Privacy Policy | Manta Studios

This policy covers this website, mantastudios.com, and the correspondence that starts from it. It does not cover other sites we link to, which have their own policies.

The short version

This website sets no cookies, runs no analytics or advertising, and does not track you across sites. Our host processes the technical data needed to serve and protect the site. If you write to us, we keep your message for as long as it takes to deal with it. That is the whole of it.

What we collect and why

When you visit

The site is served by Cloudflare. Like any web server, Cloudflare processes the request data your browser sends: your IP address, the page requested, the time, your browser's user-agent string and the referring page. It uses this to deliver pages, cache them and block attacks. That is a technical necessity of serving a website. We do not build profiles from it, and we do not run logging of our own beyond the single entry described under anti-spam below. Cloudflare keeps this data for the periods set out in its privacy policy.

When you contact us

If you email hello@mantastudios.com or press@mantastudios.com, we receive your address and whatever you include. If the contact form is enabled, it collects your name, your email address, the topic you choose and your message, and delivers them to the same inbox as an email with your address set as the reply-to. We use this to answer you and for nothing else. We do not add you to a mailing list.

When you enquire about or commission work

If you ask about web design or development, or go on to commission it, we hold the correspondence, any quote or proposal we write, the agreement for the project, and the invoices and payment records that follow. That means your name, your business, your contact details and the billing details needed to invoice you. We hold it to do the work and to keep the records the law requires of a company.

Anti-spam on the contact form

The contact form is optional and only works when its anti-spam protection is configured. When it is, three things happen on submission, and this is all of them:

A submission that fills the hidden trap field or arrives implausibly fast is discarded. Nothing from it is stored or sent.
To limit repeat submissions, the function takes the connecting IP address, hashes it with SHA-256 and stores a counter against that hash in a Cloudflare key-value store. The key also contains the current hour, so a new record starts every hour, and each record expires automatically two hours after it is written. The record holds the count and nothing else: not the address itself, and none of the form fields.
Cloudflare Turnstile checks that the submission comes from a person. Turnstile processes technical signals from your browser to do this, and the token it issues is verified with Cloudflare together with your IP address. See Cloudflare's privacy policy.

When a message is accepted, the function writes one log entry noting that it was accepted and which topic was chosen. The entry contains none of the fields you submitted. The function keeps no other copy of your message; the only copy is the email in our inbox.

Lawful basis

We rely on our legitimate interests in serving and protecting this website and in answering the people who write to us. When you enquire about work, we process your details to take the steps you ask for before a contract, and once a project is agreed, to perform that contract. We keep accounting and tax records because the law obliges us to.

Retention

Correspondence is kept for as long as the enquiry or the project needs it, and then for the statutory record-keeping periods that apply to a company's business records. The anti-spam counter described above expires two hours after it is written. There is no other store: this website has no database of visitors, no user accounts and no mailing list.

International transfers

Cloudflare operates a worldwide network, so request data and contact form submissions may be processed in a country other than your own, under the standard contractual safeguards Cloudflare publishes. The same applies to the email providers that carry our correspondence. We do not transfer your data anywhere else.

What we do not do

We do not set cookies or write anything to your browser's storage.
We do not use advertising or cross-site tracking.
We do not fingerprint your device.
We do not sell personal data or share it for advertising.
We do not use your messages to train anything.

Analytics

This website runs no analytics today. If we introduce them, we will use a privacy-preserving, cookieless provider, we will say so on this page before it goes live, and we will ask for consent where the law requires it.

Your rights

Under the UK GDPR and the EU GDPR you can ask for a copy of the personal data we hold about you, ask us to correct it, ask us to delete it, object to our processing of it, and, where it applies, ask for it in a portable form. In practice, what we hold is the correspondence we have had with you and any project records that came from it.

Email hello@mantastudios.com. The law gives us one month to respond. If you are unhappy with how we have handled your data you can complain to the data protection authority where you live.

Children

This website is not directed at children, and we do not knowingly collect personal data from anyone under 13. If you believe a child has sent us their details, email us and we will delete them.

Changes

If this policy changes, the date at the top of this page changes with it. We do not make quiet edits.

Who we are

The data controller is Crusader Ventures Ltd, trading as Manta Studios.