Privacy Policy

Who we are

This website is operated by ANYMA LLC, a limited liability company organised under the laws of Delaware, United States (file number 10702506), with its registered office at 8 The Green, Suite B, Dover, DE 19901, United States.

We are not established in the European Union. Because we offer our services to people in the EU and the EEA, the GDPR applies to us under its Article 3(2), and we apply it to the personal data described in this policy.

ANYMA LLC is the data controller for the personal information described in this policy. For any privacy question, or to exercise your rights, email us at hello@anyma.studio.

What information we collect

On this website, the only personal data we collect is what you choose to share through our contact form: your name, your email address, the services you are interested in, the challenge you select, and anything you write in the message field. We also record the language of the page you used, so we can reply in it.

We also advertise on Facebook and Instagram, and some of our ads open a short form there. If you fill one in, we receive what you send: your name, phone number and email address — which Meta may fill in for you from your account, and which you can change before sending — together with the name of your business, its sector, whether it already has a website and when you would like to start. We treat it exactly like an enquiry sent through our contact form.

Please don't include sensitive information — such as health, financial or other special-category data — in your message. Unless you accept marketing cookies, we do not track or build profiles on people who simply browse the site.

To keep the form free of automated abuse we use Cloudflare Turnstile. Its script loads on every page that carries our contact form, so Cloudflare receives your IP address and some technical signals about your browser even if you never write to us. Turnstile is an anti-bot check rather than an analytics or advertising tool: Cloudflare states that it does not use it to profile visitors or follow them across sites.

We also use Sentry to find out when something on this site breaks. If a page fails to load or a request goes wrong, Sentry receives a diagnostic report: the address of the page, the page you came from, your browser, operating system and device type, the error message and the stack trace through our own code. We have configured it not to send account identifiers, cookies or the contents of anything you submit, so what you write in the contact form never reaches it. Your IP address is not stored either — but Sentry does read it in passing to work out roughly where the error happened, and keeps that approximate location (country, region and city) with the report. We do not record sessions or replay what visitors do on the site.

We also measure how the site is used and how fast it loads, with two tools from Vercel, our hosting provider. For each page you view, Vercel Web Analytics records the address of the page, the page you came from, the country, region and city your connection appears to come from, your browser, operating system and device type, and the time. To count visits without cookies, it tells one visit from another by a code computed from your request, which Vercel discards after 24 hours, so it cannot recognise you from one day to the next or follow you across other sites. Vercel Speed Insights records how quickly each page loads and responds, with the page address, your browser, operating system, device type, connection speed (such as 4G) and country. Neither stores anything on your device, and we see only totals, never individual visitors.

If you accept marketing cookies in our cookie banner, the Whop pixel runs on the pages you visit. It gives your browser a random identifier, stores it on your device, computes a fingerprint of your browser and device, and sends Whop those identifiers together with the address of each page you load, the page you came from, and technical details such as your browser, screen size and time zone. It also tells Whop when you start filling in our contact form and, when you send it, passes Whop the name and email address you entered, in plain text, with a reference number for your request. Your other answers and your message never reach Whop. If you reject them, or simply close the banner, it never loads. Our Cookie Policy lists exactly what it stores.

The Meta pixel runs under the same consent. It gives your browser a random identifier, stores it on your device, and sends Meta that identifier together with the address of each page you load, the page you came from, your IP address, technical details about your browser and device, and which buttons you click. If you arrived from one of our ads it also stores that ad's click identifier, and if your browser holds Meta's own cookies — because you are logged in to Facebook or Instagram, for example — Meta may connect the visit to your account. If you also fill in our contact form, the pixel sends Meta the name and email address you enter, hashed in your browser before they are sent, so that Meta can match the visit to an account of yours. If you reject marketing cookies, or close the banner, it never loads either, and nothing you write in the form reaches Meta.

Why we use it

We use the information you submit only to respond to your enquiry, to discuss and scope a potential project, and to follow up with you about working together. If you used one of our forms on Facebook or Instagram, that includes calling you to prepare the preview of your website you asked for. We do not use it for marketing unrelated to your enquiry.

The diagnostic reports are used only to find, understand and fix faults, and to keep the site secure and working. We do not use them to measure audiences, and we do not try to work out who you are from them.

The visit statistics and speed measurements tell us which pages people read and where the site is slow, so we can improve it. We look only at totals, and we use them neither to identify you nor for advertising.

The Whop pixel tells us which of our ads on Whop bring people to this site, so we can see what our advertising achieves. The name and email it passes on when you send the form serve only to let Whop match your enquiry to the ad that brought you; we do not otherwise combine its data with your enquiries.

The Meta pixel does the same for our ads on Facebook and Instagram: it tells us which of them bring people here, and Meta uses it to show those ads to people likely to be interested. The hashed name and email serve only to let Meta recognise the visit; we do not otherwise combine the pixel's data with your enquiries.

