Privacy notice

Who is responsible

Syrtis, an independent web studio run by one person, decides how the data described here is used. Under the EU General Data Protection Regulation (GDPR) that makes Syrtis the “controller”. Write to studio@syrtis.dev about anything in this notice.

In short

• No advertising. Visits are counted with Cloudflare Web Analytics, without cookies. Only if you allow it in the banner, Microsoft Clarity records how the pages are used (clicks, scrolling), never what you write in the chat.
• Our own items in your browser: your answer to the banner and your language if you pick one (in cookies), your light or dark choice, and, once you write in the chat, the chat’s ID. Clarity adds its own cookies only if you allow it.
• Chat replies are written by an AI model from Anthropic. Conversations are deleted automatically 30 days after the last message.
• If you ask for a person or a quote, the studio is alerted on Telegram.
• We never sell your data or use it for marketing.

Visiting the site

Cloudflare serves this site. To deliver pages and block attacks, it processes your IP address, details about your browser and the pages you request. Request logs for this site are kept for up to 3 days and are not used to profile anyone. Pages load no fonts, maps or videos from other companies.

To see how many people visit and which pages they read, the pages load a small script from Cloudflare Web Analytics. It records the page, the site you came from, your browser and device type, your country and how fast the page loaded. It sets no cookies, stores nothing on your device, does not fingerprint you and is not used for advertising; we see only totals, never individual visitors.

Legal basis: our legitimate interest in running a secure website and understanding how it is used (Art. 6(1)(f) GDPR).

Microsoft Clarity, only if you allow it

A banner asks whether we may use Microsoft Clarity. Until you choose “Allow”, it is not loaded at all. If you allow it, Clarity records how you use the pages: where you click and tap, how far you scroll, which pages you open, your browser, device, screen size and country. From that it builds heatmaps and short replays of visits, which help us see what is unclear or broken.

The chat and anything you type into forms are hidden from it. Clarity stores a random ID in two cookies on this site, “_clck” (to tell repeat visits apart) and “_clsk” (to join the pages of one visit), and Microsoft may set its own cookies, such as “MUID”, on its domains. We turn its advertising storage off.

Microsoft handles this data for us and keeps it for up to 30 days. Legal basis: your consent (Art. 6(1)(a) GDPR and Art. 5(3) of the ePrivacy Directive). You can change your answer at any time with “Cookie settings” at the foot of every page; if you withdraw, Clarity stops and its cookies on this site are removed.

What your browser stores

Apart from Clarity’s (above), the site sets up to two cookies and may save two items in your browser’s local storage:

• A cookie named “syrtis-consent” with your answer to the Clarity banner, “yes” or “no”, so we don’t ask on every page; kept for a year.
• A cookie named “syrtis-lang” with your language, such as “de”. Set only when you choose a language from the language menu, so the site opens in that language next time; kept for a year, or until you clear your browser data. It is sent only to this site. Without it, the page follows your browser’s language.
• Your theme, “light” or “dark”, under “syrtis-theme”. Saved when you press the theme switch, and kept until you clear your browser data.
• The ID of your chat, so the conversation is still there after a reload. Saved when you send your first message, and removed once the conversation has been deleted, or when you clear your browser data.

None of these is used for tracking or shared with anyone. Each only does something you asked for, so no consent is needed for them (Art. 5(3) of the ePrivacy Directive); the language menu says, where you make the choice, that it is kept in a cookie.

When you start a chat, Cloudflare Turnstile checks that you are a person and not a bot. It processes your IP address and signals from your browser for that check. Cloudflare also uses these signals, as a separate controller, to improve its bot detection, as its Turnstile privacy addendum describes.

The chat assistant

An AI assistant (Claude, made by Anthropic) answers the chat. Someone from the studio may read a conversation and reply in person. With each conversation we keep:

• your messages and the replies, with the time of each
• your browser’s language, and the country your connection comes from (not your exact location)
• where on the page you opened the chat
• a short summary written for the studio, whether you asked for a quote or a person, and any contact details you wrote

To limit abuse we also count messages per connection, using a keyed hash of your IP address (never the address itself). These counts are not stored with the conversation and are deleted at the end of the day (UTC).

Why: to answer your questions and, if you want, to prepare a quote. The legal basis is steps you ask for before a contract (Art. 6(1)(b) GDPR) or, for general questions, our legitimate interest in answering visitors (Art. 6(1)(f)). The rate limits, message limits and bot check that stop abuse rest on the same legitimate interest.

