How we handle your data

Who is responsible

Studio Hyra, based in Amsterdam, the Netherlands, is responsible for the processing of personal data described on this page.

What we collect and why

We only collect data when you use one of the features below.

• Contact form. Your name, email address, company, message, budget and timeline. We use this to answer your request and prepare a possible project. The legal basis is the steps you ask us to take before an agreement. The form keeps an unsent draft in your own browser so you do not lose your text.
• Chat on the contact page. The messages you type are sent to our AI provider to write an answer. Do not share sensitive information in the chat.
• Newsletter. Your email address, after you confirm your signup through the link we send you. We measure whether a newsletter is opened and which links are clicked, and we store your IP address only as a one-way hash. The legal basis is your consent. Every newsletter contains a link to unsubscribe.
• University. Your email address for the login link, your course progress, your exercise answers and the questions you ask the coach. Payments go through Stripe, so we never see your card details. The legal basis is the agreement you enter with us.
• Security and error reports. To stop abuse we briefly use your IP address to limit the number of requests. When a page fails, we store technical details of the error with your IP address as a one-way hash. The legal basis is our legitimate interest in a safe and working website.

Cookies and local storage

We use no analytics, tracking or advertising cookies. We only store what the website needs to work. That is your language, your choice between light and dark mode, your recent searches, your place in a lesson and, when you log in, your login session. These are functional and need no consent.

Who processes data for us

We work with a small number of providers who process data on our behalf. Each of them has a data processing agreement with us.

• Vercel hosts the website.
• Supabase stores our database and handles logins.
• Resend sends the newsletter and the login emails.
• Anthropic provides the AI behind the chat and the University coach.
• Stripe handles payments.
• Bossly, our own customer system, receives the requests from the contact form.

Data outside the European Union

Some of these providers are based in the United States. Transfers there are covered by the EU-US Data Privacy Framework or by the standard contractual clauses of the European Commission.

How long we keep data

We keep contact requests for as long as we are in touch, and delete them no later than two years after the last contact. Newsletter data stays until you unsubscribe. University data stays until you ask us to delete your account, apart from payment records that we must keep for seven years under Dutch tax law. Error reports and rate limit records are removed automatically after a short period.

Your rights

You can ask us to show, correct or delete the data we hold about you. You can also object to processing, ask us to limit it, ask for a copy in a common format and withdraw your consent at any time. We answer within one month.

If you think we handle your data incorrectly, you can file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Changes to this page

When we change how we handle data, we update this page and the date at the top.