How we handle your data.

Last updated · 20 April 2026

Short version: we only collect what we need to reply to you and to run the studio. We never sell personal data. We store it on Swiss infrastructure, in Switzerland, under Swiss law. The long version is below.

01 — Who is responsible

Who is responsible

Estorya is the data controller for the personal data collected through this website. You can reach us any time at privacy@estorya.com or at Rue Ancienne, 1227 Carouge, Geneva, Switzerland. We operate under the Swiss Federal Act on Data Protection (revised nFADP, in force since 1 September 2023). If you are based in the European Union, your rights under the GDPR apply as well.

02 — What we collect, and why

What we collect, and why

We group personal data into four small buckets. Nothing else is collected in the background.

Contact form and project briefs

If you write to us through the contact form or the project brief form, we collect your name, email, phone (if provided), company, and the content of your message. Legal basis: your consent and our legitimate interest in answering you. Retention: 24 months after the last exchange, then archived or deleted.

Email, phone and meetings

If you email or call us directly, we keep the thread and a short note of any call we took. Legal basis: performance of pre-contractual or contractual work. Retention: for the duration of the engagement, then 10 years for accounting records as required by Swiss law.

Server logs

Our host records each request to the site — IP address, user agent, page requested, timestamp. These logs exist to protect the site from abuse and to debug issues. Legal basis: legitimate interest in site security. Retention: 30 days unless an incident requires a longer period.

The public site uses a single cookie to remember your cookie-banner choice. The Payload admin at /admin uses a session cookie for staff login — this part is not reachable by the general public. Details are in our cookie policy.

04 — Your rights

Your rights

Under Swiss and European data-protection law, you can always:

Ask for a copy of the personal data we hold about you
Correct anything that is inaccurate
Ask us to delete data we no longer need
Object to processing or ask us to restrict it
Withdraw your consent at any time, for anything based on consent
Lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC) in Bern, or your local EU authority

Write to privacy@estorya.com and we'll respond within thirty days. No form to fill in, no hoop-jumping.

05 — Security

Security

We use encryption in transit (HTTPS on every page), encryption at rest for our database, strong access controls on the admin side, and the principle of least privilege for everyone on the team. Incidents, if they happen, are reported to affected users and to the competent authority within the timeframes required by law.

06 — Children

Children

This site is not directed at children under 16. If you believe a minor has sent us personal data, write to privacy@estorya.com and we will delete it.

07 — Changes to this policy

Changes to this policy

We update this page when our practices change. The date at the top reflects the latest revision. Material changes are flagged on the home page for a few weeks after they go live.

Want a copy of your data, or just a plain answer?

Write to privacy@estorya.com. We read every message and reply personally — no ticketing system.

Email privacy@estorya.com →Read the cookie policy