PRIVACYPolicy

We design and engineer digital systems under an uncompromising commitment: zero third-party surveillance, complete data minimization, and total client ownership.

Data Controller & Identity

This Privacy Policy defines how Strelm processes and protects information gathered through strelm.dev and our engineering engagements under EU GDPR & international standards.

GDPR Art. 4(7)·Direct Controller·Zero Data Brokers

Registered Entity: Strelm Studio (Sole Proprietorship)

Lead Data Protection Officer: contact@strelm.dev

Primary Operating Domain: https://strelm.dev

Data Minimization Principle

Under GDPR Article 5(1)(c), we operate on strict data minimization. We only collect details that are strictly indispensable to evaluate projects and deliver engineering sprints.

GDPR Art. 5(1)(c)·Strict Necessity Only·Zero Web Scraping

Project Inquiries: Name, work email, budget, and architecture brief

Direct Consultations: Meeting slot coordinated via Cal.com

Zero Surveillance: No credit card data, biometrics, or ad tracking

Legal Bases for Processing

Every byte of data processed by Strelm rests on a verified statutory legal basis under GDPR Article 6, ensuring lawful, ethical, and transparent operations.

GDPR Art. 6·Explicit Consent·Contract Performance

Explicit Consent (Art. 6(1)(a)): Opt-in brief submissions

Contract Steps (Art. 6(1)(b)): Scoping, SOW execution & sprints

Legitimate Interest (Art. 6(1)(f)): Infrastructure security defense

Zero Third-Party Advertising

Strelm does not sell, rent, or trade client information to data brokers, ad networks, or commercial telemarketers. We deploy zero cross-site ad pixels.

Zero Ad Pixels·No Meta Pixel·No Google Ads Tracker

Meta & TikTok Pixels: 0 deployed across all domains

Advertising Cookies: Zero cross-site tracking or retargeting

Confidentiality: All client project details sealed under NDA

Infrastructure & Subprocessors

We select strictly essential, privacy-hardened infrastructure providers to host our web application, dispatch confirmation emails, and coordinate calendars.

Vercel Cloud·Resend API·Cal.com Sandboxed·Cloudflare WAF

Application Hosting: Vercel Inc. (Edge CDN & Serverless)

Transactional Delivery: Resend Inc. (TLS Inquiries)

Session Scheduling: Cal.com Inc. (Sandboxed Iframe)

Retention & Security Standards

We do not hoard client communication. Project inquiries and telemetry are stored with strict expiration limits and automatically deleted.

30-Day Purge·SOW Retention·TLS 1.3 Preloaded·AES-256

Unconverted Inquiries: Auto-purged after 30 business days

Contract Deliverables: Retained for statutory tax/warranty period

Encryption: Mandatory TLS 1.3 in transit and AES-256 at rest

Your Statutory Rights (GDPR & CCPA)

Under GDPR Chapter III and the CCPA/CPRA, you possess comprehensive rights over your personal data, enforceable on demand free of charge.

GDPR Chapter III·CCPA/CPRA·Free of Charge·48h SLA

Right of Access (Art. 15): Full machine export within 14 days

Right to Rectification (Art. 16): Instant correction of records

Right to Erasure (Art. 17): Permanent wipe executed on demand

Direct Legal Contact Desk

All updates published with semantic versioning. For privacy inquiries, mutual NDAs, or DPO requests, reach out directly to our founding team.

Direct Founder Desk·Mutual NDA Available·24h Response

Direct Legal Desk: contact@strelm.dev

Consultation: Book Discovery Call with Founding Team

Current Specification: v2.4 (Effective October 2026)