Each time you write, the conversation so far is sent to Anthropic to produce the next reply. Anthropic handles it for us as a processor, does not use it to train its models, and keeps it only for the limited time its commercial terms allow. If someone from the studio replies, the reply may be translated into your language by the same AI model.

AI answers can be wrong and are not a quote. Only a written quote from the studio is binding. Nothing about you is decided automatically: the assistant only decides whether to alert the studio.

Please don’t share health information, passwords, payment details or other sensitive information in the chat.

The quote form

The chat can show a quote form. Your email address is required so that we can reply. Everything else is optional: WhatsApp number, business name, type of business, town or country, timeline, plan and what the site should do.

The form goes straight to the studio: it is saved with the conversation and sent to the studio’s Telegram. It does not pass through the AI, but if you keep chatting afterwards, the assistant can see what you sent. Legal basis: steps you ask for before a contract (Art. 6(1)(b)).

Email and WhatsApp

If you email studio@syrtis.dev, your address and message reach us through our email provider.

If you message us on WhatsApp, WhatsApp (part of Meta) handles the message under its own terms and privacy policy. We see your number, profile name and messages. Email works just as well if you would rather not use WhatsApp.

Alerts to the studio

The studio gets an alert on Telegram when you send the quote form, ask for a person, write your email address or WhatsApp number in the chat, seem unhappy, or agree that the assistant passes on a question it cannot answer. The alert contains a summary, the contact details you gave, your language and country, and the latest messages. From then on, and whenever someone from the studio joins the chat, the rest of the conversation, including the assistant’s replies, is copied to that Telegram thread.

Telegram is run by Telegram Messenger Inc., which is based outside the European Economic Area (EEA), under its own terms. The alert thread is deleted together with the conversation.

If you become a client

We use your contact details, the content you send for your site and your payment details to do the work and keep a record of the project, as the contract and the law require (Art. 6(1)(b) and (c)). If we look after a site that collects your customers’ data, we do so as your processor under a separate data processing agreement.

Invoices are paid on a page of their own at pay.syrtis.dev, which opens only with the link in your invoice email. It shows the invoice and PayPal’s payment buttons, which are loaded from PayPal: PayPal then processes your IP address and browser details, may set its own cookies, and handles your card or account details under its own privacy statement. We never see your card number. We see your name, email address, the amount, the date and PayPal’s reference for the payment, and we keep the invoice, the payments and any discount code you entered for as long as tax and accounting law requires.

Who else handles your data

• Cloudflare, Inc.: hosting, chat storage, the bot check, request logs and visit counts.
• Anthropic: AI replies and translation.
• Microsoft: Clarity, only if you allow it.
• Telegram Messenger Inc.: alerts to the studio.
• PayPal (Europe) S.à r.l. et Cie, S.C.A.: payments and the payment buttons on invoice pages, if you become a client.
• WhatsApp (Meta): only if you message us there.
• Our email provider: email.

We share data with authorities only when the law requires it.

Transfers outside the EEA

Cloudflare, Anthropic and Microsoft process data in the United States. Cloudflare and Microsoft rely on the EU–US Data Privacy Framework, with the EU Standard Contractual Clauses as a fallback. Anthropic’s data processing terms include the Standard Contractual Clauses. Telegram is based outside the EEA. Write to us for a copy of these safeguards.

The chat database is placed in Western Europe where Cloudflare can do so. This is a preference, not a guarantee.

How long we keep it

• Chat conversations, with the quote form, language and country: at most 30 days after the last message (sooner if the studio sets a shorter period), then deleted automatically, together with the Telegram thread.
• Rate-limit counters: until the end of the day (UTC).
• Daily totals: numbers only, with nothing about you.
• Cloudflare request logs: up to 3 days.
• Visit counts (Cloudflare Web Analytics): 6 months, as totals.
• Microsoft Clarity recordings and heatmaps, if you allowed it: up to 30 days.
• Emails and WhatsApp messages that don’t lead to a project: 12 months after the last message.
• A homepage preview you did not take up: deleted within 3 months.
• Client records: as long as the law requires.

Your rights

You can ask us to:

• show you the data we hold about you and give you a copy
• correct it
• delete it
• limit how we use it
• stop using it where we rely on our legitimate interest
• give you the data you sent us in a machine-readable format

Write to studio@syrtis.dev. We reply within one month. For a chat, tell us roughly when you wrote and something you said: we can’t find you by IP address, because we don’t keep it.

Complaints

You can complain to the data protection authority in the EU country where you live or work, or where you think the problem happened.

Changes

If this notice changes, the date at the top changes too.