to processing based on our legitimate interest;
• lodge a complaint with the Ukrainian Parliament Commissioner for Human Rights or with the data protection authority in your country.

To exercise any of these rights, write to us at [email protected]. We will reply within 30 days.

The site links to third-party resources: the studio’s social media and messengers, client websites in the case studies, and designs in Figma. When you follow such a link, you leave our site and the privacy policies of those resources apply. We do not control their content or how they process data, and we are not responsible for them.

We may update this Policy when the way the site works, the services it uses or the law change. The new version takes effect when it is published on this page; the date of the last update is shown at the top of the document.

If the changes are significant, we will also announce them on the site.

For questions about this Policy and the processing of your personal data, write to [email protected].

The data controller is SORA37 Studio, the owner of sora37.studio.