Privacy policy

What data I collect, why, how long I keep it, and what you can ask me to do with it.

Last updated: 2026-08-11Citește în română

Who is responsible for your data

The data controller is Paul Oprisor, who publishes this site under the name DRIFT Studio. For anything to do with your personal data, including the requests described below, write to hello@driftstudio.ro.

As of this version, the activity is carried out by a natural person, with no registered legal entity. This changes none of your rights — the Regulation applies identically — but it does mean there is no company or VAT number to publish. When one exists, it will appear here.

What data I collect

Only what you type into the contact form, plus the technical data any web server records.

From the form: Your name, email address, message, and — if you choose to fill it in — a link to your site. Plus which of the two options you picked, a call or an audit.
Technical: Your IP address and browser type, in server logs, for security and for keeping the site running.
Statistics: Aggregate page-view counts. It uses no cookies and builds no profile that follows you from one day to the next.

I collect no sensitive data, I buy no contact lists, and I make no automated decisions about you.

Why, and on what legal basis

To reply to you: Art. 6(1)(b) GDPR — steps taken at your request before entering a contract. You wrote to me about a project; I need the data in order to answer.
Security and statistics: Art. 6(1)(f) GDPR — the legitimate interest in keeping the site running, defending it from abuse, and knowing which pages get read. The statistics are aggregated, so the impact on you is minimal.

Filling in the form is voluntary. The name, email and message are required only in the sense that without them I cannot reply — you are under no obligation to provide them, and you can simply email me instead.

Cookies

This site uses no cookies. None at all — not mine, not advertising, not analytics. That is why you will never see a consent window here: there is nothing to ask you about.

The only thing I write to your browser is a value called `drift:startup-seen`, which remembers that you have already watched the opening animation so I do not play it at you twice. It deletes itself when you close the tab, contains nothing about you, and never leaves your device.

The traffic statistics work without cookies and without persistent identifiers. The fonts are served from this domain rather than from Google, so your IP address is not handed to anyone merely because the page loaded.

Who else sees the data

I sell and rent data to no one. To keep the site and the email working, I do rely on a few providers, which process data strictly on my instructions:

Vercel Inc.: Website hosting and cookieless traffic statistics. USA, with EU servers. Transfers rely on Standard Contractual Clauses.
Resend, Inc.: Delivering contact-form messages and the confirmation sent back to you. USA, sending from the Ireland (EU) region.
ImprovMX: Forwarding messages sent to the published email address. EU (France).
Sanity.io: The content system that serves the portfolio images. EU, with European servers.

I may also disclose data if an authority lawfully requires it — but only as far as strictly obliged.

How long I keep it

Form messages: For as long as the conversation lasts, then at most 3 years from our last exchange, so I have the context if you come back. You can ask for deletion any time, sooner.
Contracts and invoices: If we end up working together, financial documents are kept for as long as accounting law requires, regardless of a deletion request.
Server logs: A few days, then they rotate automatically.
Statistics: Only in aggregate form, with nothing that identifies you.

Your rights

You have the following rights, and an email is enough to exercise them. I will not ask you for forms or make you justify yourself.

Access — to find out what data I hold about you and receive a copy.
Rectification — to correct anything that is wrong.
Erasure — to have it deleted, within the legal obligations above.
Restriction — to ask that it stop being used for a while.
Portability — to receive it in a format you can take elsewhere.
Objection — to object to processing based on legitimate interest.

Write to hello@driftstudio.ro and I will answer within one month at the latest, usually far sooner.

If something seems wrong and we cannot settle it between us, you have the right to complain to the Romanian data protection authority (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28–30, Bucharest — dataprotection.ro.

Changes

If something material changes — a new provider, a new purpose — I update this page and move the date at the top. I do not retroactively add new purposes for data I already hold.