Privacy Policy

Crest Web Studio designs and builds websites, internal tools and AI workflows. We operate the website at crestwebstudio.com and the client portal at app.crestwebstudio.com. For the personal data described below we act as the data controller, except where section 4 says otherwise.

Crest Web Studio is a trading name registered in the Netherlands with the Chamber of Commerce (Kamer van Koophandel) under number 89334183.

Contact: support@crestwebstudio.com.

We collect what you actively give us, and the technical records our hosting provider keeps in order to serve the site securely. We do not track you across the web.

When you submit the contact form

Your name, email address, and optionally your phone number, company name, the service and budget range you select, and anything you type into the message field.

When you book a call

If a booking calendar is offered after you submit the form, choosing a time records your name, email address, the notes carried over from the form, the slot and your time zone, so that we can both receive an invite. Booking is optional — closing the page instead simply means we email you to arrange a time.

When you hold a portal account

Your email address and authentication credentials (your password is stored only as a salted hash — we never see it), your profile details, and the project records you create while using the portal.

When you simply read the site

Nothing, unless you accept analytics in the cookie banner. If you do, Google Analytics records the pages you view, rough location, device and browser type, and sets cookies to recognise your browser between visits. If you decline, or ignore the banner, no analytics script is loaded at all and no such cookie is set. Our Cookie Policy explains this in detail.

Server logs

Our hosting provider records standard request data, including IP address, user agent and the page requested. These logs exist to keep the service running and secure, and are not combined with the information above. We also count submissions per IP address briefly in memory to stop the contact form being flooded.

• To reply to your enquiry and prepare a quote — because you asked us to, as steps taken at your request before entering a contract (Art. 6(1)(b) GDPR).
• To deliver the services you have engaged us for, including running your portal account — performance of our contract with you (Art. 6(1)(b) GDPR).
• To keep the service secure — spam filtering, rate limiting and server logging, on the basis of our legitimate interest in protecting the service and the people who use it (Art. 6(1)(f) GDPR).
• To measure how the site is used — only with your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.

We do not sell your personal data and we do not share it for advertising. We rely on a small number of service providers who process data strictly on our instructions:

• Supabase — the database where form submissions, portal accounts and project records are stored.
• Vercel — hosting for the website and the portal; processes requests and keeps the server logs described above.
• Resend — sends us an email notification when you submit a form. That notification contains the details you submitted, so that we can reply to you directly.
• Telegram — we also receive an alert in a private team chat when a form is submitted, so that enquiries are not missed. That alert deliberately contains no personal data: it says only that a submission arrived and that the details are in our email. We changed this in September 2026, because Telegram offers no data processing agreement to operators of its bot interface.
• Cal.com — where a booking calendar is offered, it schedules the call and receives your name, email and the notes carried from the form. It loads only after you have submitted the form, never while you are reading the site.
• Google — if, and only if, you accept analytics. See our Cookie Policy.
• Sanity — hosts the content of our blog and portfolio. It receives no information about you beyond the request for an image or article.

We may also disclose data where we are legally required to, or to establish or defend legal claims.

Where we handle personal data on behalf of a client— for example the customer contact records and review invitations we manage inside a client's reputation tools — that client is the controller and Crest Web Studio acts as their processor. Those individuals should direct requests to the client in the first instance, though we will always help.

Your data is stored inside the EEA. Our Supabase database runs in the eu-west-1 region in Ireland, so form submissions, portal accounts and project records are held within the European Economic Area at rest.

Some of the providers above are established in the United States and may access data from there — Supabase and Vercel for support and operation of the service, Resend to deliver our notification emails, Cal.com for scheduling, and Google where you have accepted analytics. Where personal data is transferred outside the EEA we rely on the safeguards permitted under Chapter V of the GDPR — in practice the Standard Contractual Clauses incorporated into these providers' data processing terms, or an applicable adequacy decision. You can ask us which mechanism applies to a particular provider and we will tell you.

• Contact form enquiries — 24 months from your last contact with us, then deleted. If you become a client, your records move to the basis below.
• Client and project records — for the duration of our relationship, and afterwards for as long as we are required to retain business records for tax and accounting purposes.
• Portal accounts — until you ask us to delete the account, after which it is removed within 30 days, except where we must retain specific records by law.
• Bookings — the call record stays in our calendar and in Cal.com for as long as we keep the related enquiry, and is deleted with it.
• Server logs— retained only briefly, per our hosting provider's standard retention.
• Analytics— where you have consented, Google retains the data according to the property's configured retention period. Declining, or clearing your cookies, stops the collection.

Under the GDPR you have the right to:

• Access the personal data we hold about you, and receive a copy of it
• Have inaccurate data corrected
• Have your data erased, where no legal obligation requires us to keep it
• Restrict or object to our processing
• Receive your data in a portable format
• Withdraw consent at any time, without affecting what we did before you did so

To exercise any of these, email support@crestwebstudio.com. We will respond within one month. We may ask you to confirm your identity first, so that we do not disclose your data to somebody else.

If you are not satisfied with how we handle your request, you may complain to the Dutch supervisory authority, the Autoriteit Persoonsgegevens, or to the authority where you live or work.

Data is encrypted in transit. The database enforces row level security, and the keys that can bypass it are held only on the server, never in your browser. Access to production data is limited to those who need it. No system is perfectly secure, and we will tell you and the supervisory authority if a breach affects you, as the GDPR requires.

Our services are aimed at businesses and are not directed at children. We do not knowingly collect personal data from anyone under 16.

We update this page when what we do changes — not the other way round. Material changes will be reflected here with a new “last updated” date.