Privacy policy.

Mad Studio is operated by Protonas plius, UAB, company code 304217125. This company is the controller of personal data collected through mformad.com and start.mformad.com. Our contact address is M. K. Čiurlionio g. 84B, Vilnius, Lithuania.

For anything about your data, email [email protected].

• When you send a message: your name, email address and message. A self-hosted check in your browser (ALTCHA) helps prevent spam without cookies or third-party tracking.
• When you send a project brief through start.mformad.com: your company or project name, your name and email address, your answers and any files you attach. The general form uses the same ALTCHA check.
• When you book a call: your name, email address, the topic, the time you choose, your time zone, your meeting choice (Google Meet or Cal Video) and any guest email addresses you add.
• When you visit: our hosting provider receives your IP address and basic request details, as every website does, to deliver the page and keep the service secure.

• To reply to your message, review your project brief, or arrange and hold the call you asked for. The legal basis is taking steps at your request before a possible contract (GDPR Art. 6(1)(b)).
• To keep the site and forms secure and free of spam. The legal basis is our legitimate interest in running a safe service (Art. 6(1)(f)).
• Where a record must be kept by law, to meet that legal obligation (Art. 6(1)(c)).
• We don’t use your details for marketing, and we don’t sell or share them for advertising.

We use these providers, each only for the purpose described:

• Resend (Plus Five Five, Inc.): delivers your enquiry to our inbox, tells us a project brief has arrived and sends a confirmation email to you.
• Cal.com: provides availability and receives booking details directly from your browser, creates the booking and sends its notifications. It also provides Cal Video when selected. The booking interface requests availability when the page loads, so Cal.com receives your IP address and request details before you submit a booking. Your name, email and topic are sent when you confirm a booking.
• Google: provides the connected calendar and creates the Google Meet link when that meeting option is selected.
• Our email host (Serveriai.lt, Lithuania): stores the messages we receive.
• Hetzner Online GmbH (Germany): hosts the website on our server in Finland.
• Cloudflare: provides DNS, traffic delivery and network security, processing request details such as IP addresses.
• Our hosting and storage providers, including Hetzner and Cloudflare: store project briefs and any files attached to them.

Some providers process data outside the European Economic Area, including in the United States. Their published transfer safeguards include:

• Resend: its Data Processing Addendum incorporates the European Commission’s standard contractual clauses for transfers outside the EEA.
• Google: Google LLC is certified under the EU–US Data Privacy Framework and also uses standard contractual clauses where applicable.
• Cloudflare: its Data Processing Addendum applies the European Commission’s standard contractual clauses to restricted transfers outside the EEA.
• Cal.com: Cal.com, Inc. has active EU–US Data Privacy Framework certification covering non-HR data, including booking details.

• We keep enquiry, project brief and booking details for as long as we need them for the conversation and any work that follows, then delete them. Records required by law are kept for the applicable statutory period.
• Hosting and security records are retained to investigate and resolve faults, abuse or security incidents. Retention depends on whether the issue is resolved, whether the record is still needed and whether a legal obligation requires it to be preserved.
• Cloudflare’s sampled security-event history covers up to 31 days; other security data follows its published purpose-based retention criteria. Resend’s standard email and log retention is 30 days.

You can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, or to receive it in a portable format. Email [email protected] and we will reply within one month.

You can also complain to Lithuania’s State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija): vdai.lrv.lt/en/.

Our website code and ALTCHA do not set cookies. We use no analytics or advertising trackers, and serve our fonts and application scripts from our own site.

Cloudflare may set strictly necessary security cookies when checking traffic or preventing abuse. These are separate from advertising or analytics cookies.

If we change how we handle your data, we will update this page and the date above.