Privacy Policy

This policy explains how MOSS STUDIO (“we”) processes personal data when you visit mossstudio.ch or contact us.

The Swiss Federal Act on Data Protection (FADP / DSG, also called nFADP) applies. For visitors in the EU/EEA we also observe the principles of the GDPR where they apply to our processing. This page informs data subjects — it is not legal advice.

Controller: Sebastian Georgian Utoiu, trading as MOSS STUDIO (sole proprietorship / Einzelfirma, not entered in the commercial register) — Hauptstrasse 30, 4127 Birsfelden, BL, Switzerland — contact@mossstudio.ch

There is no formally appointed Data Protection Officer. Privacy requests go to the same contact.

What we collect and why

Contact form

When you submit the contact form we process the fields you enter:

Field	Required
Name	yes
Email	yes
Service interest	yes
Budget	depends on form variant (optional on the contact page)
Project stage / start timing	depends on form variant
Message	yes
Privacy acknowledgement	yes

Technical metadata needed for delivery and abuse prevention (e.g. timestamps, coarse connection data on the infrastructure) may be processed. A hidden honeypot field and rate limiting help reduce spam without asking you for extra content.

Purpose: respond to your enquiry and related correspondence.

Flow (simplified): browser → contact form on mossstudio.ch → server-side handling (Cloudflare Worker) → email delivery via Resend → inbox contact@mossstudio.ch.

Recipients: MOSS STUDIO (controller); Resend as processor for delivery; Cloudflare as infrastructure for the site and form endpoint.

Analytics: Form contents (name, email, phone, message, etc.) are not sent to Google Analytics or PostHog. After a successful send — only with Statistics consent and only on the production host — a technical conversion event without form payload may fire.

Retention (operations): We keep enquiries and related correspondence as long as needed to handle the request, then delete or archive them subject to legal retention duties. Precise internal timelines are proposed in internal ops notes and may still be confirmed by the operator/counsel.

Booking (Cal.com)

“Book a call” uses Cal.com. Cal.com’s privacy terms also apply. We receive the information needed to schedule the conversation.

Analytics (Statistics consent only)

With your consent in the Statistics category, on the production host mossstudio.ch we may process analytics as follows:

1. Google Analytics 4 (GA4) — understand traffic and improve the site. GA4 is loaded only through Google Tag Manager (GTM-P6S49Z6S) after Statistics consent, under Google Consent Mode v2 (analytics_storage). Google’s documentation states that IP addresses from EU/Switzerland/UK users are not logged/stored long-term (see Google Analytics Help). App-side conversion events are not sent without Statistics consent and not on non-production hosts (e.g. localhost).
2. PostHog (EU Cloud) — product/web analytics and session replay. Events go to the EU endpoint (eu.i.posthog.com). Session replay and click autocapture run only with Statistics consent; the contact form is excluded from autocapture; inputs are masked for replay. Conversion events contain no form PII.

Cookie/storage details: Cookie Policy.

Marketing tags (not actively loaded today)

Meta Pixel and Google Ads are disabled in the consent registry (enabled: false) while live measurement IDs are unset and until the channel is intentionally activated. TikTok and Pinterest tags are also disabled. When marketing tags go live, we will update this policy and the cookie inventory.

Embedded content

Third-party embeds (e.g. Google Maps) load only after consent to the Embeds category.

Planned audit tool (MOSS Check)

A planned audit tool may later process a URL you submit and related technical signals. Until launch, /moss-check is informational; this policy will be updated before go-live.

Processors and transfers

We use providers that process data on our instructions or as infrastructure. Transfers to third countries may occur depending on the provider; contractual or statutory safeguards (e.g. SCCs, Data Privacy Framework where the provider states so) are described in each provider’s documentation. We do not claim that all data stays exclusively in Switzerland or the EU.

Provider	Role for MOSS STUDIO	Short note
Cloudflare	DNS, CDN/proxy, site runtime (Workers), rate limiting, security	Global network; DPA / SCCs / DPF per Cloudflare
Resend (Plus Five Five, Inc.)	Sending contact-form email	May process in the United States (vendor statement); DPA / subprocessors per Resend
Google	GA4 (Statistics, after consent)	USA / global possible; Google Ads Data Processing Terms / Google Privacy; IP handling per Google Analytics Help
PostHog	Analytics & session replay (Statistics, after consent), EU Cloud	Primary storage in the EU (Frankfurt / AWS eu-central-1 per PostHog); DPA / subprocessors / DPF per PostHog
Cal.com	Appointment booking	Processing under Cal.com terms

Cookies and consent

Non-essential cookies and similar technologies load only after you consent via the cookie banner. Your choice is stored locally under moss-cookie-consent (versioned, 12-month TTL). Withdraw or change: Cookie Policy and Cookie settings in the footer.

Retention (overview)

Purpose	Approach
Cookie consent	12 months (then re-prompt)
Contact enquiries	as long as needed to handle / correspond, then delete/archive
Email delivery (Resend)	per Resend documentation and operational need
Analytics / replay	per provider and project settings; withdrawable via cookie settings
Infrastructure / security logs	as short as practical for operations and abuse prevention

Your rights

Under Swiss FADP (and GDPR where applicable) you may request access, rectification, erasure, restriction, and — where provided by law — data portability. Complaints: FDPIC (Switzerland) or your local EU authority.

Privacy contact: contact@mossstudio.ch (subject: Privacy) — same address as above.

Changes

We update this policy when our processing changes. The “Last updated” date on this page is authoritative.