Privacy policy
Last updated: 2026-10-04
Who we are
Oldtimer Studio (7 Agromec Str., Moara Vlăsiei, Ilfov 077130, RO) is the data controller for information collected through this website.
Contact: office@oldtimerstudio.com · +40 744 381 792
What we collect
- Contact & enquiry form submissions — the name, email address, phone number, subject, and message you voluntarily provide, together with your IP address and a timestamp.
- Part-enquiry submissions — the same fields plus the identifier of the part you enquired about.
- Server logs — standard web-server access logs (IP, user-agent, request URL, timestamp) retained for 30 days for security and abuse prevention.
- Cookies — see our Cookie policy for the full list. Advertising and analytics cookies (Google Ads, ChatGPT Ads, Microsoft Clarity) are set only if you accept them in the cookie banner.
- Where you came from — only if you accept advertising cookies: the channel that first brought you to the site in that browser session (for example a Google or ChatGPT ad, a search engine or another website), the campaign name and the page you landed on. It is kept in your browser for the session and sent with an enquiry, so we can see which advertising works.
We do not collect payment information through this site. Stripe is not currently active; if and when it is, Stripe becomes the payment-data controller under its own policy.
Why we process your data
| Purpose | Lawful basis |
|---|---|
| Responding to your enquiries, quoting, and fulfilling any contract | GDPR Art. 6(1)(b) — performance of a contract / pre-contractual steps |
| Keeping records for tax, warranty, and accounting | GDPR Art. 6(1)(c) — legal obligation |
| Preventing abuse, fraud, and attacks | GDPR Art. 6(1)(f) — legitimate interest |
| Optional marketing (newsletter, if you subscribe) | GDPR Art. 6(1)(a) — consent, withdrawable at any time |
| Measuring our advertising (Google Ads, ChatGPT Ads), showing our ads to past visitors, noting which channel brought an enquiry, and recording how the site is used (Microsoft Clarity) | GDPR Art. 6(1)(a) — consent via the cookie banner, withdrawable at any time under Cookie settings |
How long we keep it
- Contact form submissions: up to 5 years after the last interaction, or shorter if you ask us to delete them.
- Customer project records (restoration tracker, invoices, warranty): for the duration of the warranty period plus the statutory retention period required by Romanian tax law.
- Server logs: 30 days.
Who we share it with
We share data only with processors who help us run the business and have signed a data-processing agreement with us:
- Supabase (database + file storage hosting — EU region)
- Vercel (application hosting + cookie-less page-view analytics, including a count of visits that arrive from our ads (the ad channel, the pages viewed and whether the visit led to an enquiry) and of taps on our phone number or email address, nothing that identifies you)
- Google Workspace (email — sending our replies and confirmations to you, and receiving the emails you send us)
- Resend (newsletter audience management only, and only if you subscribe to the newsletter)
- Upstash (rate-limit counters keyed by IP address, used to prevent form abuse; kept only for minutes)
- Anthropic, via the Vercel AI Gateway — when you send an enquiry, the text you submit is processed by Anthropic's Claude model to prepare a short suggested reply for our team. A person always reviews and edits before anything is sent to you; your data is not used to train models.
- Spam and abuse prevention — to keep our contact forms usable we check the email address you submit (and, where available, the network address of the submission) against public spam-reputation services: CleanTalk, StopForumSpam and AbuseIPDB. Only the address is sent to them, never the content of your message. Submissions that are confirmed spam are filed and not answered.
- Meta / Instagram (only when you explicitly click social links; we never send your personal data to them from our server)
Google Ads — only if you accept advertising cookies. Google's tag then records which of our ads brought you to the site and whether you sent us an enquiry or tapped our phone number or email address, and adds your browser to our audience of site visitors so Google can show you our ads later on other sites and in search (remarketing). It uses cookies and your browser's details. Google processes this data under its own privacy policy.
ChatGPT Ads (OpenAI) — only if you accept advertising cookies. OpenAI's measurement pixel records whether a visit from one of our ads in ChatGPT led to an enquiry or a tap on our phone number or email address. OpenAI's automatic matching may read the email address or phone number you type into our forms and send it to OpenAI in hashed (one-way encrypted) form, to match the enquiry to the ad. OpenAI processes this data under its own privacy policy.
Microsoft Clarity — only if you accept cookies. Clarity records how you use our pages (clicks, scrolling, the pages you visit) as anonymised session recordings and heatmaps, so we can see where the site is unclear. What you type into forms is masked and never recorded. Recordings are tagged with the channel that brought you (for example an ad) and with whether you sent an enquiry. Microsoft processes this data under its privacy statement.
Choose Decline, or withdraw later under Cookie settings in the site footer, and none of these tags is loaded.
We do not sell personal data. We do not transfer it outside the EEA except to these listed processors under Standard Contractual Clauses.
Your rights
Under GDPR you can:
- Access a copy of your data
- Correct inaccurate data
- Delete your data ("right to be forgotten")
- Restrict or object to processing
- Port your data to another controller
- Withdraw consent for anything you consented to
- Complain to the Romanian supervisory authority — ANSPDCP (anspdcp.ro)
To exercise any of these rights, email office@oldtimerstudio.com. We respond within 30 days.
Children
This site is not directed at children under 16 and we do not knowingly collect data from them.
Changes
We may update this policy. Material changes will be flagged on the site. This version was last updated on 2026-10-04.