Privacy Policy

1. Who is responsible for your data

Ovout Studios (“we”, “us”) decides what happens to the personal data described on this page, which makes us the controller of it.

The way to reach us about anything here — including a request to see, correct or delete your data — is [email protected]. We read that address and we reply on it.

Our full legal identity and place of establishment are available on request at that address. Ask and we will tell you. We do not publish them here because a one-person studio’s registered details are a home address until the company is incorporated, and putting that on a public page protects nobody.

2. What this policy covers

It covers this website (ovout.net) and the quote form on it, our Discord server including commission tickets, email to [email protected], and our Minecraft build server when we invite you onto it to see your commission.

It does not cover what another company does with your data on its own platform. When you use Discord, or buy a listing on a marketplace, that company handles your account under its own privacy policy and we have no control over it.

3. What we collect, and why

The quote form

Your name, a contact (an email address or a Discord handle — you choose which), the project scope you pick, an optional budget range, your brief, and an optional note about your deadline.

We use it to reply with questions and a quote. There is no account, no password, and no profile behind the form. Submissions are delivered to a private channel on our Discord that only the Studio can see.

The anti-spam check on that form

When you submit the form, your IP address is checked by Cloudflare Turnstile to confirm you are a person rather than a bot, and is used to stop the same address submitting over and over.

We do not store your IP address. It is held for the length of the request and then it is gone — there is no database behind this site to put it in. What is kept alongside your message is the two-letter country code Cloudflare derives from the address, and the page you submitted from: enough to recognise a spam wave, not enough to identify you.

Discord tickets

If you open a ticket, we see your Discord username and user ID because you are in our server, and we see whatever you send in the ticket.

We may keep a transcript of a closed ticket, because it is the record of what was agreed. Ask us and we will delete it.

Your Discord account itself is Discord’s, not ours. What you have set on your profile, and what Discord knows about you, is covered by Discord’s own privacy policy.

Email

If you write to us, we keep the correspondence as a record of what was said, for as long as section 8 allows.

Payment

We never see your card details. Payment is handled by the payment provider named on your invoice, which collects your payment details directly under its own privacy policy. What reaches us is confirmation that a payment was made and the invoice record that goes with it.

Our build server

If we invite you onto our Minecraft server to walk through your commission, the server records your Minecraft username, your account UUID and the IP address you connect from — in its logs and its player data, the same as every Minecraft server does. We use it to run the server, to give you access to your own build and not to anyone else’s, and to know who changed what in a world.

Analytics

We use Cloudflare Web Analytics: which page was viewed, where the visit came from, the country, and the browser and device type, in aggregate.

It uses no cookies and no client-side storage, and does no fingerprinting. It cannot tell us who you are, and it cannot tell us that the same visitor came back. We use it to know which pages people actually read.

4. Cookies

This site sets no advertising or tracking cookies, and that is why there is no cookie banner on it. A banner here would be theatre: it would interrupt you without protecting you from anything.

• Our analytics is cookieless by design. There is nothing to consent to.
• The only cookies that can appear are strictly necessary security cookies set by Cloudflare, which hosts and protects the site, to keep it available and to tell people from bots. They carry no advertising and are not used to build a profile of you. Under EU and UK rules, cookies that are strictly necessary for a service you asked for do not require consent.
• The site stores nothing in your browser of its own — no localStorage, no sessionStorage, no local profile.

You can block or delete cookies in your browser settings. Blocking the security cookies may mean the form’s bot check cannot complete, in which case you can still reach us by email or on Discord.

If we ever add something that is not strictly necessary — an advertising pixel, an embed that tracks you, analytics that follows you between sites — we will ask for your consent before it loads, and this section will say so.

5. Why we are allowed to use it

Under the GDPR and the UK GDPR, everything we do with your data rests on one of these:

• To answer your enquiry and run your commission — because it is necessary to perform our contract with you, or to take steps at your request before entering one.
• To keep the site up, block spam, and protect our server and our clients’ builds — our legitimate interests in a service that works and is not abused. The data involved is minimal and short-lived, which is how we keep the balance on your side.
• To keep invoices and commission records — a legal obligation under tax and accounting rules, and our legitimate interest in being able to answer a claim.

