Privacy Policy

1. Data controller

The data controller responsible for personal data processed on this website is CSM Studio, registered office:

Majaka tn 26
Lasnamäe linnaosa
11412 Tallinn
Harju maakond
Estonia

Contact: [email protected]

2. What we collect

• Account and order data: name, email, company, order details.
• Brief data: product information, audience notes, references and files you upload.
• Payment metadata from PayPal / Whop (we never store your card details ourselves).
• Basic technical data (IP, user-agent) collected in server logs for security and abuse prevention.

3. Why we use it

• To fulfil your order (produce the creatives you requested).
• To communicate about your order, revisions and support.
• To comply with legal, tax and accounting obligations.
• To prevent fraud and abuse of the service.

4. Legal bases (GDPR)

We process personal data under the following legal bases: performance of a contract (Art. 6(1)(b)), compliance with legal obligations (Art. 6(1)(c)), and our legitimate interests in operating and securing the service (Art. 6(1)(f)).

5. Processors we use

Data may be processed on our behalf by the following categories of providers:

• Payment: PayPal, Whop.
• Hosting and storage: Cloudflare (CDN + R2), our VPS provider.
• Transactional email: our transactional email provider.
• AI/creative production tools used internally to generate the ordered creatives.

We only share the minimum data necessary and require processors to protect it appropriately.

6. Retention

We retain order and brief data for as long as needed to provide the service and to meet legal (tax/accounting) retention requirements. Uploaded assets are retained for the duration of production and a reasonable period after delivery, then deleted or anonymised.

7. Your rights

Under GDPR you have the right to access, rectify, delete or port your personal data, to object to or restrict processing, and to lodge a complaint with your national data protection authority. Contact us at [email protected] to exercise these rights.

8. International transfers

Some processors we use are located outside the EEA. Where that is the case, transfers are safeguarded by adequacy decisions or Standard Contractual Clauses.

9. Cookies

The website uses only essential cookies required to operate the site and process orders. Analytics or marketing cookies, if added later, will be documented and only enabled with your consent where required.

10. Changes

Material changes to this policy will be communicated by email to active customers and reflected in the effective date above.