Privacy policy

This policy covers the Cintaro Studio website, which presents products and provides contact options. It does not automatically cover future apps or games. Separate privacy information will be provided for those products where needed.

Last updated: 21 October 2026

1. Controller

Arian Kycyku, Cintaro Studio
Inzersdorfer Straße 114/3
1100 Vienna, Austria
Email: contact@cintarostudio.com

2. Website delivery and security

The website is hosted on Cloudflare Pages and delivered through Cloudflare’s network. The provider is Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA.

When you visit, Cloudflare processes data including your IP address, the time and destination of the request, technical browser and device details, response status and, where sent by your browser, the referring page. These data support content delivery, troubleshooting and protection against attacks. Cloudflare also provides aggregated server-side traffic and security statistics.

The legal basis is Article 6(1)(f) GDPR. The legitimate interest is the secure, reliable and functional operation of this website. Cintaro Studio does not maintain an additional visitor database.

Cloudflare acts as a processor when providing the service. Cloudflare also describes processing as an independent controller for certain purposes of its own, particularly network security. Details about recipients, subprocessors and retention are available in Cloudflare’s privacy policy and its Data Processing Addendum.

Cloudflare operates a global network. Processing outside the European Economic Area, particularly in the United States, is possible. For covered US transfers, Cloudflare provides for the EU-US Data Privacy Framework and, where required, EU Standard Contractual Clauses. The safeguards are described in the linked Data Processing Addendum.

Technical data are needed for delivery, troubleshooting, and preventing or investigating security incidents. Where Cloudflare retains end-user activity logs, it states a default retention period of seven days. This is not a single deletion period for all Cloudflare data: security incidents, legal obligations and non-personal aggregated statistics may involve different periods.

3. Cookies, analytics and external content

This website uses no advertising trackers or studio-integrated browser-based audience measurement. Cloudflare Web Analytics and Zaraz are disabled. Images and styling assets are served from this website’s own origin, and the typeface uses system fonts. No external videos, maps or social media feeds are embedded.

Cloudflare’s security features may occasionally trigger a security check and store or read technically necessary information on your device. After a successful check, the cf_clearance cookie may prevent repeated challenges. The configured validity of a completed challenge is 30 minutes; according to Cloudflare, the technical cookie lifetime may differ. Bot Fight Mode and Under Attack Mode are not enabled.

Access to your device without consent is permissible only where strictly necessary for transmission or for a service you explicitly request (Section 165(3) of the Austrian Telecommunications Act 2021). Associated processing for website security relies on the legitimate interest described above. See Cloudflare’s cookie documentation for further information.

4. Disabled contact form

The contact form is currently disabled. No form entries are collected or sent. Direct requests to the form endpoint are also rejected without processing messages.

This version does not load Turnstile form protection. The Resend email service and the Cloudflare D1 database prepared for the form are not used to process contact enquiries. Section 2 continues to apply to technical website requests.

You can contact the studio by email. Processing through Zoho Mail is described in the following sections.

5. Email contact and Zoho Mail

When you email contact@cintarostudio.com, the sender address, name where supplied, message content, attachments and technical delivery information are processed to handle your enquiry and related correspondence.

General enquiries are handled under Article 6(1)(f) GDPR. The legitimate interest is responding to questions about projects and collaborations. Where the enquiry concerns a contract or steps taken at your request before entering a contract, the basis is Article 6(1)(b) GDPR. Statutory retention requirements are based on Article 6(1)(c) GDPR.

The email service is Zoho Mail. Zoho identifies Zoho Corporation GmbH, Trinkausstr. 7, 40213 Düsseldorf, Germany, as the contracting entity for Austrian customers. Its EU data centres are operated by Zoho Corporation B.V., Beneluxlaan 4B, 3527 HT Utrecht, the Netherlands. The mail domain uses Zoho’s European mail servers.

Zoho and its subprocessors process messages to provide the mail service. European infrastructure does not rule out access by group companies or service providers outside the EEA, for example for support. Zoho describes safeguards including Standard Contractual Clauses. Information on recipients, transfers and obtaining a copy of the safeguards is available in Zoho’s privacy policy. Requests about the safeguards can also be sent to legal@zohocorp.com.

6. Retaining correspondence

The mailbox is reviewed regularly and correspondence that is no longer needed is deleted. General enquiries are removed after they have been resolved, once there is no further legitimate need. Not every email is retained for seven years.

If a message contains business or accounting records subject to statutory retention, the relevant legal period applies. For tax-related records this is generally seven years under Section 132 of the Austrian Federal Fiscal Code (BAO). Pending proceedings or the necessary establishment, exercise or defence of legal claims may require longer retention. Depending on the circumstances, the basis is Article 6(1)(c) or (f) GDPR. Copies in the mail provider’s backups follow its backup and deletion cycles and are not necessarily removed immediately when a message is deleted from the mailbox.

7. Providing data and automated decisions

Processing your IP address, in particular, is necessary to deliver the website. Contacting the studio is voluntary. A message and a working reply address are needed to respond meaningfully. There is no obligation to enter into a contract.

Cintaro Studio does not make solely automated decisions producing legal or similarly significant effects and does not carry out corresponding profiling. This is distinct from Cloudflare’s technical security checks described above.

8. Your rights

Subject to the GDPR’s conditions, you have rights of access, rectification, erasure and restriction of processing. Data portability applies where its legal conditions are met, particularly for automated processing based on consent or a contract.

Right to object: You may object to processing based on Article 6(1)(f) GDPR on grounds relating to your particular situation. Processing will then stop unless there are compelling legitimate grounds or grounds for the establishment, exercise or defence of legal claims.

Send requests about your data to contact@cintarostudio.com. Where processing relies on consent, you may withdraw it at any time with effect for the future.

You may lodge a complaint with a supervisory authority, particularly in the EU member state of your habitual residence, place of work or the alleged infringement. In Austria: Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, dsb@dsb.gv.at. See the authority’s complaint procedure (in German).