Privacy policy.

1. Data we process

• Contact data — your name, email and anything you choose to tell us when you reach out.
• Project materials — the product images, brand assets and briefs you send us for a project.
• Correspondence — the emails and messages we exchange about your project.
• Payment data — payment status, checkout metadata and invoice details processed when you pay through Stripe Checkout or invoices. We do not receive or store full card numbers.
• Technical data — basic server logs our host keeps to run and secure the website.
• Aggregated analytics — anonymous, cookieless usage measurement (see “Analytics” below).

This website has no accounts and no sign-up. We hold what you send us directly, limited payment and invoice records, plus anonymous usage statistics.

2. Why we process it

To respond to your enquiry and to scope, produce and deliver the work you ask for (performance of a contract or pre-contractual steps), to run and secure the website (our legitimate interest), and to comply with legal obligations such as keeping invoices. Where we rely on your consent, you may withdraw it at any time.

3. Service providers

We rely on a small number of providers who process data on our behalf under appropriate agreements — principally our website host and the AI and creative tools we use to produce the work. Payments are processed by Stripe. Some providers may process data outside the EU under suitable safeguards. We do not sell your personal data, and there is no advertising network involved in this website.

4. Analytics

We use a third-party, privacy-friendly analytics provider to measure how the site is used. It is cookieless: it collects aggregated, anonymous statistics (such as page views and approximate country) without setting cookies, storing identifiers on your device, or building a profile of you. Our legal basis is our legitimate interest in understanding and improving the site. Because it stores nothing on your device, it does not require a consent banner.

5. Retention

We keep project materials and correspondence for as long as needed to deliver the work and for a reasonable period afterwards, then delete or archive them. We keep invoicing records for as long as the law requires. You can ask us to delete materials we no longer need.

6. Your rights

Under the GDPR you may request access, rectification, erasure, restriction and portability, and you may object to certain processing. To exercise these rights, contact abrar@phantomz.fr. You also have the right to lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr).

7. California & US users

If you are in the United States, including California, you may have rights to know about, access and delete personal information. We do not sell or “share” personal information. Contact us at the address above to exercise these rights.