Our lawful basis

We process this information on the basis of our legitimate interests (Article 6(1)(f) GDPR) — specifically, our interest in responding to and managing enquiries about our services. We have considered your rights and do not believe this processing overrides them.

The same basis covers the diagnostic reports, here our interest in keeping this site functioning and secure — an interest Recital 49 of the GDPR recognises explicitly. Since the monitoring stores nothing on your device, it needs no consent under the cookie rules; you can still object to it under Article 21 by writing to hello@anyma.studio.

The visit statistics and speed measurements rest on legitimate interests too: our interest in understanding, in aggregate, how the site is used and in keeping it fast. They store nothing on your device either, so they need no consent under the cookie rules, and you can object to them in the same way.

If you would prefer we did not handle your enquiry on this basis, email us at hello@anyma.studio and we will stop.

The Whop and Meta pixels run on a different basis: your consent (Article 6(1)(a) GDPR), given in the cookie banner, which is also the consent the cookie rules require. You can withdraw it at any time from “Cookie Preferences” at the bottom of every page; withdrawing does not affect what happened before you did.

Who we share it with

We do not sell or rent your personal data. We share it only with the providers that help us run the studio and reply to you — Vercel, which hosts this website and provides the visit statistics and speed measurements; Google, whose Workspace we use for email; Attio, the customer relationship management (CRM) system in which we record enquiries; Resend, which delivers the confirmation email we send you the moment your enquiry arrives; Cloudflare, whose Turnstile service checks that our form is being used by a person rather than a bot; and Sentry, which receives the diagnostic reports described above — and only so far as they need it to provide their service to us. All of them act as our processors, under a data processing agreement that requires them to keep what they hold secure and to act only on our instructions.

Sentry is the one that never sees what you write: it receives diagnostics about failures, not enquiries. It uses its own subprocessors to run its service, which it lists publicly at sentry.io/legal/subprocessors and may change on 30 days' notice.

Resend, by contrast, does handle what you write: the confirmation email repeats your answers back to you, so it passes through Resend in order to be delivered. It too uses subprocessors, listed at resend.com/legal/subprocessors, which it may change on 14 days' notice.

Whop is different, and it only comes into it if you accept marketing cookies. It is not one of our processors: it receives the visit data the pixel collects, including the name and email from the contact form, and handles it under its own privacy policy, at whop.com/privacy. We decide to collect that data and send it to Whop, so for that step we are responsible together with Whop; what Whop does with it afterwards is its own responsibility.

Meta stands in the same position, and also only if you accept marketing cookies. Meta Platforms Ireland Limited receives the visit data the Meta pixel collects, including the hashed name and email from the contact form, and handles it under its own privacy policy, at facebook.com/privacy/policy. For collecting that data on this site and sending it to Meta, we and Meta are joint controllers under the controller addendum in Meta's Business Tools Terms; what Meta does with it afterwards is its own responsibility.

Our forms on Facebook and Instagram work the other way round: they are a feature of Meta's platforms, so what you write in them is collected there by Meta Platforms Ireland Limited and delivered to us, and Meta handles your use of its services under its own privacy policy, at facebook.com/privacy/policy. Once your answers reach us, we handle them like any other enquiry, with the providers listed above.

Where your data is stored

This website runs on Vercel. Its static pages are served from a global content delivery network, so they reach you from wherever is nearest, but the parts that execute code — the contact form above all — run in Vercel's Washington, D.C. region in the United States. The visit statistics and speed measurements are recorded by Vercel too. Enquiries you send through the form are then recorded in Attio, our CRM, handed to Resend so it can send you a confirmation, and answered from Google Workspace.

Your data is therefore processed in the United States. We are a US company with no establishment in the European Union and you send it to us directly, which under the European Data Protection Board's Guidelines 05/2021 is a direct collection rather than a “transfer” within the meaning of Chapter V of the GDPR. Everything else in this policy — your rights, our lawful basis, how long we keep your data — applies exactly as written.

Google and Cloudflare are US providers too. Both maintain safeguards for European personal data that reach further than our own position requires: Google LLC is certified under the EU–US Data Privacy Framework (Implementing Decision (EU) 2023/1795) and incorporates the Standard Contractual Clauses into its terms, and Cloudflare incorporates the Standard Contractual Clauses into its data processing addendum.

Attio is Attio Ltd, a United Kingdom company whose platform is hosted on Google Cloud in the European Union, so the enquiries we record there are stored in the EU. Its data processing addendum incorporates the Standard Contractual Clauses, together with the UK Addendum for transfers subject to UK law.

Resend is operated by Plus Five Five, Inc., of 2261 Market Street #5039, San Francisco, CA 94114. We have set it to send from its European region, so your confirmation email leaves from Ireland, but Resend states that its own processing operations take place in the United States and its subprocessors are US providers — so treat the confirmation as processed there. It carries both safeguards: it is certified under the EU–US Data Privacy Framework, and its data processing addendum incorporates the Standard Contractual Clauses together with the UK Addendum.

