Orinoco Studios Orinoco Studios

Privacy Policy

Last updated: 2026-08-02

1. Who is responsible for your data

The data controller is Orinoco Studios OÜ, a company registered in Estonia. For any question about this policy, or to exercise the rights in section 6, write to hi@orinocostudios.dev.

This policy covers orinocostudios.org only. It does not cover any separate product or service we operate under its own terms.

2. What we collect, and when

When you submit the contact form

You give us:

  • Your full name
  • Your email address
  • Your company name, if you choose to enter one
  • The service you are interested in
  • The content of your message

And we record automatically, alongside it:

  • A one-way cryptographic hash of your IP address — not the address itself. We use it to stop the form being abused. It cannot be turned back into an IP address.
  • The country the request came from, and your browser's user agent
  • The page language, and the date and time

Measurement and advertising — only if you accept

We use Google Analytics 4 to understand how the site is used, and Google Ads to measure whether our advertising works. Both rely on cookies and similar identifiers, and both send data to Google.

Nothing is switched on until you accept. When a page loads, all advertising and analytics storage is set to denied. It only changes if you choose "Accept" in the banner. If you decline, no analytics or advertising cookie is written and the site works exactly the same. Declining is one click, in the same place and the same size as accepting.

If you accept, Google may process: a randomly assigned identifier stored on your device, the pages you view and how long you spend, the site you arrived from, approximate location derived from your IP address, your device and browser type, and — if you arrived from one of our adverts — which advert it was. Google acts as our processor for Analytics and, for advertising, as an independent controller for its own purposes. Google's own explanation is at policies.google.com/technologies/partner-sites.

You can change or withdraw your choice at any time, as easily as you gave it, using the Cookies link in the footer of any page. Withdrawing does not affect processing that already happened.

We use no other advertising networks, tracking pixels, or profiling cookies.

3. Why we use it, and on what legal basis

  • To reply to your enquiry and prepare a possible engagement. Legal basis: Art. 6(1)(b) GDPR — steps taken at your request before entering into a contract.
  • To stop the form being abused — rate limiting and spam detection, using the hashed IP address. Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in keeping the service available and free of automated abuse.
  • To measure how the site is used and whether our adverts work. Legal basis: your consent, Art. 6(1)(a) GDPR. Nothing happens here unless you accept.

What you send through the contact form is never used for advertising and is never combined with the measurement data above. We do not sell or rent your data, and we make no automated decisions that produce legal or similarly significant effects about you.

We may use artificial intelligence tools to help draft our reply to your message (see section 5), but a person always reviews, decides and sends it.

4. How long we keep it

  • Contact form submissions: 12 months from the date we receive them, then permanently deleted.
  • Submissions automatically flagged as spam: 30 days.
  • If our exchange leads to a contract, the related data is kept for as long as the business relationship and the applicable statutory retention periods require.

Deletion means removal from the database, not anonymisation.

5. Who else processes it

We keep this list deliberately short. Your data is handled by:

  • Our hosting provider — the server storing contact form submissions is located in France (European Union).
  • Cloudflare, Inc. — DNS for our domain.
  • Google Ireland Ltd. (Gmail) — we are notified of new submissions by email, so the content of your message passes through Google's mail service.
  • Google Ireland Ltd. (Analytics and Ads) — only if you accept the cookies described in section 2.
  • Anthropic (provider of the Claude AI assistant) — we use its artificial intelligence tools in our work, including to help us draft and organise replies to the messages we receive, so the content of your submission may be processed by Anthropic as our processor. A person always reviews and decides the reply.
  • Google (Google Fonts) — this site loads a web font from Google's content delivery network, so your IP address is transmitted to Google when a page loads. This happens on every page, independently of the contact form and of your cookie choice.

The chat and error-monitoring tools we use internally to read submissions are self-hosted on our own infrastructure in the European Union; no third party operates them. Some of the AI tools we work with also run on that same infrastructure, and what they process never leaves it. Where transfers outside the EU/EEA occur through the providers above, they rely on the European Commission's Standard Contractual Clauses and, for Google and Anthropic, the EU–US Data Privacy Framework.

6. Your rights

Under the GDPR you have the right to:

  • access the personal data we hold about you;
  • have inaccurate data corrected;
  • have your data erased;
  • restrict our processing, or object to it;
  • receive your data in a portable, machine-readable format;
  • withdraw consent at any time, where consent is the basis.

Write to hi@orinocostudios.dev and we will respond within one month. Exercising these rights is free.

If you believe we have handled your data incorrectly, you can complain to the Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate), https://www.aki.ee/, or to the supervisory authority of the EU country where you live.

7. Security

The site and the contact form are served over HTTPS. Submissions are stored on a server that is not reachable directly from the internet, IP addresses are kept only as an irreversible hash, and access is limited to the people who need it to answer you.

8. Changes to this policy

If we change how we handle personal data, we will update this page and the date at the top.