Privacy Policy
This document is a starting template provided by the studio. It is not legal advice. Please review with a qualified privacy professional before relying on it for compliance.
1. Who we are
This privacy policy applies to lisasobacca.art and the services offered through it. The site and services are operated by Velzie LLC, a limited liability company formed under the laws of the State of Wyoming, United States, doing business as “Lisa Sobacca” (the “Studio,” “we,” “us”). For the purposes of the EU and UK General Data Protection Regulations (“GDPR” and “UK GDPR”), we act as the data controller of personal data described in this policy. You can contact us at yely@lisasobacca.art.
2. What we collect
- Contact form. When you submit the contact form on the About page, we collect your name, email address, optional subject, and message. The submission is stored in our database.
- Payments. If you commission work, payments are processed through Stripe. Stripe collects information needed to complete the transaction, including billing name, email, billing address, country, and payment-method details. We receive a transaction reference and the metadata we ourselves attach to the charge (for example, project name); we do not receive or store full card numbers.
- Email correspondence. Anything you send to yely@lisasobacca.art is received via standard email and stored in the corresponding mailbox.
- Analytics. The site loads Google Tag Manager and Google
Analytics (container
GTM-MP7FMP8K), which collect standard usage data such as pages viewed, approximate location derived from IP, device and browser type, referrer, and on-site interactions. - Anti-spam. The contact form uses Google reCAPTCHA. When you submit the form, Google receives standard reCAPTCHA telemetry to assess whether the request is automated.
- Server and security logs. Our hosting provider (Cloudflare) may log request metadata including IP address, user-agent, and timestamps for security, abuse prevention, and operational purposes.
3. Why we collect it
- To respond to your enquiries and discuss potential commissions.
- To deliver commissioned services and process payments.
- To prevent spam, fraud, and abuse of the site.
- To understand how the site is used and to improve it.
- To comply with our legal, tax, and accounting obligations.
4. Legal bases (GDPR / UK GDPR)
Where the GDPR or UK GDPR applies, we rely on the following legal bases:
- Performance of a contract — processing your name, contact details, and payment information to take a booking, deliver the work, and handle invoicing.
- Legitimate interests — basic site analytics, security logging, and spam prevention, balanced against your rights and freedoms.
- Consent — where required by your jurisdiction (for example, certain analytics or marketing cookies). The site does not currently implement a granular cookie-consent banner; if you live in a jurisdiction requiring opt-in consent and would prefer not to be tracked while we work on this, please use your browser’s privacy controls or contact us to request that we remove your data.
- Legal obligation — retaining transaction records as required by tax and accounting law.
5. Sharing and sub-processors
We do not sell personal data. We share data only with the service providers we use to run the site and the business:
- Stripe — payment processing. stripe.com/privacy
- Resend — transactional email (contact-form notifications, order receipts, project updates). resend.com/legal/privacy-policy
- Cloudflare — hosting (Workers), image storage (R2), and DNS. cloudflare.com/privacypolicy
- Google — Tag Manager, Analytics, reCAPTCHA, and Fonts. policies.google.com/privacy
We may also disclose data where required by law, to enforce our Terms, or to protect the rights, property, or safety of the Studio, our clients, or others.
6. International data transfers
The Studio is based in the United States, and several of our sub-processors host or process data in the United States and other countries. Where we transfer personal data of individuals located in the EEA, the UK, or Switzerland to a country that has not received an adequacy decision, we rely on appropriate safeguards such as Standard Contractual Clauses or equivalent mechanisms put in place by our sub-processors.
7. Retention
- Contact-form submissions are retained while reasonably needed to respond to your enquiry and for a limited period afterwards in case you follow up.
- Project records and invoices are retained for the period required by U.S. tax and accounting law (typically up to seven years).
- Analytics data is retained according to Google’s default retention settings.
- Server logs are retained for a short rolling window for security and operational purposes.
You can request earlier deletion of your data at any time, subject to records we are legally required to keep.
8. Marketing
The Studio does not currently send marketing emails or operate a newsletter. Email sent to clients is transactional — for example, replies to enquiries, project updates, and Stripe receipts. If we introduce optional marketing communications in the future, we will only add you to such a list with your prior consent, and every marketing email will include an unsubscribe link.
9. Your rights
9.1 GDPR and UK GDPR
If you are in the EEA, the UK, or Switzerland, you have the right to:
- Access the personal data we hold about you;
- Have inaccurate data corrected;
- Request erasure of your data;
- Restrict or object to certain processing;
- Receive your data in a portable format;
- Withdraw consent at any time, where processing is based on consent;
- Lodge a complaint with your local data-protection supervisory authority.
9.2 California (CCPA / CPRA)
If you are a California resident, you have the right to:
- Know what personal information we collect, use, disclose, and (if applicable) sell or share — we do not sell or share personal information for cross-context behavioral advertising;
- Request deletion of your personal information;
- Request correction of inaccurate personal information;
- Limit use and disclosure of sensitive personal information (we do not knowingly use sensitive personal information for purposes beyond those necessary to provide our services);
- Be free from retaliation or discrimination for exercising your privacy rights.
9.3 How to exercise your rights
Email yely@lisasobacca.art with the request and enough context that we can identify you in our records. We may need to verify your identity before acting on the request. We will respond within the timeframes required by applicable law. You may also authorize an agent to make a request on your behalf, subject to verification.
10. Children
The site and our services are directed to adults. We do not knowingly collect personal data from children under 13 (or under 16 in the EEA and UK). If you believe a child has provided us with personal data, please contact us and we will delete it.
11. Cookies and similar technologies
The site sets and reads cookies for the following purposes:
- Essential — required for the site to function and for security (set by Cloudflare).
- Analytics — cookies set by Google Analytics / Tag Manager to measure site usage.
- Anti-spam — cookies set by Google reCAPTCHA on pages that include the contact form.
You can use your browser settings or extensions to block or delete cookies. Blocking essential cookies may break parts of the site.
12. Security
We use industry-standard measures, including TLS encryption in transit and access controls, to protect personal data. No method of transmission or storage is 100% secure; we cannot guarantee absolute security, but we will notify affected users of any data breach as required by applicable law.
13. Changes to this policy
We may update this policy from time to time. The “last updated” date at the top of this page reflects the most recent revision. Material changes will be highlighted on this page. Continued use of the site after an update constitutes acceptance of the updated policy.
14. Contact
Questions, concerns, or rights requests can be sent to
yely@lisasobacca.art.
Velzie LLC · State of Wyoming, United States.