Privacy
Policy.
How we collect, store, and process your data at Primyer.
- No selling personal data or building profiling trackers.
- Zero third-party advertising pixels or cookies.
- Infrastructure processors: Cloudflare only (hosting, database, and security).
- Fully compliant with GDPR, KVKK, CCPA/CPRA, and LGPD.
1. Who This Policy Covers
This policy explains how Primyer Studio (“we,” “us,” “the Studio”) collects, uses, and protects information when you visit primyer.com or primyer.de, submit a project inquiry, or sign up for a product release channel.
The natural person responsible for data processing on this website (the “data controller”) is identified in full, along with a service-of-process address, on our Imprint page. We keep that information there rather than duplicating it here to avoid publishing the same personal details across multiple pages.
This policy does not cover:
- Open-source software we publish (such as Sqlist.NET), which runs locally in your own environment. We do not collect, transmit, or monitor telemetry, schemas, or credentials through it.
- Kanz, our mobile application, which operates under its own privacy policy and is governed separately by the applicable App Store and Google Play agreements.
2. Our Approach to Data
We collect the minimum data needed to run this website and respond to inquiries. We do not sell personal data, do not build advertising or behavioral profiles, and do not use third-party ad trackers of any kind.
3. What We Collect and Why
A. Project Inquiries (Contact Form)
When you submit a project inquiry, we collect: full name, company name (optional), email address, phone number, and project details, scope, or timeline you provide. We also derive your coarse location (city, country, region) from your IP address at the point of submission.
Why: to evaluate your inquiry and respond to it — this is a pre-contractual step, not marketing. Location is used separately, to help us reach out through the most effective channel, in your local language where relevant, and at an appropriate local time. Legal basis (EU/UK): Article 6(1)(b) GDPR for the contact and project details you provide — necessary to take steps at your request prior to entering a contract. Article 6(1)(f) GDPR — legitimate interest — for the derived location, since it is not strictly necessary to respond but reasonably improves how we communicate with you; this is limited to coarse, IP-derived location, not precise geolocation. Storage: written directly to Cloudflare D1, our serverless database hosted on Cloudflare’s edge infrastructure. Submissions are screened by Cloudflare Turnstile to filter automated spam before reaching our database. We receive an internal notification containing only the general category of inquiry (e.g. project type and timeline) — this notification does not include your name, contact details, location, or the specifics you provided, and is not routed through any third-party processor. Retention: if no engagement follows, inquiry data — including derived location — is deleted after 12 months, or sooner on request. If we begin a project together, data is retained per the terms of that engagement.
B. Release Channel / Beta Signups (e.g. Kanz Beta)
When you submit your email to join a release queue, we collect that email address, along with your coarse location (city, country, region), derived from your IP address at the point of signup.
Why: to notify you of relevant product updates you opted into, and to help us plan region-scoped releases or rollouts. Legal basis (EU/UK): Article 6(1)(a) GDPR — your consent, given by submitting the form, for the email itself. Article 6(1)(f) GDPR — legitimate interest — for the derived location, limited to coarse, IP-derived location used solely to plan regional release scoping. You may withdraw consent for the email at any time by unsubscribing or contacting us; doing so also stops any associated location use. Retention: until you unsubscribe, or until the relevant release channel closes.
C. Network and Edge Security Metadata
To protect our infrastructure from automated abuse, our hosting network processes standard request headers, including IP address and coarse geographic location (country/city/region, determined at the network edge).
Legal basis (EU/UK): Article 6(1)(f) GDPR — legitimate interest in securing our infrastructure against automated threats. This interest is limited in scope (security only, not profiling) and we believe it does not override your rights, given the narrow purpose and short retention. Retention: edge security logs are retained for 30 days and then purged.
4. Cookies, Analytics, and Local Storage
- No tracking cookies or ad pixels. This site does not use tracking cookies, advertising pixels, or third-party trackers (e.g. Google Ads, Meta Pixel).
- Cloudflare Web Analytics: we measure traffic using Cloudflare’s cookieless, privacy-first analytics, which processes anonymous request data at the network edge without identifying or profiling individual visitors.
