Privacy Policy

01. Who we are

ExoScrum (“ExoScrum”, “we”, “us”) is a digital design and development studio. This policy explains what personal information we collect through exoscrum.com (the “Site”), how we use it, and the choices you have.

For any privacy question or request, contact us at hello@exoscrum.com.

02. Information we collect

The Site has no account system, no contact form and no advertising or analytics trackers. We collect only what is described below.

• Information you send us. If you email, call or message us on WhatsApp, we receive your contact details and whatever you choose to share, such as your name, company, project brief and files.
• Technical data. Our hosting provider automatically processes standard server logs when you visit, including your IP address, browser and device type, pages requested and timestamps. We use this to deliver, secure and troubleshoot the Site.
• Local session data. The Site stores a single flag in your browser’s session storage to remember that you have already seen the intro animation. It contains no personal information and is cleared when you close the tab.

03. How we use information

• To respond to enquiries and provide proposals or services you request.
• To operate, secure and improve the Site.
• To meet legal, accounting and contractual obligations.
• To send project-related communications. We do not send marketing email unless you ask us to.

04. Legal bases

Where data protection law such as the GDPR or UK GDPR applies, we rely on: your consent (when you contact us); our legitimate interests in running and securing the Site and responding to enquiries; performance of a contract or steps before entering into one; and compliance with legal obligations.

05. Third parties and service providers

We do not sell your personal information or share it for cross-context behavioral advertising. We use a small number of providers to run the Site and communicate with you:

• Hosting and delivery: Vercel Inc., which serves the Site and processes server logs.
• Fonts: Google Fonts, which serves typefaces directly from Google’s servers. Your browser sends your IP address to Google when loading them. See Google’s privacy policy for details.
• Messaging: WhatsApp (Meta), if you choose to message us there. Your use of WhatsApp is governed by its own terms and privacy policy.
• Email and telephony providers that carry the messages you send us.

06. International transfers

Our providers may process data in countries other than your own, including the United States. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses.

07. Retention

We keep enquiry correspondence for as long as needed to respond and, if we work together, for the life of the engagement plus the period required for legal, tax and accounting purposes. Server logs are retained by our hosting provider for a short, limited period. When information is no longer needed, we delete or anonymize it.

08. Security

We use reasonable technical and organizational measures to protect personal information, including encrypted connections (HTTPS) and access controls. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. To report a vulnerability, see our security contact at /.well-known/security.txt.

09. Your rights

Depending on where you live, you may have the right to access, correct, delete or export your personal information, to object to or restrict certain processing, to withdraw consent at any time, and to lodge a complaint with your local data protection authority. California residents have rights under the CCPA/CPRA, including the right to know, delete and correct, and the right not to be discriminated against for exercising them. We do not sell or share personal information as those terms are defined under California law.

To exercise any of these rights, email hello@exoscrum.com. We may need to verify your identity before acting on a request and will respond within the time required by applicable law.

10. Children

The Site is not directed to children under 16, and we do not knowingly collect their personal information. If you believe a child has contacted us, email us and we will delete it.

11. Changes to this policy

We may update this policy from time to time. The “Last updated” date above shows when it last changed. Material changes will be highlighted on the Site.