Privacy policy.
Updated: 9 October 2026
Controller
Alexander Maag, Zürich, Switzerland, telephone +41 76 804 74 18. You can currently use the contact form or call for privacy enquiries. A complete postal address and dedicated contact email still need to be added.
Scope & purposes
This policy describes the portfolio, contact form, newsletter registration and private studio. Personal data is processed to deliver the website, answer enquiries, manage requested updates and protect the studio. Swiss data protection law applies; where applicable, the GDPR also applies.
Contact enquiries
When you send an enquiry, your name, email address, message and submission time are stored in the private studio inbox so Alexander Maag can read and respond. Do not include sensitive information unless it is necessary for your enquiry. Processing serves your request and, where applicable, steps before entering a contract (GDPR Art. 6(1)(b)) or legitimate interests in handling correspondence (Art. 6(1)(f)).
Newsletter registration
Newsletter registration is optional and separate from an enquiry. Your email address, submission time and consent statement are stored when you explicitly subscribe. No mailing service or automated newsletter delivery is currently connected. Any future delivery must provide an unsubscribe option and only use confirmed registrations. You can withdraw your registration by contacting Alexander Maag. Where applicable, the basis is consent (GDPR Art. 6(1)(a)).
Local storage & cookies
This website uses browser storage, not advertising cookies. am-language stores your selected language; am-privacy-v1 stores your privacy choice until you change it or clear browser data. am-owner excludes the studio owner from analytics. Studio sign-in stores authentication information to maintain a secure login. Essential storage is not used for advertising.
Optional analytics
Without permission, the website only counts anonymous page views (device category, referring hostname and campaign tags; no identifier, no storage, no IP address) so the operator sees accurate visitor numbers (legitimate interest, GDPR Art. 6(1)(f)). Only after permission, the website records visits, project openings, contact openings and successful enquiry or newsletter submissions, with a random session identifier (am-session in sessionStorage), referring hostname, campaign tags, device category, browser language and time zone. Message contents and email addresses are not sent to analytics. The application does not add IP addresses to analytics records; hosting providers still receive connection information when delivering the site. Permission can be withdrawn using Privacy settings. The session identifier is removed on withdrawal; browser session storage normally ends when the tab is closed. Where applicable, processing is based on consent (GDPR Art. 6(1)(a)).
Hosting, media & recipients
Lovable and the connected cloud infrastructure deliver this website, media and database services. Requests necessarily transmit connection information such as IP address, requested resource and browser information to the relevant providers. Access to enquiry contents is restricted to the studio administrator through application access controls. Fonts are hosted with the website rather than loaded from Google Fonts. No Google Analytics, Meta Pixel or external video player is configured in the application. Provider processing locations, contractual safeguards and operational log retention must still be confirmed by the operator before this policy is finalised.
Retention & security
Enquiries are kept for as long as needed to handle the conversation and any resulting business relationship, subject to applicable statutory retention duties. Newsletter registrations are kept until withdrawn or no longer needed. Stored analytics events are not automatically deleted by the current application; a retention and deletion schedule must still be set by the operator. Browser storage can be cleared in your browser. Access controls and encrypted connections help protect data, but no online service can guarantee absolute security.
Your rights
Depending on applicable law, you may request access, correction, deletion, restriction or portability of your personal data and object to certain processing. You may withdraw consent for future processing at any time. Contact Alexander Maag by telephone or the contact form. You may also contact the Swiss Federal Data Protection and Information Commissioner (FDPIC) or the competent supervisory authority in your country. Identity verification may be necessary before disclosing personal data.