Privacy Policy

The controller for this website (waterboxstudios.com, in every language) is:

[TODO: full legal name(s) of the owner(s)] trading as Waterbox Studios [TODO: street and number] [TODO: postcode and town] Switzerland

Email: [email protected]

This policy follows the Swiss Federal Act on Data Protection (FADP), the EU General Data Protection Regulation (GDPR) and the UK GDPR.

• We don’t use analytics, advertising or tracking of any kind.
• The only cookie stores the language you pick.
• We only use your details to answer your message or to send the release email you asked for.
• We never sell your data or share it for marketing.

The site is hosted by Vercel Inc. (USA). When you load a page, Vercel’s servers automatically log technical data: your IP address, the date and time, the page requested, the referring page and your browser’s user agent.

We need this to deliver the site and keep it secure (legitimate interest, Art. 6(1)(f) GDPR). Vercel keeps these logs for a short period and we do not combine them with other data.

Fonts, images, audio and video are served from our own domain. Your browser does not contact Google or any other third party while you browse.

We set one cookie, NEXT_LOCALE, and only when you choose a language with the language switcher. It holds the language code (en, de or fr) so the site opens in that language next time, and expires after one year.

It is strictly necessary to provide a feature you asked for, so it needs no consent. We use no other cookies and no local storage. You can delete the cookie in your browser at any time.

When you send us a message we process your name, email address, your message and the language of the page you wrote from. We use them only to answer you.

The message is delivered to our inbox by our email provider, Resend (USA), and you receive an automatic confirmation of receipt.

Legal basis: steps prior to a possible contract and our legitimate interest in answering enquiries (Art. 6(1)(b) and (f) GDPR).

We delete enquiries once they are dealt with, at the latest 12 months after our last exchange, unless they lead to a contract and the law requires us to keep them longer.

If you sign up to hear when a project is released, we process your email address and site language, plus the time you confirmed, as a record of your consent.

We use double opt-in: we first send you a confirmation link, and you are only added to the list after you click it. If you don’t confirm within 48 hours, nothing is stored.

Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time with the unsubscribe link in every email or by writing to [email protected]. Withdrawal does not affect emails already sent.

The list is stored with Resend (USA). We do not track whether you open or click our emails. We delete the list at the latest six months after the release it was created for.

We use two service providers, both bound by a data processing agreement and allowed to use your data only on our instructions:

• Vercel Inc., USA: website hosting
• Resend, USA: sending email and storing the mailing list

Transfers to the USA are covered by the EU-U.S. and Swiss-U.S. Data Privacy Framework where the provider is certified, and otherwise by the Standard Contractual Clauses approved by the European Commission and recognised by the Swiss FDPIC.

We do not pass your data to anyone else unless the law requires it.

We link to Spotify, Apple Music, YouTube, Loot Audio and social networks. These are plain links: nothing from those sites loads until you click, and after that their own privacy policies apply.

You have the right to:

• find out what data we hold about you and get a copy
• have incorrect data corrected
• have your data deleted, or its use restricted
• receive your data in a portable format
• object to processing based on our legitimate interest
• withdraw consent at any time, with effect for the future

To use any of these rights, email [email protected]. We answer within 30 days.

You can also complain to a data protection authority: in Switzerland the Federal Data Protection and Information Commissioner (FDPIC, edoeb.admin.ch), in the EU the authority in your country of residence, and in the UK the Information Commissioner’s Office (ico.org.uk).

You don’t have to give us any data. Without an email address, however, we can’t answer you or tell you about a release.

We make no automated decisions and do no profiling.

The whole site is served over an encrypted connection (HTTPS), and only we can access your messages and the mailing list.

We update this policy when what we do with data changes. The date at the top shows the latest version.