TL;DR

We collect the minimum we need to answer you, schedule a call with you and understand how the site is used. We do not sell your data. Our statistics run on our own server, never through Google Analytics or any other third party, and anything beyond a plain page count waits for your yes in the cookie banner.

You can ask us to delete what we hold at any time by emailing [email protected].

1. Who we are

Elypt is a web design studio operating from Portugal, building websites for an international client base, run by CAMPOS SOLUTIONS, UNIPESSOAL LDA (NIF 518831183), Rua Capitão Leitão, 2800-133 Almada, Portugal. For the purposes of EU data protection law, it is the data controller of personal data collected through this site.

You can reach us at [email protected].

2. What data we collect

Information you give us directly

When you book a discovery call, you give us your name and email address, and if you choose to, a phone number, your industry, your role, a website address and notes. When you email us, we receive whatever you choose to include in that message.

When you send the project form at the end of the home page, you give us your name, your email address, what you are interested in, how soon you need it and your message, and if you choose to, your company. When you send the form of one of our landing pages, you give us your name, your email address and your business, and if you choose to, your industry, your website, your budget, your timeline and a WhatsApp number; we also note which page and campaign link you came from. We keep these messages, and the calls booked through the site, in our own CRM, so we can answer and follow up.

When you send Elypt a message or leave a comment on our Instagram or Facebook, Meta passes it to our CRM so we can answer from there: your name or username as Meta shows it, your message or comment, and when you sent it. We keep it with our other conversations.

Signing in, the client space and the CRM are not part of this site: they live in our app at app.elypt.io, which has its own Privacy Policy.

Information collected automatically

Every page opened on the site is added to a daily count per page. That count uses no cookie and holds nothing about you.

If you accept cookies in our banner, we also keep a record of your visit on our own server. It holds a random ID kept in a cookie, the pages you open, how long each one is in view and how far down you go, the site or campaign link that brought you, your type of device, browser, operating system and screen width, your country, the buttons and links you click, and how fast the pages load for you. We never store your IP address.

If you accept cookies and start the booking form, we keep what you type even if you stop before booking, so we can see where people stop. The form says so under its fields. We do not email you because of it.

3. Why we collect it

  • Booking form data — to schedule the discovery call, generate the calendar invite, and prepare for the conversation.
  • Email correspondence — to respond to your inquiry.
  • Project and landing page forms. To answer you and follow up on what you asked for.
  • Statistics. To understand which pages are useful, where people stop, and how fast the site is, so we can improve it.

4. Legal basis

We process your personal data under the following bases set out in Article 6 of the GDPR:

  • Performance of a contract (Art. 6(1)(b)) — when you book a call or ask us about a project, we need your data to answer and deliver it.
  • Legitimate interest (Art. 6(1)(f)). For the daily page count, which holds nothing about you, for keeping the site's forms safe from abuse, and to respond to general inquiries.
  • Consent (Art. 6(1)(a)). For the record of your visit and what you type in the booking form, only after you accept cookies, and for any future marketing communications, which we do not currently send. You can withdraw it at any time with the Cookies link at the bottom of every page.

5. Who we share data with

We share limited personal data with the following service providers, who act as our processors:

Messages and comments sent to us on Instagram or Facebook reach us through Meta's own systems, under Meta's privacy policy; our answers go back the same way.

We do not sell your data. We do not share it for marketing purposes. We do not provide it to third-party data brokers.

6. International transfers

Some of our processors (Google, Resend) are headquartered in the United States. When personal data is transferred outside the European Economic Area, we rely on the EU-US Data Privacy Framework where applicable, and on Standard Contractual Clauses approved by the European Commission.

7. How long we keep your data

  • Booking form data: up to 12 months from the date of the discovery call, then deleted unless a service relationship continues.
  • Email correspondence: up to 24 months.
  • Messages from the project and landing page forms, and on Instagram or Facebook: up to 24 months, like email, unless a service relationship continues.
  • Records of visits and booking forms left halfway: 13 months, then deleted automatically.
  • Daily page counts: 25 months. They hold nothing about anyone.

We keep data only as long as needed for the purposes set out above, or as required by law.

8. Your rights

Under the GDPR, you have the right to:

  • Access — ask what data we hold about you.
  • Rectify — ask us to correct inaccurate data.
  • Erase — ask us to delete your data (the “right to be forgotten”).
  • Restrict — ask us to limit how we process your data.
  • Port — ask for your data in a portable format.
  • Object — object to processing based on legitimate interest.
  • Withdraw consent — at any time, where processing is based on consent.

To exercise any of these rights, email [email protected]. We respond within 30 days.

If you believe we have mishandled your data, you can lodge a complaint with the Portuguese data protection authority (Comissão Nacional de Proteção de Dados — CNPD) or with the data protection authority in your country of residence.

9. Cookies and tracking

This site uses the following categories of cookies:

Strictly necessary

  • elypt_consent remembers your answer in the cookie banner, for 13 months.

Signing in happens in our app at app.elypt.io, which sets its own cookies only there; they are listed in its own Privacy Policy.

Statistics, only if you accept

  • elypt_vid is a random ID that lets us tell a returning visit from a new one, for 13 months. It is read by our own server only.
  • An ID for the current visit is kept in your browser's session storage and ends after 30 minutes away.

We use no advertising cookies and no third-party trackers.

How to change your answer

Use the Cookies link at the bottom of every page. Saying no removes the statistics cookie. You can also clear cookies in your browser settings at any time.

10. Security

The site runs on our own server and is served over HTTPS. Its forms only accept messages sent from the site itself, turn away robots, and limit how many can be sent in an hour from one connection or one email address. Accounts, passwords and the studio's panel live in our app at app.elypt.io: passwords are kept only as one-way hashes, and the studio's panel asks for a second step, a code sent by email, every time someone signs in. See its own Privacy Policy.

11. YouTube API Services

We use YouTube API Services in an internal tool that uploads our own videos to our own YouTube channel. By using it you agree to the YouTube Terms of Service, and the Google Privacy Policy applies to the data Google processes.

The tool asks Google for one permission, to upload videos to the channel that authorises it. It does not read, collect, store or share any other data from YouTube or from Google accounts. The access it receives is stored encrypted on our own computer and is never sent to anyone else.

You can revoke the tool's access at any time from your Google Account security settings. If you would like us to delete anything related to it, email us at the address below and we will do it within 7 days.

12. Children

This site is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, please contact us so we can delete it.

13. Changes to this policy

We may update this policy from time to time. The “Last updated” date at the top reflects the most recent revision. Material changes will be communicated clearly when reasonably possible.

14. Contact

For any question about this policy or how we handle your data, email [email protected].