Privacy

Who is responsible

The data controller for theft.studio is Theft Studios, registered in the Netherlands, KVK 81705344, VAT NL862188726B01, with its studio in Valencia, Spain. Contact for anything in this policy: jason@theft.studio. We are a two-person studio; the scale of our processing does not require a data protection officer.

What this site collects

Almost nothing. This site has no user accounts, no contact forms, no cookies, no advertising trackers, and currently no analytics. Two categories of processing exist:

• Server logs. Our hosting infrastructure records IP address, user agent, and requested URLs for security and operations. Legal basis: legitimate interest (Art. 6(1)(f) GDPR). Retention: rotating, at most 30 days.
• Web fonts. Pages currently load the Anton and Archivo typefaces from Google Fonts, which transmits your IP address to Google LLC in the United States when a page loads. Legal basis: legitimate interest in consistent typography; we are moving to self-hosted fonts to remove this transfer entirely. Google's processing is described in Google's own privacy policy.

When you email us

If you write to jason@theft.studio, we process your name, email address, and whatever you send us in order to reply and, if you become a client, to run the engagement. Legal basis: pre-contractual steps and contract performance (Art. 6(1)(b) GDPR). We keep correspondence for the duration of the relationship plus the retention periods Dutch law requires (generally seven years for business and fiscal records).

Subscribers

Active subscriptions run through the collaboration tools agreed at onboarding (email by default; Figma and Notion for deliverables), and invoicing runs through our billing provider. Each of those platforms processes data under its own terms as our processor or as an independent controller; we name the exact providers and safeguards in the subscription agreement before any work starts. We do not sell personal data to anyone, ever.

Your rights

Under the GDPR you can ask us at any time to:

• access the personal data we hold about you (Art. 15)
• correct it (Art. 16) or delete it (Art. 17)
• restrict processing (Art. 18) or object to it (Art. 21)
• receive it in a portable format (Art. 20)
• withdraw any consent you gave, without affecting prior processing (Art. 7(3))

Write to jason@theft.studio and we answer within one month. You can also lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or with your local EU data protection authority.

No profiling, no automated decisions

We make no automated decisions about you and build no profiles. AI tools accelerate our design work; they are not pointed at your personal data.

Changes

When the site gains analytics, payments, or forms, this policy changes first and the date above moves. Material changes for subscribers are announced in their request channel.