Privacy Policy
This policy explains how 23 Studios handles personal data. 23 Studios is a trade name of 23 Studios, a sole proprietorship registered in the Netherlands, Lange Lakenstraat 14, Haarlem (Chamber of Commerce no. 67270689). Questions or requests: hello@23studios.io.
1. Two roles
- Studios and their team (the people who use 23 Studios): for your account and billing details, we decide what happens with them. That's what this policy is about.
- Couples, leads and visitors of a studio's pages: their details are put in by the studio, which decides what happens with them. We process them only for the studio, under our Data Processing Agreement. Questions about those details go to the studio first; we help them answer.
2. What we keep about studios, and why
| What | Why | Basis |
|---|---|---|
| Name, email address, password (only as a secure hash), two-step login settings | Your account and logging in | Contract |
| Studio name, logo, contact details, settings | Providing 23 Studios | Contract |
| Billing details (company name, address, VAT number), plan, payments and invoices | Billing; invoices are kept 7 years as Dutch tax law requires | Contract, legal obligation |
| Technical logs (IP address, browser, failed login attempts) | Security, preventing abuse and fixing errors | Legitimate interest |
| Emails we send you about your account and plan | Service messages | Contract |
We don't sell personal data, don't use it for advertising and don't build profiles.
3. Cookies
We only use cookies that 23 Studios needs to work: to keep you logged in and to protect forms (CSRF). Your browser also remembers small things for you, such as the tab you were on. We don't use tracking or advertising cookies and no analytics tools. Because of that, there's no cookie banner.
4. Emails a studio sends
Emails a studio sends to its couples and leads go out through 23 Studios. To show the studio whether an email arrived, we note when it's opened and when a link in it is clicked. That's part of the processing for the studio (see the Data Processing Agreement).
5. Who else processes data
We use a few service providers (processors), each bound to protect the data:
| What for | Where |
|---|---|
| Hosting the app and its database | Germany (EU) |
| Storing films, photos and other files | EU |
| Sending emails | Ireland (EU) |
| Payments for your plan | Netherlands (EU) |
| Fonts on pages (the visitor's IP address) | Worldwide |
| Spam protection on forms (the visitor's IP address and browser details) | Worldwide |
Their names are available on request at hello@23studios.io, and studios find them in their account. Where one of them is a company outside the EEA, transfers are covered by the EU-U.S. Data Privacy Framework or the EU's Standard Contractual Clauses. We only share data with others when the law requires it.
6. How long we keep it
- Account and studio details: as long as your studio exists. After a plan ends, the studio is read-only for 90 days and may then be removed (see the Terms); deleting your account removes it straight away.
- Invoices and payment records: 7 years (tax law).
- Technical logs: a short time, at most a few months.
7. Security
All connections are encrypted (HTTPS), the app and its database are hosted in the EU, passwords are stored as secure hashes, two-step login is available for every account, and files are only reachable through private links.
8. Your rights
You can ask to see, correct, delete or receive a copy of your personal data, and object to how we use it. Much of it you can do yourself: change your details under Account, export everything under Account › Data & account, or delete your account there. For anything else, email us; we reply within a month. If you're not happy with how we handle it, you can complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
9. Changes
We may update this policy. When a change matters to you, we email you before it applies. The current version is always on this page.