Privacy Policy
Last updated: 8 October 2026
This policy covers the website canopystudio.eu. It explains which personal data we process, why, on what legal basis, how long we keep it, and who else sees it.
Our shared product values are in the Canopy Studio product manifest.
Who is responsible
The controller for your personal data is Matthieu Brousse, a private person trading as Canopy Studio.
Full details are in our legal notice.
What we process and why
We process personal data in only three situations.
1. Visiting this website
- Data
- Your IP address, the date and time, the page you ask for, your browser type (user agent) and the server response. The server that hosts the site records these in technical logs.
- Purpose
- To deliver the pages, keep the site secure and find errors.
- Legal basis
- Art. 6(1)(f) GDPR: our legitimate interest in keeping the website secure and working.
- Retention
- Only as long as needed to keep the site secure and working, then deleted. We are checking the exact period and will state it here.
- Recipients
- Hetzner Online GmbH, Germany. The website runs on our own server there, which we use for our marketing websites. Hetzner acts as our processor.
2. The contact form
- Data
- The app you choose, your name, your email address and your message.
- Your IP address
- Apart from the server logs described above, we keep your IP address only in memory, for up to 10 minutes after your last message, to stop spam. It is never written to disk.
- Purpose
- To answer your request, and to keep the form free of spam.
- Legal basis
- Art. 6(1)(f) GDPR: our legitimate interest in answering the questions people send us and in keeping the form free of spam. If your question is about using one of our products, also art. 6(1)(b) GDPR.
- Retention
- Up to 12 months after your request is closed. Then we delete your message and our reply. Resend, as our processor, also keeps its own delivery logs (sending metadata and message logs) for a limited period under its own retention policy. After that, they are deleted. Messages we delete from Gmail are then removed from Google's systems under Google's own deletion process.
- Recipients
- Resend, Inc., USA, sends the form as an email to contact@canopystudio.eu. Hetzner Online GmbH, Germany, runs that address and forwards every message to our mailbox at Gmail, a service of Google Ireland Limited, Ireland. The same applies when you email contact@canopystudio.eu directly. Resend and Hetzner act as our processors. We have no data processing agreement with Google: Gmail is a consumer service, and Google handles the messages under its own terms and privacy policy, also on servers outside the EU (see Data outside the EU).
- Is it required?
- No. You only need to give your name and email address if you want a reply. Without them we cannot answer you.
3. Cookies and browser storage
- Data
- The NEXT_LOCALE cookie stores your chosen language (en, fr or nl). If you use the light/dark switch, your browser also stores that choice ("theme") in its local storage.
- Purpose
- To show the site in the language and theme you chose.
- Legal basis
- These are strictly necessary for a function you ask for, so they need no consent. The theme choice stays in your browser and is never sent to us.
- Retention
- NEXT_LOCALE is a session cookie. Your browser deletes it when you close it. The theme choice stays until you clear your browser data.
- Recipients
- None.
No tracking
We use no analytics, no advertising and no tracking cookies. Fonts and images are served from our own server, so your browser does not contact other companies while you read this site.
Data outside the EU
Hosting is in Germany, in the EU. For now, our mailbox is at Gmail (Google Ireland Limited, Ireland).
Two steps can leave the EU. When you send the contact form, Resend (USA) delivers it as an email; your data is protected by the safeguards in Resend's data processing agreement, including the EU Standard Contractual Clauses. And Google may process the messages in our Gmail mailbox on its servers outside the EU, including in the USA. We have no agreement with Google about this. For the USA, Google LLC is certified under the EU-US Data Privacy Framework, which the European Commission has found adequate; for other countries, Google's privacy policy describes the safeguards it uses.
Links to other websites
Our pages link to the App Store and boske.dev. When you follow such a link, you leave this site. These services are not our processors. Their own privacy policies apply.
Automated decisions
We make no automated decisions about you and do no profiling.
Changes
We update this policy when our processing changes. The date at the top shows the latest version.
Our apps
This policy covers the website. Some apps have their own privacy notice:
Your rights
You have the right to access, correct and delete your data. You can also ask us to restrict processing, object to processing, or give you your data in a portable format.
To use these rights, email contact@canopystudio.eu. We answer within one month.
You can lodge a complaint with the Dutch data protection authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or with the authority in the EU country where you live.
Privacy questions: contact@canopystudio.eu · contact page