Controller
Privacy questions can be sent to business@frostemberstudios.com.
What we process
We limit processing to what is needed to deliver the website, understand its performance, keep it secure, and respond when someone starts a conversation with us.
Website delivery and security
When you visit the site, hosting and infrastructure providers may process technical request data such as IP address, user agent, requested URL, timestamps, and basic security logs. This is used to deliver the website, prevent abuse, debug issues, and keep the service reliable.
Vercel Web Analytics
We use Vercel Web Analytics to understand aggregate website usage, such as page views and general traffic trends. Vercel describes Web Analytics as cookie-free and anonymized, without tying page view data to an individual visitor or stored IP address.
Vercel Speed Insights
We use Vercel Speed Insights to measure real-world performance information such as Core Web Vitals, loading behaviour, device or browser context, and page performance. This helps us improve the website experience.
Project and contact requests
If you contact us about a project, we process the information you choose to provide, such as your name, email, company, website, project context, goals, timing, and the content of your message.
Requested website audits
When you request an audit, we process the public URL you submit, fetch the public page from our server, and send the URL to the Google PageSpeed Insights API for a mobile Lighthouse assessment. The audit result is returned to your browser and is not written to our application database. Do not submit private links, access tokens, personal data, or confidential query parameters.
Abuse prevention and rate limits
Public forms and the audit use the connection IP address to create a keyed, pseudonymous rate-limit identifier. The rate-limit record contains the identifier, request count, scope, and timestamps; the raw IP address is not stored in that table. This helps protect the service from automated abuse and excessive requests.
Language preference
If you choose a Studio language, we store that choice in the first-party frostember-studio-locale cookie so the requested language can be used on later visits.
Legal bases
Website delivery, security, abuse prevention, privacy-focused measurement, and service improvement rely on our legitimate interests under Article 6(1)(f) GDPR, balanced against visitor rights. Project inquiries and requested audits are processed to take steps at your request before a possible contract under Article 6(1)(b), and where that does not apply, for our legitimate interest in answering business communications. Accounting, tax, and other mandatory records rely on Article 6(1)(c). Consent is used only if an optional feature requiring consent is introduced; it is not a condition of sending a project inquiry.
Processors and external services
We use Vercel for hosting, request logs, Web Analytics, and Speed Insights; Google PageSpeed Insights only when you request a website audit; Supabase for pseudonymous public-API rate-limit records; and configured email and mailbox providers to deliver and answer project inquiries. An audited public website also receives a server request from our audit service. We do not sell inquiry data or use it for third-party advertising. Some providers may process data outside the EEA. Where GDPR Chapter V applies, transfers rely on the provider’s applicable adequacy mechanism or Standard Contractual Clauses; further information or a copy of the relevant safeguards is available on request.
Retention
The language preference cookie expires after 12 months. A requested audit URL and its result are processed for the request and are not stored in our application database. Pseudonymous rate-limit records are kept only for the applicable abuse-prevention window and a short operational cleanup period. Inquiry correspondence is kept while we assess or deliver the requested work and afterwards only while needed for reasonable follow-up, contractual records, accounting and tax duties, security, or legal claims. Hosting, analytics, performance, and email records follow the configured retention periods of the relevant service and are reviewed against these purposes. Vercel states that the temporary Web Analytics visitor hash is discarded after 24 hours.
Your rights
- Request access to personal data we hold about you.
- Ask us to correct inaccurate or incomplete data.
- Request deletion of data where applicable.
- Object to or restrict certain processing.
- Request portability where applicable.
- Withdraw consent where processing is based on consent.
- Lodge a complaint with a data protection authority.
We normally respond to a verified rights request within one month. You may also complain to the Czech Office for Personal Data Protection or to the competent supervisory authority where you live, work, or believe an infringement occurred.
Czech supervisory authority: Úřad pro ochranu osobních údajů.
Providing data and automated decisions
Providing a public URL is voluntary, but we cannot run the website audit without it. Name, email, company, project selections, and project context are required to send the project brief; without them we cannot assess or answer the inquiry. Other communication is voluntary. We do not make automated decisions about people that produce legal or similarly significant effects. The website audit produces an automated technical score about a public page, not a decision about an individual.