Privacy Policy

1. Data Controller

The controller of your personal data is an individual operating as OverCreate Studio (without a legal entity) based in Poland.

Contact for data protection inquiries: [email protected]

2. What data we collect

• Account & Authentication: name, email, password (hashed), and session tokens.
• Contact forms: name, email address, message content and attachments (if provided).
• Uploaded content: portfolio media (images, videos) and project information.
• Technical logs: IP address, browser headers, timestamps, pages visited.
• Cookies & Local Storage: used for authentication, preferences, and consent.

3. Purpose and legal basis

• Providing user accounts and services (GDPR Art. 6(1)(b)).
• Responding to contact requests (GDPR Art. 6(1)(b)).
• Protecting the website and preventing abuse (GDPR Art. 6(1)(f)).
• Displaying client projects and portfolio with consent (GDPR Art. 6(1)(a)).
• Storing necessary cookies for website functionality (GDPR Art. 6(1)(f)); optional analytics only with your consent (Art. 6(1)(a)).

4. Data storage and retention

Your personal data is stored securely and retained only for as long as necessary:

• Accounts — while active and up to 30 days after deletion.
• Contact requests — up to 24 months.
• Security logs — 90 to 180 days.
• Portfolio materials — until consent is withdrawn or project published.

5. Data processors and transfers

We use trusted third-party service providers:

• Hosting / Database: railway.
• Media Storage: Cloudflare R2.
• Email: Gmail.
• [Optional] Analytics — only if explicitly enabled by consent.

Where data is transferred outside the EEA, we ensure adequate safeguards via Standard Contractual Clauses (SCCs).

6. Your rights under GDPR

You have the right to:

• Access, correct or delete your data.
• Withdraw consent at any time.
• Restrict or object to processing.
• Request a copy (data portability).
• File a complaint with the UODO (Polish Data Protection Office) if you believe your rights are violated.

To exercise your rights, contact us at [email protected].

7. Cookies

This site uses cookies and local storage to ensure proper functionality (e.g., login, preferences, and cookie consent banner). Optional analytics or media embeds are only activated after you grant consent.

You can withdraw consent or change cookie preferences at any time via “Cookie Settings” in the footer or by clearing your browser cookies.

8. Children

Our services are not intended for children under 16. If you believe a child provided us personal data, please contact us to remove it.

9. Changes

We may update this Privacy Policy from time to time. The latest version will always be available at overcreate.co/privacy-policy.