Privacy policy

POAP Studio is a creative technology studio based in Paris, France. We are the data controller for the personal data collected through this website.

This policy applies to the website poap.studio and its subpages. It does not cover the experiences we design for clients (event activations, claim pages, loyalty programs), which run under the client's own privacy terms and are described to participants at the point of use.

For any question about this policy or about your data, write to contact@poap.studio.

We collect the minimum needed to answer you and to keep the site running.

Contact form. When you use the form on our contact page, we receive the name, email address, company, service of interest, and message you type, plus the page you sent it from. This data is used solely to reply to your inquiry and, if we work together, to prepare a proposal. The legal basis is our legitimate interest in responding to a request you initiated, and then the performance of a contract.

Email. If you email us directly, we keep the correspondence for as long as needed to handle the conversation and any resulting project.

Technical logs. Our hosting provider records standard server logs (IP address, user agent, requested URL, timestamp) to deliver the site securely and to detect abuse. We also apply a short rate limit on the contact form, keyed on IP address and held in memory only for a few seconds.

poap.studio sets no advertising or analytics cookies, and does not use a consent banner because none is required.

Some case-study pages embed videos through YouTube's privacy-enhanced mode (youtube-nocookie.com), which only sets cookies if you play the video. Fonts are loaded from Google Fonts, which receives your IP address when the font files are requested. No data about your visit is sold or shared for advertising.

We rely on a small number of providers who process data on our behalf under contract.

Vercel hosts the website and the contact-form endpoint. Brevo delivers contact-form submissions to our inbox as transactional email. Google serves web fonts and privacy-enhanced video embeds. Each provider only receives the data required for its function, and some of them may process data outside the European Economic Area under standard contractual clauses.

Inquiries that do not lead to a project are deleted within 24 months of our last exchange.

When an inquiry becomes a client relationship, contact and contract records are kept for the duration of the engagement and then for the period required by French commercial and accounting law. Server logs are rotated automatically by our hosting provider and are not retained beyond their operational purpose.

Under the GDPR you can access, correct, delete, restrict, or export your personal data, and object to its processing.

To exercise any of these rights, email contact@poap.studio from the address you used with us. We answer within one month. If you believe we have not handled your data correctly, you may lodge a complaint with the French data protection authority, the CNIL (cnil.fr).

We may update this policy when our tools or practices change. The date at the top of this page reflects the latest revision.