Privacy policy
What we collect
When you submit an enquiry, we collect your name, email address, message and any optional project details you provide, together with the page you submitted from. Firebase handles submission and a private backup; Resend delivers our notification and your acknowledgement. Spam protection checks submissions and uses temporary rate-limit records. Separately, only if you accept the analytics notice do we measure usage with Google Analytics: pages viewed, approximate region, device and browser type, and referral source. Analytics events do not include your enquiry details.
Who is responsible and why
Questar Studio is the data controller for this site. Analytics runs only on your consent, which is our legal basis for it; contact emails are processed to answer you and manage our relationship, which is our legitimate interest.
What we do not do
We do not sell personal data or share it for advertising, run advertising or cross-site tracking, or collect payment details on this site. We use service providers to process enquiries and operate the site. Analytics stays off until you allow it, and stays off if you decline.
Cookies and local storage
The site stores your analytics choice in local storage so the notice does not repeat. Google Analytics sets its own cookies only after you allow analytics; declining keeps them unset.
Hosting and providers
The site is hosted on Firebase (Google). Firebase also processes and stores form submissions and provides App Check with reCAPTCHA Enterprise for spam protection. Resend processes enquiry notifications and acknowledgement emails; our inbox providers handle the messages we receive and our replies. We use these services to respond to enquiries and operate the site. Google processes hosting and analytics data on our behalf; where this involves transfers outside your country, its contractual data-protection safeguards apply.
How long we keep data
Analytics records are held in aggregate and deleted automatically after at most 14 months. Enquiry records, delivery records and contact emails are kept only as long as needed to answer you and manage our relationship, then deleted. Temporary spam-protection records expire automatically.
Your choices
You can allow or decline analytics in the notice, and change your mind at any time with the Cookie settings link in the footer or by clearing site data. You may ask us what we hold about you and have it corrected or deleted; visitors from the EEA and UK also have the rights granted by GDPR, including complaining to a supervisory authority. For any privacy question, email us and we will respond.