The diagnostic reports go to Sentry's United States region. Sentry is Functional Software, Inc., of 45 Fremont Street, 8th Floor, San Francisco, CA 94105, and it carries the same pair of safeguards: it is certified under the EU–US Data Privacy Framework for non-HR data, and its data processing addendum incorporates the Standard Contractual Clauses as a fallback. It has appointed an EU representative of its own, Sentry Software Netherlands B.V. in Amsterdam.

Whop is Whop, Inc., of 300 Kent Ave #401, Brooklyn, New York 11249, so the pixel's data is processed in the United States too. Its privacy policy states that it protects personal information transferred from Europe with measures such as the Standard Contractual Clauses.

Meta Platforms Ireland Limited shares the data the Meta pixel collects with Meta Platforms, Inc. in the United States. Meta Platforms, Inc. is certified under the EU–US Data Privacy Framework, and Meta also relies on the Standard Contractual Clauses for these transfers. What you send through our forms on Facebook and Instagram passes through Meta's systems in the same way before it reaches us.

How long we keep it

We keep enquiry data for up to 24 months after our last contact about it, unless your enquiry becomes an active project — in which case we keep it for as long as we work together and for any period required afterwards. After that, we delete it. You can ask us to delete it sooner at any time. The same applies to what you send through our forms on Facebook and Instagram; Meta decides how long it keeps its own copy, under its privacy policy.

Diagnostic reports run on a separate and much shorter clock: Sentry deletes them automatically 30 days after they arrive, and we do not copy them anywhere else.

The code Web Analytics uses to tell visits apart is discarded after 24 hours. What remains in Vercel is aggregate figures (page views, speed readings and their breakdowns by page, country, browser and device), which Vercel keeps for the period its service provides.

The confirmation email we send you keeps its own clock too. Resend holds a copy of it — your answers included, since the message repeats them back to you — in its sending records, and deletes it automatically 30 days after it is sent.

The Whop pixel's identifier stays on your device for up to two years, or until you withdraw consent, which deletes it, or clear your browser's storage. Whop decides how long it keeps the visit data it receives; its privacy policy says it keeps personal information for as long as it needs it for the purposes it was collected for.

The Meta pixel's cookies stay on your device for 90 days from your latest visit, or until you withdraw consent, which deletes them, or clear your browser's storage. Meta decides how long it keeps the visit data it receives, under its own privacy policy.

Your rights

Under the GDPR you have a number of rights over your personal data. To exercise any of them, email us at hello@anyma.studio; we will respond within one month. Your rights are:

• to ask for a copy of the personal data we hold about you (access);
• to have inaccurate data corrected (rectification);
• to ask us to delete your data (erasure);
• to ask us to restrict how we use it;
• to object to our processing, including where we rely on legitimate interests;
• to ask us to transfer your data to you or another provider (portability), where that applies;
• to withdraw your consent at any time, where we rely on it — for the Whop and Meta pixels, from “Cookie Preferences” at the bottom of every page; and
• not to be subject to decisions based solely on automated processing.

Automated decisions

We do not make decisions about you based solely on automated processing. Apart from the advertising measurement you can allow in the cookie banner, we do not build profiles of visitors. We build AI systems for our clients, but this website does not use any to make decisions about visitors.

How to complain

If you have a concern about how we handle your data, please contact us first at hello@anyma.studio so we can put it right.

You also have the right to lodge a complaint with a data protection supervisory authority — in particular in the EU or EEA country where you habitually live, where you work, or where you think the problem happened. The list of authorities is published at edpb.europa.eu. If you are in the United Kingdom, you can complain to the Information Commissioner's Office at ico.org.uk.

Because we are not established in the European Union, the “one-stop-shop” mechanism in Article 56 GDPR does not apply to us: there is no single lead authority, and each national authority is competent for its own territory.

Do you have to provide your data?

Providing your details is not a statutory or contractual requirement. But if you do not give us your name, email and message — or, in our forms on Facebook and Instagram, your name and a phone number or email — we will not be able to respond to your enquiry.

Cookies

By default this website uses only strictly-necessary storage. Two marketing tools, the Whop and Meta pixels, run only if you accept them in the cookie banner. You can read more in our Cookie Policy.

Do Not Track

Some browsers can send a “Do Not Track” signal. There is no common industry standard for how a website should respond to one, and our behaviour does not change with it. What decides whether anything tracks you here is your answer in the cookie banner: unless you accept marketing cookies, we do not track visitors across other websites.

Unless you accept them, we also do not allow third parties to collect personal information about what you do on this site for their own purposes, or to follow you across other sites over time. The error monitoring described above works for us alone, records only failures, and stops at the edge of this site; the visit statistics and speed measurements likewise work for us alone and record only totals.

Changes to this policy

We may update this policy from time to time. The current version is always on this page, along with the date it was last updated.