1. Who the controller is
Raze Studio ("we") is the controller of the personal data described in this policy. We are a software development studio based in Argentina.
For anything related to this policy, including exercising your rights, write to [email protected].
2. What this policy covers
This policy applies to this website (razeorg.dev) — an informational
landing page, with no user accounts and no private area.
Our products that do have registered users — such as otrolatido or vitral — carry their own policy, published inside each application. This page does not cover them.
3. What we process, and what for
| When | What | Why | How long |
|---|---|---|---|
| You visit a page | Page view, referrer, country, device and browser type. No cookies and no persistent identifier: we do not build a profile and do not track you across sessions. | Knowing which content works and which does not | Aggregate metrics, indefinitely; nothing individual |
| You book a call | Name, email address, time slot and whatever you type into the form | Scheduling and holding the meeting | For the duration of the business relationship, or until you ask for deletion |
| You email us | Your address, the message and any attachments | Replying and, where applicable, quoting the work | For the duration of the business relationship, or until you ask for deletion |
We run no advertising, we do not sell or share data with third parties, and we do not use your data to train models. We also make no automated decisions about people.
4. Legal basis
We process your data with your consent (when you email us or book a call) or because it is necessary to perform a contractual or pre-contractual relationship you initiated. Site analytics rests on our legitimate interest in understanding how the site is used, which is why it is deliberately reduced to aggregate, cookie-free data.
5. Where it is hosted
Our infrastructure runs on servers we rent from Hetzner, in Ashburn, United States. Site analytics (Umami) is self-hosted on that same infrastructure: events go to a machine of ours, not to a third party. That is a decision, not an accident — it is why we do not use Google Analytics.
The United States is not on the list of countries deemed adequate by Disposition 60-E/2016 of Argentina's data protection authority. We host our own data there, on infrastructure under our exclusive control, encrypted in transit, and we actively avoid handing personal data to third-party services established outside the country.
6. Third parties involved
They are the bare minimum, and each has a concrete job:
- Cloudflare — resolves DNS and reverse-proxies the site. It sees request IP addresses as part of protecting and routing traffic.
- Cal.com — the booking widget. Its script loads on every visit, so Cal.com sees your browser's IP address even if you never open it; form data is sent only if you book. Either way Cal.com's policy applies as well.
- Cloudflare Email Routing and Resend — carry mail to and from
[email protected].
7. Security
- All site traffic is encrypted over HTTPS/TLS, with forced redirection.
- Secrets and credentials live outside the code, with per-file restricted permissions.
- Infrastructure access is key-based, never password-based, and limited to the team.
- We keep encrypted backups of production data.
No system is infallible. If you spot a security problem, write to [email protected] and we will treat it as a priority.
8. Your rights
At any time and free of charge you can ask us to give you access to the data we hold about you, to correct it, update it or delete it. Just write to [email protected] from the address involved, or tell us how to verify your identity. We answer within the deadlines set by Argentina's Law 25.326: ten calendar days for access and five business days for correction or deletion.
The Agency for Access to Public Information, in its capacity as the supervisory authority for Law 25.326, is empowered to hear complaints and claims brought by anyone whose rights are affected by non-compliance with data protection rules in force.
9. Minors
This site and our internal tooling are not directed at children under 13, and we do not knowingly collect data from minors. If you believe a minor has sent us personal data, write to us and we will delete it.
10. Cookies
We set no first-party or third-party cookies for analytics or advertising. Visit measurement is aggregate and carries no persistent identifier, which is why there is no cookie banner: there is nothing to consent to. The one possible exception is the Cal.com widget, which loads on every visit and may use its own storage to function; that is described in its policy.
11. Changes to this policy
If anything material changes, we update this page and its last-modified date. The version in force is always the one published here.
12. Contact
Raze Studio — [email protected]