Privacy
policy

This policy explains what personal data p99.studio collects when you visit this website or contact us, why we collect it, who we share it with, and the choices you have. It covers the website at p99.studio only.

1. Who we are

p99.studio is a senior engineering studio working out of San Francisco, New York and Berlin. For the data described here we are the controller — we decide why and how it is processed.

Reach us about anything in this policy at hello@p99.studio. We answer privacy requests from the same inbox we answer everything else from, usually the same day.

2. What we collect

Information you give us

• Contact details you type into the booking form — an email address or a phone number, whichever you choose to give. That single field is the only thing the form requires.
• Whether you marked the request urgent, and the page you were on when you sent it.
• Anything you put in an email or iMessage to us — we keep the correspondence so we can reply and pick the thread back up later.

Information collected automatically

• Server access logs. Every request to this site is logged by our CDN: your IP address, the time, the page or file requested, the HTTP status, the referring URL, your user agent (browser and operating system), and rough network/geographic information derived from the IP. These logs also record the cookie header your browser sends, so a request can be tied to the analytics id described in section 3.
• Product analytics. Page views, and events describing how the page was used — clicks on calls-to-action, whether the booking popup was shown or dismissed, whether a booking was submitted, hovers on the work showcase, and a periodic "still reading" signal. Each event carries a pseudonymous visitor id, the page URL, referrer, screen size and user agent. We do not record your screen or replay your session.
• A first-party tracking pixel (/a.gif) that we request from our own domain so we can tell real browsers apart from bots in the access logs.
• Ad click identifiers. If you arrive from one of our ads, the advertising click id in the URL (for example gclid) is stored for the length of your visit and attached to a booking request if you send one, so we can tell which ads produce real enquiries.

3. Cookies and local storage

We use a small number of first-party cookies and browser storage entries. We do not run a consent banner today; instead we keep the set minimal and give you a working opt-out below.

• Analytics (PostHog). A first-party cookie and matching localStorage entry hold the pseudonymous visitor id and session id that tie your events together. They are set by our own self-hosted analytics service.
• Site state. A localStorage flag remembering that the booking popup has already been shown to you, and a visit counter, so you are not shown it repeatedly.
• Ad click id. A sessionStorage entry holding the click id described above. It is discarded when you close the tab.
• Advertising (Google). Google's tag sets a first-party _gcl_* cookie to attribute conversions, and may set or read Google cookies for remarketing audiences.

Server access logs are not covered by that button — they are produced by the web server itself and are needed to run and secure the site. You can also block cookies and scripts in your browser settings; the site works without them.

For advertising specifically, you can manage Google's use of your data at My Ad Center and Google Ads Settings.

4. Why we use it, and our legal basis

• To answer you. When you send a booking request we email and message ourselves so someone replies quickly. Legal basis: taking steps at your request before entering into a contract, and our legitimate interest in responding to business enquiries.
• To run and secure the site. Access logs let us debug errors, spot abuse and keep the site up. Legal basis: legitimate interest.
• To understand what the site does well. Aggregate analytics tell us which sections are read and where people give up. Legal basis: legitimate interest in improving our own site, with the opt-out above as the safeguard.
• To measure and target advertising. Conversion measurement and remarketing audiences. Legal basis: consent where the law requires it for advertising cookies, otherwise legitimate interest.

5. Who we share it with

We do not sell your personal data, and we do not share it with anyone for their own marketing. We use a short list of service providers, who process data on our instructions:

• Amazon Web Services — hosting, content delivery, the serverless function behind the booking form, and log storage (United States).
• PostHog — product analytics. We run our own instance on our own server; analytics events are not sent to a third-party analytics vendor.
• Sentry — error monitoring for the booking form's backend, also self-hosted on our own server. If sending your enquiry fails, the error report can contain the contact detail you submitted.
• Resend — the email provider that delivers your enquiry to our inbox (United States).
• Telegram — an internal notification so we see a new enquiry immediately. The notification contains the contact detail you submitted.
• Google — advertising measurement and remarketing through Google Ads.

We may also disclose data if we are legally required to, or to establish or defend legal claims.

6. Where your data goes

Our infrastructure runs in the United States (AWS us-east-1) and on servers in Europe. If you are in the European Economic Area, the United Kingdom or Switzerland, your data may therefore be transferred outside your country. Where that happens we rely on the European Commission's Standard Contractual Clauses or an equivalent transfer mechanism offered by the provider.

7. How long we keep it

• Enquiries and correspondence — for as long as we are in contact with you and afterwards for as long as we may need them for our business records. Ask us and we will delete them.
• Analytics events and access logs — retained in pseudonymous form for as long as they are useful for security and for understanding the site.

If you want something removed sooner, email hello@p99.studio and we will do it.

8. Your rights

Depending on where you live you have some or all of these rights over your personal data:

• Access — ask what we hold about you and get a copy.
• Correction — have inaccurate data fixed.
• Deletion — have your data erased.
• Restriction and objection — object to processing we base on legitimate interest, including analytics and advertising.
• Portability — receive data you gave us in a machine-readable form.
• Withdraw consent — at any time, without affecting what happened before.

To exercise any of them, email hello@p99.studio. We will not charge you or treat you differently for asking. If you are in the EEA or the UK you also have the right to complain to your local data protection authority.

California residents. We do not sell personal information for money. Advertising technologies of the kind described in section 3 can count as "sharing" personal information for cross-context behavioural advertising under the CCPA/CPRA; use the Google controls linked in section 3 to opt out of those. Our own analytics honour the Global Privacy Control signal: if your browser sends one, we do not capture analytics events at all, and the opt-out button above does the same thing manually. You also have the rights to know, delete, correct and to non-discrimination, exercisable at the same address.

9. Security

The site is served over HTTPS only. The origin storage is private and reachable only through our CDN. Credentials for the services above are held as encrypted environment variables and are not in our source code. No system is perfectly secure, but we keep the amount of personal data we hold small on purpose — the booking form asks for one field.

10. Children

This site sells engineering services to companies. It is not directed at children and we do not knowingly collect data from anyone under 16. If you believe a child has sent us data, email us and we will delete it.

11. Changes to this policy

If we change how we handle personal data we will update this page and move the "last updated" date at the top. Material changes will be described here rather than made silently.

12. Contact

Privacy questions, requests and complaints: hello@p99.studio.