Privacy policy

1. Who processes the data

The data controller is [to be confirmed], a self-employed professional income tax payer in Russia, taxpayer number [to be confirmed] ("SD Studio", "we"). Contact for personal data questions: sebastian.desigual@gmail.com.

This policy covers the website studio.sebastiandesigual.com, the AI chat assistant on the website and the Telegram bot @SDStudio_assistant_bot. We process personal data under Russian Federal Law No. 152-FZ "On Personal Data". The Russian version of this policy prevails.

2. What data we receive

• Your name — how to address you.
• Your contact: Telegram username or phone number, and email if you leave one.
• Brief answers: your industry, city or country, whether you have a brand and a website, links, the task in your own words, timeline and budget range.
• Your conversation with the AI assistant on the website and with the studio's Telegram bot.
• In the Telegram bot: your chat ID, name and username from your Telegram profile, and your phone number if you share it with the button.
• Technical data: the page the enquiry was sent from and the site language. We don't store your IP address in readable form — only an irreversible hash, used to limit abuse.

We don't ask for passport details, bank card numbers, passwords, health information or other special categories of data — please don't send them.

3. Why

• To reply to your enquiry or question, prepare a proposal and estimate, and enter into and perform a contract.
• To answer questions in the chat and the bot (AI assistant) and to pass your question to the team when you ask.
• To protect the website and the bot from spam and abuse.

4. Legal basis

• Your consent to personal data processing (Art. 6(1)(1) of 152-FZ) — a separate document: studio.sebastiandesigual.com/en/consent/.
• Preparing and performing a contract you enter into at your own initiative (Art. 6(1)(5) of 152-FZ).

5. What we do with the data

Collection, recording, organisation, accumulation, storage, updating, retrieval, use, transfer (provision, access), blocking, deletion and destruction — using automated means.

6. Where the data is stored

Enquiries, brief answers and conversations are stored in a database on a server in Moscow, Russia, as Russian law requires for data of Russian citizens (Art. 18(5) of 152-FZ). Database backups are kept in Yandex Object Storage, also in Russia.

7. Who we share data with

• Yandex.Cloud LLC — the text of your chat and bot messages is processed by the YandexGPT language model so the assistant can reply (on our instructions; servers in Russia). The model doesn't receive your contact details unless you type them into a message.
• Telegram — notifications about an enquiry or a handed-over question (name, contact, enquiry text, conversation with the assistant) reach the team on Telegram. This is a cross-border transfer of personal data: Telegram's servers are outside Russia. Conversations in the studio's Telegram bot are also processed by Telegram under its own terms.
• The studio team works remotely, including from Turkey, and reads enquiries from there.

We don't sell data or share it for advertising.

8. Analytics and cookies

We don't use cookies for analytics or advertising. We count visits with Umami on our own server in Moscow: it uses no cookies and collects no personal data — only anonymous statistics (pages, referrers, device type), which is why the site has no cookie banner.

Your brief draft and chat conversation are kept in your browser's memory (sessionStorage) until you close the tab, so your answers aren't lost if you reload the page or switch language; we only receive this data when you send an enquiry or a message.

9. How long we keep data

• Enquiries and brief answers — as long as needed to reply and to prepare and perform a contract, but no longer than 3 years after your last contact, or until you withdraw consent.
• Conversations with the AI assistant on the website and in the bot — 90 days after the last message, then deleted automatically. A conversation passed to the team with an enquiry is kept as part of the enquiry.
• Database backups — up to 30 days.
• Telegram notifications are deleted together with the enquiry.

10. Your rights

You can ask what data of yours we hold, ask us to correct or delete it, and withdraw your consent. Email sebastian.desigual@gmail.com — we'll reply within 10 working days (Art. 14 and 20 of 152-FZ). Once you withdraw consent, we stop processing and delete the data within 30 days unless the law requires us to keep it.

If you believe we're violating your rights, you can contact Roskomnadzor (rkn.gov.ru) or go to court.

11. How we protect data

Server access is key-only, the database is closed to the internet, connections to the website and between our servers are encrypted (HTTPS), and only the studio team can access the data. We back up regularly.

12. Changes

We may update this policy; a new version applies from the date shown at the top of the page. The current version is always here: studio.sebastiandesigual.com/enstudio.sebastiandesigual.com/en/privacy/.