Privacy policy

Who we are

This website is run by TwoYou Studio ([Company details once registered]), a web design and development studio based in Zagreb, Croatia and Međugorje, Bosnia and Herzegovina. We are responsible for your personal data as described below. You can reach us at hello@twoyou.studio.

What we collect and why

When you contact us

When you send the contact form, we receive your name, email address, your message, the language you used and the time you sent it. We use this only to reply to you and to discuss a possible project. The legal basis is taking steps at your request before entering into a contract (Art. 6(1)(b) GDPR). The same applies when you email us directly.

To protect the form from spam and abuse, we also store your browser's user agent and a one-way, keyed hash of your IP address. We never store the IP address itself. The legal basis is our legitimate interest in keeping the service secure (Art. 6(1)(f) GDPR).

When you browse the website

We use Vercel Web Analytics and Speed Insights to understand which pages are visited and how fast they load. They work without cookies and only produce anonymous, aggregated statistics. Our hosting provider also processes technical data such as your IP address in short-lived server logs, which is necessary to deliver and secure the website (Art. 6(1)(f) GDPR).

This website does not use cookies for tracking or advertising.

Who processes your data for us

• Vercel Inc. (website hosting and analytics)
• Supabase Inc. (database for contact form messages, hosted in the EU)
• Resend (delivery of contact form messages to our inbox)

These providers act only on our instructions under data processing agreements. Where data is transferred outside the European Economic Area, it is protected by the European Commission's Standard Contractual Clauses or the EU-U.S. Data Privacy Framework.

How long we keep it

We keep enquiries for up to 24 months after our last contact. If an enquiry turns into a project, we keep the related correspondence for as long as accounting and tax law requires.

Your rights

You have the right to access, correct or delete your personal data, to restrict or object to its processing, and to receive it in a portable format. To use any of these rights, email us at hello@twoyou.studio.

You also have the right to lodge a complaint with a supervisory authority: in Croatia, the Personal Data Protection Agency (azop.hr); in Bosnia and Herzegovina, the Personal Data Protection Agency (azlp.ba).

Changes

If we change how we handle personal data, we will update this page and the date at the top.