Privacy policy

Last updated: 4 November 2026

Here we explain what personal data we process when you write to us through the contact form or visit mairo.studio, why, how long we keep it, who we share it with and what rights you have. This is the information required by Article 13 of the GDPR.

In short

Mairo Studio sp. z o.o. is responsible for your data.
From the form we receive your full name, email address and message. We use them only to reply to you and talk about your project.
We keep messages for 12 months after the last message, unless we sign a contract.
The site sets no cookies and stores nothing in your browser. We count visits without cookies and without following individual people.
We do not sell data or use it for advertising.

Controller

The controller of your personal data is Mairo Studio sp. z o.o., ul. Grójecka 71/73 lok. 37, 02-094 Warszawa, Poland, entered in the National Court Register (KRS) under number 0001263263, NIP (tax ID) 7011329233, REGON 545592062. For anything about your personal data, write to contact@mairo.studio or to our registered address. We have not appointed a data protection officer.

What data we process and why

Replying to your message and follow-up talks

Data: Your full name, email address and message from the form, and the language of the page you wrote from. If the conversation continues, also what you send us in later messages.
Purpose: Answering your enquiry and any follow-up talks, for example about a quote or working together.
Legal basis: Article 6(1)(b) GDPR, when you ask about working with us and want us to take steps at your request before entering into a contract. Otherwise Article 6(1)(f) GDPR: our legitimate interest in answering messages sent to us.

Protecting the form and the site

Data: Your IP address and technical request data (such as time, page address and browser) in our hosting provider's logs.
Purpose: Protecting the site and the form from abuse: we limit how many messages one IP address can send (5 per 10 minutes). The form also has a hidden field that people don't see; if a bot fills it in, the message is not sent.
Legal basis: Article 6(1)(f) GDPR: our legitimate interest in keeping the site secure.

Visit statistics

Data: The page you visit, the page you came from, your browser, operating system and device type, approximate location (country, region, city), and whether the form was sent (not its content). The tool tells visitors apart by a hash of request data that changes every day, so it cannot recognise you the next day or on other websites.
Purpose: Seeing how many people visit the site and which parts they read, so we can improve it.
Legal basis: Article 6(1)(f) GDPR: our legitimate interest in improving the site.

Establishing, pursuing or defending legal claims

Data: Correspondence, if it is needed in a dispute.
Purpose: Establishing, pursuing or defending legal claims.
Legal basis: Article 6(1)(f) GDPR: our legitimate interest.

Giving us your data is voluntary, but without your name, email address and message we can't reply. We do not make automated decisions about you or profile you.

How long we keep data

Messages and contact details: 12 months after the last message in the matter. If we sign a contract, we keep the data needed to perform it for as long as the contract lasts, and then for as long as the law requires (for example tax law) or until any claims become time-barred.
Technical data in hosting logs: 30 days, the log retention period on our hosting plan.
Data kept for legal claims: until the claims are time-barred.
Visit statistics: the hash that tells visitors apart changes every 24 hours; the aggregate statistics identify no one.
If you object, we will stop processing data based on legitimate interest sooner, unless we need it to defend against claims.

Who we share data with

We use these providers. They process data on our behalf, under data processing agreements:

Vercel (Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA): hosting the site, running the contact form, security (firewall and message limit) and visit statistics. The function behind the form runs in Frankfurt (EU), and the network that delivers the site to browsers is global.
Resend (Plus Five Five, Inc., operating as Resend, 2261 Market Street #5039, San Francisco, CA 94114, USA): delivering messages from the form to our inbox, from servers in Ireland (EU). Resend keeps sent messages and data about them (including sender, recipient, subject, content and delivery status) in the USA for a limited time.
Google Workspace (Google Cloud Poland Sp. z o.o., Rondo Daszyńskiego 2C, 00-843 Warszawa, Poland): our email, including the contact@mairo.studio inbox, where messages arrive and from which we reply.

We may also disclose data to public authorities where the law requires it.

Transfers outside the EEA (the European Union, Iceland, Liechtenstein and Norway). Vercel and Resend are based in the USA, and Google and its affiliates may access data from outside the EEA. These transfers are protected by the EU–US Data Privacy Framework (a European Commission adequacy decision) where the recipient in the USA is certified, and by standard contractual clauses adopted by the European Commission otherwise. We will send you a copy of the clauses if you ask at contact@mairo.studio.

Cookies and browser storage

mairo.studio sets no cookies and does not use browser storage (localStorage or sessionStorage). We serve our font from our own server, so your browser does not connect to Google Fonts or other third-party services.

Visit statistics (Vercel Web Analytics) work without cookies and store nothing on your device, so we do not ask for consent or show a banner. If we ever add cookies or other mechanisms that are not strictly necessary, we will turn them on only after obtaining your consent.

Your rights

You have the right to:

access your data and get a copy of it,
have it rectified (corrected),
have it erased,
restrict its processing,
data portability, for data we process under Article 6(1)(b) GDPR,
object, on grounds relating to your particular situation, to processing based on legitimate interest (Article 6(1)(f) GDPR).

Write to contact@mairo.studio. We will reply within one month. For complex or numerous requests we may extend this by two months; in that case we will tell you about the extension and its reasons within the first month. If we have reasonable doubts about your identity, we may ask for information needed to confirm it.

You can also lodge a complaint with the President of the Polish Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa) if you think we process your data unlawfully.

Changes to this policy

When we change how we process data, we will update this page and its last-updated date. The current version is always at mairo.studio/en/privacy.