What we do with what you send.

01Who we are

Deckhaus is a boutique visual communication studio founded and led by Rodrigo García. Deckhaus is the data controller for the personal data described on this page.

Legal entity

Owner input — registered company name

Registered address

Owner input — business address

Tax / VAT number

Owner input — VAT identification

Privacy contact

rodrigo@deckhaus.studio

02What we collect

We only collect what a project conversation needs.

• Contact details — name, work email, company, submitted through the Try one piece and Start a project forms.
• Project context — what you are presenting, deadlines, notes and any link you share.
• Uploaded material — the file you choose to send: a slide, a page, a deck, a brand file.
• Technical data — standard server logs kept by our hosting provider (IP address, timestamp, user agent) for security and abuse prevention.

We do not use cookies for advertising, we do not run third-party ad trackers, and we do not build visitor profiles.

03Why we collect it

• To reply to your enquiry and assess whether the work is a fit — our legitimate interest in responding to a business request, and steps taken at your request before entering a contract.
• To deliver a project you have commissioned — performance of a contract.
• To keep the site secure and prevent abuse — legitimate interest.
• To meet accounting and tax obligations once you become a client — legal obligation.

We never sell personal data, and we never use the material you send to train machine-learning models.

04File uploads

Files submitted through the site are validated in the browser and on the server, then stored with our file-storage provider. The studio receives a secure link, not the file itself, so material is never sitting in an inbox thread.

• Accepted formats: PDF, PPTX, PPT, Keynote, PNG, JPG, GIF, SVG, ZIP.
• Maximum size: 25 MB per file. Larger material should be shared as a link.
• Filenames are sanitised and stored under an unguessable path.
• File contents are never written to application logs or analytics.

If the material is confidential, ask for an NDA before you send anything. We sign yours or provide ours.

05Who processes data for us

Hosting

Vercel Inc. — site hosting and serverless functions

File storage

Vercel Blob Owner input — confirm final storage provider

Email delivery

Resend Owner input — confirm final email provider

Analytics

Owner input — confirm analytics provider, or state none

International transfers

Owner input — confirm transfer mechanism if providers process outside the EEA

Each provider acts as a processor on our instructions, under a data-processing agreement.

06How long we keep it

• Uploaded material — deleted 30 days after the exchange ends if we do not work together.
• Enquiry correspondence — kept for up to 24 months so we can pick up a conversation you restart.
• Client project files and invoices — kept for the period required by accounting and tax law. Owner input — confirm statutory retention period
• Server logs — retained by the hosting provider under its standard policy.

Deletion is a real operational step, not only a policy line: storage objects are removed, and the linked email thread is archived without attachments.

07Your rights

Under the GDPR you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or receive it in a portable format. Write to rodrigo@deckhaus.studio and we answer within 30 days.

You also have the right to complain to your national supervisory authority. Owner input — name the competent supervisory authority once the legal entity is confirmed

08Changes to this policy

If this policy changes materially we update the date below and, where the change affects work already in progress, tell the clients concerned directly.