Privacy Policy

1. Who is responsible

The controller of your personal data is [Legal entity — to be confirmed] (“msmm”, “we”). Contact for anything in this policy, including requests about your data: info@neuromancer.studio.

2. What we collect

• Proposals (clients): your name, email, company if given, project type, scope, budget, timeline, any creatives or projects you selected, and anything you write in the brief.
• Applications (creatives): your name, email, location, disciplines, rates, portfolio links and the files you upload, and anything you write in the application.
• Sign-in (invited users): your email address, used to send you a one-time sign-in link, and the session needed to keep you signed in.
• Payments: handled by Stripe. We receive the payment status, amount and the billing details Stripe passes to us. We never see or store card numbers.
• Correspondence: messages you send us by email.
• Technical data: IP address, browser and device information in server logs and bot-protection signals (Vercel BotID), processed to run and protect the site.
• Analytics (only if you accept): pages viewed and actions taken, via Google Analytics 4. No analytics runs if you decline.

3. Why we use it, and our legal basis

• To read your proposal or application, match you, and coordinate the work: performance of a contract or steps you ask us to take before one (GDPR Art. 6(1)(b)).
• To sign you in, take payment and keep records: contract and legal obligations such as tax and accounting (Art. 6(1)(b) and (c)).
• To keep the site secure and prevent abuse and spam: our legitimate interest (Art. 6(1)(f)).
• To measure how the site is used: your consent (Art. 6(1)(a)), which you can withdraw at any time.

We do not sell personal data, and we do not use it for advertising or automated decisions that significantly affect you.

4. Who receives it

msmm matches and coordinates; clients and creatives do not receive each other's contact details directly. What we share:

• With the creatives you select or we match you with: the content of your proposal needed to quote the work. With clients: a creative's approved profile and quote.
• Supabase: database and private file storage, hosted in the EU (Frankfurt), and email sign-in.
• Vercel: hosting, delivery and bot protection.
• Stripe: payments (Payment Links at launch, Stripe Connect payouts later).
• Our email provider: delivery of notifications and sign-in emails to and from info@neuromancer.studio.
• Google (Analytics 4): only if you accept analytics.
• Professional advisers, and authorities where the law requires it.

These providers act as processors under our instructions, except Stripe, which also acts as an independent controller for payment compliance.

5. Transfers outside your region

Proposals and applications are stored in the EU. Some providers (Vercel, Stripe, Google) may process data outside the EU/EEA, including in the United States. Where they do, we rely on adequacy decisions or the European Commission's Standard Contractual Clauses.

6. How long we keep it

• Declined proposals: 12 months, then deleted.
• Stale proposals (no activity): 24 months, then deleted.
• Declined creative applications: 12 months, then deleted.
• Accepted creatives: for as long as you are on the roster; your profile can be removed on request.
• Payment and accounting records: as long as tax and accounting law requires.
• Analytics data: according to the retention setting of our Google Analytics property.

You can ask us to erase your data earlier at info@neuromancer.studio.

7. Your rights

You can ask us to access, correct, erase or restrict the use of your personal data, to receive it in a portable format, and to object to processing based on legitimate interests. Where we rely on consent you can withdraw it at any time. Email info@neuromancer.studio; we reply within one month. Erasure is free and on request.

You can also complain to a data protection authority. Competent authority: [Data protection authority — depends on the legal entity].

8. Cookies and local storage

• Strictly necessary: a session cookie that keeps invited users signed in, and a language preference. These need no consent.
• Your cookie choice: stored in your browser (local storage) so we do not ask again.
• Analytics: Google Analytics 4 sets cookies only after you accept. Until then it is not loaded at all. Declining removes its cookies.
• Your browser may also keep an unsent form draft for the current tab only.

9. Security

Data is encrypted in transit, files are held in private storage, and access is restricted to the people who need it. No system is perfectly secure; if a breach affects you, we will notify you and the authority as the law requires.

10. Age

msmm is for professional use and is not directed at anyone under 18.

11. Changes

We may update this policy. The date above shows the latest version; material changes will be flagged on the site.