We do not rely on your consent for anything on this site today, because nothing here needs it. If that ever changes we will ask you first, and you will be able to say no.

6. Who else sees it

• Cloudflare — hosts the site, serves it, provides the analytics and the anti-bot check.
• Discord — hosts our server, our tickets, and the private channel your form submission is delivered to.
• The payment provider named on your invoice — takes the payment.
• A marketplace such as BuiltByBit, if you buy a Build Shop listing there. That purchase is theirs, under their terms, and they are the ones holding your payment and account data.
• A collaborating builder assigned to your commission, who sees the brief and your feedback because they cannot build without them. Every collaborator works under a written contract with us that binds them to confidentiality and forbids using your material for anything else. They do not get your contact details unless you deal with them directly.

That is the whole list. We do not sell personal data, we do not share it for advertising, and we do not use it to profile you or to make automated decisions about you.

We would disclose data where the law actually requires it — a valid legal order — and not otherwise.

7. Where your data is processed

Ovout Studios is established, and processes your data, outside the European Economic Area and the United Kingdom. Details of our place of establishment are available on request at [email protected].

Our providers are global: Cloudflare and Discord are established in the United States and move data across borders under their own transfer arrangements, which their privacy policies set out.

So if you are in the EEA or the UK, sending us a brief means your data travels to a country whose data protection rules may not be the same as yours. We keep what we hold to the minimum, we protect it as described here, and you can have it deleted at any time by writing to us.

8. How long we keep it

• Enquiries that do not become commissions — deleted within 12 months.
• Commission records (the brief, the agreed scope, the correspondence, the invoices) — kept while the commission and its six-month warranty are live, and after that for as long as we may need them to answer a claim or to meet tax and accounting rules.
• Ticket transcripts — deleted on request; otherwise they are kept as part of the commission record above.
• Build server logs and player data — while your access lasts, and a short period after it ends.
• Analytics — aggregate only and never linked to you; Cloudflare’s own retention applies.

Where we cannot give you a fixed number, the rule we apply is the same: we keep data only while it still serves the purpose it was collected for, and delete it once it does not.

9. Your rights

If the GDPR or the UK GDPR applies to you, you have the right to:

• ask for a copy of the personal data we hold about you;
• have it corrected if it is wrong;
• have it deleted;
• restrict or object to how we use it, including anything we do on the basis of legitimate interests;
• receive it in a portable form, where it was given to us for a contract;
• withdraw consent, for anything we ever do on that basis.

To use any of them, write to [email protected] and say what you want. It is free, and we reply within one month. We may ask you to send the request from the email address or the Discord account we already hold for you — usually that is all it takes to know it is really you.

You can also complain to your local data protection authority in the EEA or the UK. We would rather you came to us first, but that route is yours and we will not stand in the way of it.

You do not have to give us any of this. But if you do not tell us how to reach you, we cannot send you a quote.

10. Children

This site is not directed at children under 13, and we do not knowingly collect their data.

Commissioning a build is a contract. If you are below the age at which you can enter one where you live, an adult has to deal with us on your behalf. If you believe a child has given us personal data, write to us and we will delete it.

11. How we protect it

The site is static and served over HTTPS. The one server-side piece — the form handler — holds no database, so there is nothing there to breach. Secrets live outside the code. Form submissions land in a channel only the Studio can open, and collaborators are bound in writing before they see anything of yours.

No one can honestly promise perfect security, and we will not. What we can say is that we hold very little, we hold it for a limited time, and we can delete it when you ask.

12. Changes to this policy

Every version has a version number and an effective date, and older versions stay online at their own address. When a change is material we will say what changed rather than quietly reissue the page.

Unlike our Commission Terms, this policy is not frozen at the version in your quote: the current version describes what we actually do with data from its effective date.

13. Contact

Write to [email protected] — for a data request, for a question about this page, or to ask who we are.

For a commission in progress, a ticket in our Discord is faster.