Privacy Policy

What we collect

• Contact-form details you give us: your name, your email address, and the message you write. If a channel asks for optional details (company, budget, preferred service), those are saved with your inquiry only if you provide them.
• Your IP address and the form submission token from our bot-protection check (Cloudflare Turnstile), used only to rate-limit and block form spam.
• Standard technical logs. Our hosting provider (Cloudflare) processes request logs such as IP address, timestamps, and requested URLs for security and operational purposes.

This website uses no analytics tools, no advertising networks, and no social-media pixels.

Why we use your data

• To reply to your inquiry and, if we work together, to manage your project.
• Submissions are stored as a “lead” in our private client portal so we can follow up. If you become a client, that same record becomes your project record; if not, we keep it only as long as it may be relevant.
• To prevent spam and abuse of the contact form (rate limiting, bot verification).
• To keep the site secure and operating correctly (technical logs).

The legal bases are your consent (you chose to submit the form), our legitimate interest in running and securing our business, and — for project work — performance of our contract with you.

The client portal

Clients and admins sign in to a private portal. There we process account data (your name, email, hashed password, optional two-factor authentication and recovery email) and project data (documents such as proposals, quotes, invoices and deliverables, your approvals or feedback on them, and internal notes). For security we keep a record of active sessions, including the IP address and time of each sign-in. All of this is governed by the same principles as this policy: we only process it to run your project and keep your account secure.

Service providers

We use a small number of providers, none of whom receive your data for marketing purposes:

• Cloudflare — hosting, database, storage, bot protection, and security logs.
• An email delivery provider (for example Resend or an SMTP provider) — used only to send us your inquiry and to send clients transactional emails like invitations and document notifications.
• Google Fonts — serves the site’s typefaces; Google receives standard web-server request data such as your IP address when the fonts are loaded.

How long we keep data

Inquiries are kept while they may still lead to working together, and project data for as long as needed to deliver and maintain your project. Rate-limit counters and bot checking delete automatically within minutes to hours. Ask us to delete anything earlier — see below.

Your rights

You can ask us for a copy of the data we hold about you, ask us to correct or delete it, or withdraw consent for future contact — just email contact@optimoatelier.com. If you are in the EEA or the UK you also have the right to complain to your local data-protection authority.

Changes to this policy

If we change what we collect or how we use it, we’ll update this page and change the date above. Significant changes affecting existing clients will also be announced by email or in the portal.