Legal & information
How the current website handles visits, enquiries, accounts and optional audio interviews, and which safeguards still need to be completed.
Updated 13 November 2026
Micheál Fiachra Mac Cóil, trading as Studio Fi, is the controller for personal information collected through this website. Contact: [email protected]; postal address: Grabbestr. 3 32791 Lage Germany. This draft covers this website, not the separate privacy notices for websites built for customers.
Delivering and protecting the website involves processing connection information such as IP addresses, request times, requested URLs, browser information and technical errors. Security and abuse prevention rely on legitimate interests under Article 6(1)(f) GDPR. Hosting providers' actual logging, locations and retention must be checked before launch. Images, introductory audio and website fonts are served through the website. Featured project screenshots are local images; visiting an external project link takes you to that project's own website and privacy rules.
If you email us or submit a brief, we process your contact details, project information and correspondence to answer you and discuss the requested service. The basis is Article 6(1)(b) GDPR for steps you request before a contract, or Article 6(1)(f) for other business correspondence. Information needed for statutory record-keeping is processed under Article 6(1)(c). The written prototype stores submitted contact and project information in private object storage. Sending a brief is an enquiry, not an order or payment. Please do not include unnecessary sensitive information or other people's private data.
Winnie is an optional AI interview using ElevenLabs. Only after your explicit agreement and starting the interview are microphone audio and conversation information sent to ElevenLabs for live processing, recording, transcription and an AI-generated summary. This optional processing relies on consent under Article 6(1)(a) GDPR. You can stop the interview; stopping does not itself delete information already processed. The app stores a session identifier, a hashed session token, a keyed hash derived from your network address, consent version and timestamps for session security and usage limits. The raw network address is not stored in the interview session table; hosting infrastructure may still process it. Security processing relies on Article 6(1)(f). You review the proposed brief and enter your name and email separately. Pressing Send saves your contact details, edited brief, generated summary, transcript and extracted project information in the app's private database. The review step alone does not save that content in the app's submission record, but ElevenLabs already processes and retains the conversation. Separate short and guided recording prototypes upload audio to private storage only when submitted and currently require a verified account. AI summaries are suggestions for human review, not decisions that automatically accept or reject a customer or create a contract.
The current account integration uses Neon Auth and offers Google sign-in. If you choose it, Google and the authentication provider process sign-in information; the app receives account information needed to identify your session, such as your name, email and verification status. Provider privacy notices also apply. Authentication is used to provide the account function you request under Article 6(1)(b), with security processing under Article 6(1)(f). No account is required for the Winnie enquiry. Account-management and payment features described as future plans are not treated as existing services.
The app integrates Neon for its database, authentication and private object storage, ElevenLabs for the optional AI interview, and Google when you choose Google sign-in. Email correspondence also involves the business's email provider. Hosting, email configuration, relevant processor identities, processing regions and data-processing agreements must be confirmed before this draft is approved. Authorised access is limited to operating the service, handling the enquiry, security and applicable legal obligations. The illustrated crew is not a set of separate employees receiving your information.
Some integrated providers and their subprocessors may process information outside the European Economic Area. The actual locations, subprocessors and applicable transfer mechanism must be verified before launch. This draft does not claim that a particular EU adequacy decision, certification or set of contractual safeguards has already been checked.
The agreed target is to delete interview recordings and transcripts 14 days after each conversation ends, including the transcript copy saved with a submitted brief. This target is not yet implemented or verified: ElevenLabs currently retains conversations indefinitely, and the app has no automatic deletion process for interview transcripts or uploaded recordings. Contact details and the customer-reviewed brief have a separate purpose: responding to the enquiry and, if agreed, delivering the contract. Their retention schedule still needs to be agreed. Contract, accounting and tax records may need to be retained for applicable statutory periods, and relevant records may be needed for legal claims. This is not a justification for retaining all audio or unsuccessful enquiries indefinitely. Do not rely on a 14-day deletion guarantee at this stage. Contact [email protected] about access or deletion of existing information. Before public launch, both provider-side and app-side deletion, backups and the separate brief-retention schedule must be verified.
Subject to the conditions in the GDPR, you may request access, correction, erasure, restriction and portability of your personal information. You may object to processing based on legitimate interests on grounds relating to your situation. Where processing relies on consent, you can withdraw it at any time without affecting the lawfulness of processing before withdrawal. Contact [email protected]. We may need proportionate information to verify a request. Erasure is not absolute where a legal obligation or another applicable exception requires information to be kept.
You may complain to a data-protection supervisory authority, including the authority where you live or work or where the alleged infringement occurred. The authority for North Rhine-Westphalia is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), whose website is www.ldi.nrw.de.
Micheál Fiachra Mac Cóil · Studio Fi
Grabbestr. 3 32791 Lage Germany