Scope and who is responsible
This notice explains how Madevyn handles personal data when you visit madevyn.xyz, send a project brief or callback request, contact the studio by email, or use the private admin. It also explains the choices you have and how to exercise them.
Madevyn is a software studio operated by Ben Gbiang. Madevyn is the controller for the personal data described in this notice. The studio's correspondence address and any registration details are available to a counterparty in a signed proposal or on a lawful request. They are not published on the public site.
Privacy questions and rights requests go to privacy@madevyn.xyz.
Personal data we process
The data depends on how you interact with the studio:
- Inquiry data: the name, email address, company, website, phone number, services, budget range, timeline, project description, callback preference, timezone, referral source and consent that you choose to send through the brief or callback form.
- Communication data: the content of messages you send by email or through a form, the reply, and the dates and status of the inquiry.
- Engagement data: business contact details, project records, files, access details, invoices, payment references and correspondence needed to deliver work that has been agreed.
- Admin data: the admin email address, a salted password hash, an authenticator secret, session records, sign-in times and security events. The private admin uses a separate HttpOnly session cookie.
- Analytics data: only if you allow analytics, a random visitor identifier, a tab session identifier, the page path, the referring host, campaign labels, an approximate country, region and city, a coarse device class, the consent choice, and one of four event names: page view, call to action click, form start or form submit.
- Technical data: short-lived security and error logs held by the hosting and network providers. The application does not write your raw IP address, browser user agent, fingerprint or full referring address into an inquiry or analytics record.
- Preference data: your theme choice and analytics choice are kept in your browser.
Where the data comes from
Most data comes directly from you when you send an inquiry, reply to an email or request a callback. Cloudflare supplies the approximate location headers used by the site. Your browser supplies the analytics fields described above, but only after you allow analytics. The studio creates inquiry, admin and security records itself.
Do not send special category data, such as health, biometric, political, religious or trade union information, unless the work genuinely requires it and we have agreed how it will be handled. Do not send another person's personal data unless you have the authority and lawful basis to do so.
Why we process it and the lawful basis
The lawful basis depends on the purpose. We rely on one or more of the following:
- To reply to an inquiry, discuss a project and prepare a quote. This is a step you ask us to take before entering a contract, or our legitimate interest in responding to a business inquiry.
- To deliver an agreed engagement, manage the relationship, invoice for work and keep the records needed to run the studio. This is performance of a contract and our legitimate interest in operating the business.
- To protect the site, the forms and the private admin from abuse, fraud and unauthorised access, and to investigate a security incident. This is our legitimate interest in keeping the service safe, and a legal obligation where one applies.
- To understand which pages and calls to action help visitors, only if you allow analytics. This is consent, which you can withdraw at any time.
- To meet tax, accounting, legal and regulatory obligations, and to establish, exercise or defend a legal claim. This is a legal obligation or our legitimate interest.
- To send a service message about an inquiry or an engagement. This is performance of a contract or our legitimate interest in communicating about work you have asked for.
We do not sell personal data, use it for behavioural advertising, build a cross-site profile, record your session or make a solely automated decision that has a legal or similarly significant effect on you.
International transfers
Some infrastructure and email providers process data in countries other than the one in which it was collected. Where a transfer needs a safeguard, the studio relies on the provider's data processing terms and a lawful transfer mechanism, such as standard contractual clauses or another route permitted by applicable law.
A transfer is limited to what the provider needs for the service. You can ask for information about the safeguard that applies to a particular transfer by writing to privacy@madevyn.xyz.
How long we keep data
We keep personal data only for the period the purpose and the law require:
- Inquiry records are kept while the conversation is active and for up to 24 months after the last contact, then deleted unless a legal, tax, accounting or dispute obligation requires a longer period. You can ask for earlier deletion.
- Engagement, invoice and transaction records are kept for the period required by applicable tax and accounting law, and for as long as needed to establish, exercise or defend a legal claim.
- Analytics events are deleted after 90 days. A visitor identifier is deleted after 180 days without activity. A consent record is kept for the life of the visitor identifier and is removed with it.
- Admin sessions expire after twelve hours. Admin identity records remain while the admin role exists and are removed when it ends.
- Security and error logs are kept for a short operational period, normally no more than 30 days, unless an incident or legal obligation requires longer.
- Backup copies may persist for the short rotation of the backup system under the same access and security controls.
When a period ends, the record is deleted or irreversibly anonymised. If you ask us to delete a record, we will explain any legal or accounting reason that requires us to keep part of it.
Security
We use technical and organisational measures that include salted password hashing, authenticator-based admin sign-in, hashed server-side sessions, HttpOnly and SameSite cookies, CSRF checks, server-side validation, Turnstile on the forms, rate limits, least-privilege access and encrypted transport.
No system is perfectly secure. If you suspect a vulnerability or a data incident, write to security@madevyn.xyz. Do not test a suspected issue against another person's data or a system you do not own.
Your rights
Depending on the law that applies to you, you may ask to be informed about the data we hold, to access it, to correct it, to erase it, to restrict or object to processing, to receive a portable copy, to withdraw consent, and not to be subject to a solely automated decision that has a legal or similarly significant effect.
To exercise a right, write to privacy@madevyn.xyz. We may ask for information needed to verify your identity, but we will not ask for more than the request needs. We aim to respond within 30 days. A complex or repeated request may take longer, and we will explain why. A request is normally free unless the law permits a reasonable fee for a manifestly unfounded or excessive request.
If you are not satisfied with our answer, you may complain to the data protection authority in the country where you live or work, or where you believe the issue occurred.
Children
The site and the studio's services are intended for organisations and for people who can enter a binding contract. They are not directed to a child under 18. Do not send a child's personal data through the site. If a project genuinely involves data about a child, it must be agreed in writing and handled with the safeguards the law requires.
Marketing and automated decisions
We do not add people to a marketing list or send advertising email because they submitted an inquiry. We use your contact details to reply, discuss the work and manage an engagement. If we ever introduce a newsletter, it will ask for a separate choice and provide an unsubscribe route.
We do not make a solely automated decision that produces a legal or similarly significant effect. A decision about a project, a quote, a refund or a suspension is made or reviewed by a person.
Personal data breaches
We record and investigate a suspected personal data breach. Where the law requires notification, we notify the relevant supervisory authority without undue delay and, where the deadline applies, within 72 hours of becoming aware of it. Where a breach is likely to result in a high risk to a person, we notify the affected people without undue delay.
Where we act as a processor for a client, we notify the client without undue delay and give the facts the client needs to meet its own notification duty.
Complaints
If you are not satisfied with how we have handled your data or your request, write to privacy@madevyn.xyz first so we can try to resolve it. You may also complain to the data protection authority in the country where you live, work, or believe the issue occurred. We will cooperate with a lawful request from that authority.
Changes and contact
We may update this notice when the service, the providers or the law change. The version and date at the top identify the version that applies. A material change will be notified before it takes effect where the law requires it.
The controller is Madevyn, a software studio operated by Ben Gbiang. Privacy questions, rights requests and incident reports go to privacy@madevyn.xyz.