We collect the minimum we need to schedule a call with you and understand how the site performs. We do not sell your data. We use Google for calendar and analytics, and Vercel for hosting — that is it.
You can ask us to delete what we hold at any time by emailing general@elypt.io.
1. Who we are
Elypt is a web design studio operating from Portugal, building websites for an international client base. For the purposes of EU data protection law, Elypt is the data controller of personal data collected through this site.
You can reach us at general@elypt.io.
2. What data we collect
Information you give us directly
When you book a discovery call, you provide: name, email address, industry or sector, your role, and optionally a website URL. When you email us, we receive whatever you choose to include in that message.
Information collected automatically
When you visit the site, we automatically receive: anonymised IP address, browser type and version, device type, operating system, pages visited, referrer URL, and approximate location (country / region level). This is collected through Google Analytics 4 with IP anonymisation enabled.
3. Why we collect it
- Booking form data — to schedule the discovery call, generate the calendar invite, and prepare for the conversation.
- Email correspondence — to respond to your inquiry.
- Analytics — to understand which pages and articles are useful to visitors, so we can improve them.
4. Legal basis
We process your personal data under the following bases set out in Article 6 of the GDPR:
- Performance of a contract (Art. 6(1)(b)) — when you book a call, we need your data to deliver it.
- Legitimate interest (Art. 6(1)(f)) — for website analytics, security, and to respond to general inquiries.
- Consent (Art. 6(1)(a)) — for any future marketing communications, which we do not currently send.
5. Who we share data with
We share limited personal data with the following service providers, who act as our processors:
- Google — for Google Calendar, Google Meet (call conferencing), and Google Analytics 4. See Google's privacy policy.
- Vercel — our hosting platform. See Vercel's privacy policy.
We do not sell your data. We do not share it for marketing purposes. We do not provide it to third-party data brokers.
6. International transfers
Some of our processors (Google, Vercel) are headquartered in the United States. When personal data is transferred outside the European Economic Area, we rely on the EU-US Data Privacy Framework where applicable, and on Standard Contractual Clauses approved by the European Commission.
7. How long we keep your data
- Booking form data: up to 12 months from the date of the discovery call, then deleted unless a service relationship continues.
- Email correspondence: up to 24 months.
- Analytics data: 14 months (Google Analytics 4 default), after which the data is automatically aggregated and personal identifiers are removed.
We keep data only as long as needed for the purposes set out above, or as required by law.
8. Your rights
Under the GDPR, you have the right to:
- Access — ask what data we hold about you.
- Rectify — ask us to correct inaccurate data.
- Erase — ask us to delete your data (the “right to be forgotten”).
- Restrict — ask us to limit how we process your data.
- Port — ask for your data in a portable format.
- Object — object to processing based on legitimate interest.
- Withdraw consent — at any time, where processing is based on consent.
To exercise any of these rights, email general@elypt.io. We respond within 30 days.
If you believe we have mishandled your data, you can lodge a complaint with the Portuguese data protection authority (Comissão Nacional de Proteção de Dados — CNPD) or with the data protection authority in your country of residence.
9. Cookies and tracking
This site uses the following categories of cookies:
Strictly necessary
None set by us. The site does not require cookies to function.
Analytics
Google Analytics 4 sets cookies (typically named _ga and _ga_*) to measure aggregate site usage. IPs are anonymised. We operate in Google's Consent Mode v2 with advertising storage and personalisation denied by default.
How to opt out
- Install Google's opt-out browser add-on.
- Use a privacy-focused browser (such as Brave or Firefox in strict mode) or a browser extension (uBlock Origin, Privacy Badger).
- Disable third-party cookies in your browser settings.
10. Security
The site is served exclusively over HTTPS with HTTP Strict Transport Security enabled. We rely on Google and Vercel's enterprise-grade infrastructure for storage and processing. We do not operate our own servers.
11. Children
This site is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, please contact us so we can delete it.
12. Changes to this policy
We may update this policy from time to time. The “Last updated” date at the top reflects the most recent revision. Material changes will be communicated clearly when reasonably possible.
13. Contact
For any question about this policy or how we handle your data, email general@elypt.io.