CLEAR ABOUT
YOUR DATA.

Section 01

Who we are

VATS Studio is a digital agency based in Chicago, Illinois, providing web design and development, brand identity, search and advertising, and AI workflow automation services.

For the purposes of applicable data protection law, VATS Studio is the data controller for information collected through this website.

Business address: Apt 402E, 1016 W Balmoral Ave, Chicago, IL 60640, United States.
Contact: vats.studio/contact

Section 02

What we collect

Information you provide

• Contact form — name, email address, phone number, service interest, and your message. Submitted through the enquiry form at vats.studio/contact.
• Newsletter subscription — email address only, submitted via the homepage sign-up field.

Information collected automatically

• Analytics data — pages visited, time on site, device type, browser, approximate location (city and country level), and the URL that referred you. Collected via Google Analytics 4, Microsoft Clarity, and Umami.
• Session recordings — anonymised mouse movements, clicks and scrolling behaviour, collected by Microsoft Clarity to help us understand how people use the site. No keystrokes or personal input fields are recorded.
• Server logs — IP address and request timestamps, retained briefly by our hosting provider Vercel for security and performance monitoring.
• Bot-detection signals — interaction patterns assessed by Cloudflare Turnstile when submitting the contact form. This data is not stored by VATS Studio.

Section 03

How we use it

• Respond to enquiries — your contact form submission is used solely to reply to your question or project request and manage any resulting client relationship.
• Send confirmation emails — when you submit the contact form, an automated confirmation is sent to your address via our email provider Brevo. We also receive an internal notification.
• Newsletter — if you subscribe via the homepage, we may send occasional updates about our work and services. You can unsubscribe at any time.
• Improve the site — aggregate analytics data (page views, navigation paths, device types) helps us understand what is useful and what needs improving.
• Security — server logs and bot-detection data are used to prevent spam, fraud and abuse of our forms.

We do not sell, rent or trade personal information to third parties.

Section 04

Cookies

Cookies are small text files stored in your browser. We do not use cookies for advertising or to track you across other websites.

Cookies set by third-party tools

Cookie	Set by	Purpose	Duration
_ga, _ga_*	Google Analytics	Distinguish unique visitors	2 years
_gcl_au	Google Tag Manager	Ad conversion measurement	3 months
_clck	Microsoft Clarity	Identify unique users	1 year
_clsk	Microsoft Clarity	Consolidate page views per session	1 day

Umami Analytics does not set any cookies.

Managing cookies

You can control cookies through your browser settings. Most browsers allow you to refuse new cookies, delete existing ones, or alert you when a cookie is set. Disabling analytics cookies will not affect your ability to use the site.

To opt out of Google Analytics across all websites, use the Google Analytics Opt-out Browser Add-on. To opt out of Microsoft Clarity, visit clarity.microsoft.com/optout.

Section 05

Data retention

• Contact form submissions — retained while the enquiry or client relationship is active and for a reasonable period afterwards for reference. Deleted on request.
• Newsletter subscriptions — retained until you unsubscribe. To be removed, reply to any email or contact us directly.
• Google Analytics data — retained for 14 months (GA4 default setting).
• Microsoft Clarity data — retained for 13 months.
• Umami data — anonymised aggregate data with no personally identifiable information.
• Server logs — retained by Vercel for a short period in accordance with their data retention policies.

Section 06

Your rights

Under GDPR (visitors in the EU and UK)

If you are located in the European Union or United Kingdom, you have the following rights regarding your personal data:

Under CCPA (California residents)

If you are a California resident, you have the right to:

To exercise any of these rights, use the contact form at vats.studio/contact. We will respond within 30 days. We may ask you to verify your identity before fulfilling a request.

Section 07

Security

All data transmitted to and from this website is encrypted using HTTPS/TLS. Form submissions are validated and protected against common attacks including cross-site scripting and bot spam. Access to stored data in Supabase is restricted to authorised VATS Studio accounts.

While we take reasonable precautions, no method of transmission over the internet is completely secure. If you believe your data has been compromised, please contact us immediately.

Section 08

Children's privacy

This website and our services are not directed at children under the age of 13. We do not knowingly collect personal information from children. If we become aware that a child has provided personal data, we will delete it promptly. If you believe a child has submitted information to us, please contact us.

Section 09

Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. When we do, the "last updated" date at the top of this page will be revised. We encourage you to review this page periodically.

Continued use of the site after any changes constitutes acceptance of the updated policy.