- Statically hosted fonts: Plus Jakarta Sans, Tajawal, and JetBrains Mono are served from our own servers. Your browser never contacts Google Fonts or similar third-party font services, so your IP is never exposed to them.
- Functional local storage: used only to remember interface preferences (language, sidebar state). This is strictly functional and does not require prior consent under EU, UK, or Turkish law, as it is not used for tracking or advertising.
5. Who We Share Data With
We do not sell, rent, or trade your personal data. We share data only with the processor necessary to operate this website:
| Processor | Role | Location |
|---|---|---|
| Cloudflare | Hosting, D1 database, edge security, Turnstile spam filtering, analytics | USA / Global |
International transfers: where data is processed outside your country (e.g. by Cloudflare in the US), transfers are made under Cloudflare’s Data Processing Addendum, which incorporates Standard Contractual Clauses or equivalent safeguards recognized under GDPR Chapter V, UK GDPR, and comparable frameworks. As the Studio is based in Türkiye, these transfers are also made consistent with the cross-border transfer requirements of KVKK Article 9.
6. Your Rights
Regardless of location, you can generally ask us to:
- Confirm what data we hold about you
- Correct inaccurate data
- Receive a copy of your data in a portable format
- Delete your data
- Object to or restrict certain processing
How these rights apply, and which regulator enforces them, depends on where you live:
EU / UK / EEA / GDPR You have the rights above under the GDPR / UK GDPR, plus the right to withdraw consent at any time (for consent-based processing) and the right to lodge a complaint with your local data protection supervisory authority.
Türkiye / KVKK You have equivalent rights under the Personal Data Protection Law (KVKK No. 6698), including the right to request erasure and to complain to the Turkish Personal Data Protection Authority (KVKK Kurumu).
California / US States / CCPA Depending on your state (e.g. California CCPA/CPRA, and comparable laws in Virginia, Colorado, Connecticut, Utah, and others), you may have the right to know what data is collected, request deletion or correction, and opt out of the “sale” or “sharing” of personal data for cross-context advertising. We do not sell or share personal data as defined under these laws, so this opt-out is not applicable to our current practices, but you may still exercise your access, correction, and deletion rights by contacting us.
Brazil / LGPD You have equivalent rights under the Lei Geral de Proteção de Dados (LGPD), including access, correction, anonymization, deletion, and the right to lodge a complaint with the Autoridade Nacional de Proteção de Dados (ANPD).
Global / APAC / AMER We extend the same core rights — access, correction, deletion, and complaint to your local privacy regulator — as a matter of policy, consistent with frameworks such as PIPEDA (Canada), the PDPA (Singapore), the Privacy Act 1988 (Australia), and the APPI (Japan).
To exercise any of these rights, contact us at privacy@primyer.com. We will respond within the timeframe required by the applicable law in your jurisdiction (typically 30 days).
7. Automated Decision-Making and Do Not Track
We do not use automated decision-making or profiling that produces legal or similarly significant effects on you. All inquiries are reviewed by a human.
This site does not use cookies or third-party trackers to monitor your browsing activity, so there is nothing for a “Do Not Track” browser signal to disable — we do not respond to DNT signals because tracking of that kind does not occur here in the first place.
8. Children’s Privacy
This website is not directed at children, and we do not knowingly collect personal data from anyone under the age of 16 (or the relevant minimum age in your jurisdiction). If you believe a child has provided us data, contact us and we will delete it.
9. Data Security
We rely on Cloudflare’s infrastructure-level security (encryption in transit, edge-level threat protection) and limit access to inquiry data to those who need it to respond to you. No system is perfectly secure, and we cannot guarantee absolute security of data transmitted over the internet.
10. Changes to This Policy
We may update this policy as our practices, tools, or applicable law change. Material changes will be reflected by updating the “Last updated” date above.
11. Contact
For any privacy question, data request, or complaint, contact the Studio at privacy@primyer.com. Full legal identity and service-of-process details are available on our Imprint page.