Privacy.

The controller of your data is FRAMEFLOW S.R.L., tax ID 52767449, registered office Sat Pocola, Comuna Pocola, Nr. 94, jud. Bihor, România. For any question about your data, write to contact@frameflow.ro.

• When you write to us. Your name, email address and what you write, so we can answer and make you an offer. Legal basis: steps before a contract, at your request (GDPR Art. 6(1)(b)). We keep the conversation for up to 2 years after the last message, unless it becomes a project.
• When you book a call. The booking calendar is a Google Calendar page. What you fill in there (name, email, your note) reaches our calendar, and the call takes place on Google Meet. Legal basis: steps before a contract. The booking stays in the calendar for up to 2 years.
• When you become a client. The contact and billing details in the contract and invoices. Legal basis: performing the contract (b) and our accounting and tax obligations (c). We keep them as long as accounting law requires, usually 10 years.
• Visit statistics. We count visits with our own tool, without cookies and without anyone else's analytics service. From the IP address and browser we make a pseudonymous code (a hash) with a key that changes every day and is deleted the next day, so we cannot recognise you from one day to the next. The IP address and the full browser identifier are not stored; we keep only the browser and system family (for example Safari, iOS). We see the pages visited, how long a page stays open and how far it is scrolled, where visitors come from (including campaign UTM tags and which ad network sent the click, never the click ID), country, browser language, device type, page speed, errors, and clicks on contact actions (a link to the contact page, opening the calendar, copying or opening the email address, a phone link, a form being sent). Nothing typed into a form is ever sent to the counter. If your browser sends Do Not Track or Global Privacy Control, we count nothing. Legal basis: our legitimate interest in knowing which pages are read and fixing errors (f). Visits are kept for 13 months, errors for 30 days.
• Technical logs. The server records errors, sometimes with the IP address and the page requested, to keep the site safe and working. Legal basis: legitimate interest (f). They are deleted automatically after 30 days.

We do not sell data, build profiles or send newsletters.

A few providers process data only on our behalf, under contract:

• Amazon Web Services EMEA SARL (Luxembourg): hosting and the database of the visit statistics, on servers in Frankfurt, in the studio's own AWS account. The CloudFront delivery network may serve pages from locations near you, including outside the EU.
• Google Ireland Limited: Google Calendar and Google Meet, for bookings and calls.
• Our accountant, for invoices.

When a provider transfers data outside the European Economic Area, it does so with the safeguards GDPR requires (the European Commission's standard contractual clauses or the EU-US Data Privacy Framework).

Our site sets no cookies for visitors and uses nothing that tracks you. That is why you see no banner. The only cookies are those of the admin area (/admin): sign-in, session, and one that keeps the studio's own visits out of the statistics. They are set only on the studio's devices and are strictly necessary.

• The work page remembers in your browser how you like the list (grid or rows). It stays with you and is never sent to us.
• The booking calendar loads only when you press “Show the calendar”. Only then does Google load its page and set its own cookies, under Google's policy. If you would rather not, email us or open the calendar directly on Google's site.

You can delete cookies and stored data at any time in your browser's settings.

You can ask at any time to see the data we hold about you, to correct it, erase it, restrict it, receive it in a portable format, or object to processing based on our legitimate interest. Write to contact@frameflow.ro; we answer within one month.

If you think we have not respected your rights, you can complain to Romania's data protection authority, ANSPDCP, B-dul G-ral. Gheorghe Magheru 28-30, sector 1, Bucharest, dataprotection.ro, or to the authority in your own EU country.

The site runs on HTTPS only, and only the studio has access to the data. If this policy changes, the date at the top changes with it.