Privacy Policy & Data Rights Charter

Effective Date. This Privacy Policy took effect and was verified on 2026-11-11. All data collected by Omelvix from that date forward is managed under the terms stated herein.

Data Controller. The data controller operating this website is Omelvix, trading at omelvix.com. Our physical studio is located at 1201 Northwest Irving Street, Portland, Oregon 97209, Portland, Oregon, United States. We can be reached directly by telephone at +1 (324) 555-2313 or by electronic mail at [email protected].

Categories of Data Collected. We collect information you transmit directly when requesting a consultation via our intake form (`ladu729.php`): full name, telephone number, email address, practice address, project track, scope notes, configuration specification, and your consent confirmation. Our live advisory desk (`buwe786.php`) retains conversation messages and an encrypted browser token. Automatically recorded technical data includes IP addresses, browser user-agent strings, referring URLs, page render timestamps, and campaign click identifiers attached to incoming traffic links. We store no account passwords, issue no consumer accounts, and process no credit card or financial billing numbers on this website.

Purposes of Processing. Collected data is processed exclusively to evaluate prospective client scopes, prepare fixed proposals between $5,000 and $20,000 USD, schedule consultations at our Portland studio or over teleconference, verify server and firewall integrity, prevent fraudulent form submissions, attribute paid search clicks to legitimate inquiries, and manage cookie consent preferences.

Legal Bases for Processing. Under applicable statutory regulations, our processing operations rest upon defined legal bases: (a) Consent, provided by affirmative tick box before inquiry dispatch or banner interaction; (b) Pre-contractual steps taken at your request, including drafting structural site blueprints and timeline estimates; (c) Legitimate interests, specifically securing our web server infrastructure against denial-of-service attempts and verifying paid advertising campaign performance.

Advertising Platforms & Click Identifiers. This website receives live traffic from paid advertising. Specifically, Google Ads, Microsoft Advertising and Meta Ads run traffic to it. Incoming visitor links carry campaign click identifiers: gclid for Google Ads, msclkid for Microsoft Advertising, and fbclid for Meta Ads. These parameters allow our studio to evaluate landing page relevance, keyword attribution, and inquiry volume without constructing persistent cross-site behavioral profiles. Neither Google Ads, Microsoft Advertising nor Meta Ads has reviewed, endorsed, or approved this website or its services.

Consent Mode v2 Integration. We enforce Google Consent Mode v2 across all pages. Four discrete signals—ad_storage, ad_user_data, ad_personalization, and analytics_storage—are held denied by default upon visitor arrival. No measurement scripts or pixels read or write local storage keys until the visitor allows storage via our consent panel. When the visitor declines or withdraws storage permission, all four signals are set back to denied immediately.

Third-Party Data Processors. Data is shared only with verified infrastructure vendors necessary to operate our practice: (a) Google LLC / Google Ireland Ltd for Google Ads measurement and Consent Mode processing; (b) Microsoft Ireland Operations Ltd for Microsoft Advertising, whose handling of telemetry data is governed by the Microsoft Privacy Statement available at privacy.microsoft.com; (c) Meta Platforms Ireland Ltd for Meta Ads attribution where active; (d) Our secure United States hosting provider running PHP/Nginx infrastructure; (e) Our authenticated mail transport provider routing incoming inquiries directly to [email protected].

International Data Transfers. Omelvix is located in Oregon, United States. When visitors outside the United States access omelvix.com or transmit consultation forms, data is transferred directly to servers located within the United States. Such transfers are executed pursuant to standard contractual clauses, international adequacy assessments, or direct pre-contractual necessity initiated by the inquiring party.

Definite Retention Periods. We do not hold data indefinitely. Inquiries submitted through our forms and their associated email copies are retained for 36 months to maintain business project records. Chat transcripts generated via our advisory desk are deleted after 12 months. Web server access and security logs are automatically overwritten after 30 days. Your browser consent choice, saved under the key `site_consent_v2`, persists for 12 months unless cleared manually.

Security Measures. We protect submitted data through strict technical and operational controls: mandatory Transport Layer Security (TLS 1.3), hardened Unix file system permissions, automated honeypot spam traps (`agency` and `url` form fields), server-side timestamp validation (`t`), and continuous firewall monitoring. Only authorized studio staff led by Anna Ivanova have administrative access to stored inquiry records.

European Privacy Rights (GDPR). For visitors accessing our practice from the European Union, European Economic Area, or the United Kingdom, the General Data Protection Regulation (GDPR) guarantees specific statutory rights: the right to access your personal records, rectify inaccurate submissions, request complete erasure (the right to be forgotten), restrict processing, demand machine-readable data portability, object to processing based on legitimate interests, and withdraw consent at any time without affecting past lawful processing.

United States State Privacy Rights (CCPA / CPRA). Residents of California and other states with comprehensive privacy legislation hold distinct statutory protections under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA). You have the right to know what personal data categories we collect, request deletion, correct inaccurate personal data, and be free from discrimination for exercising your rights. Omelvix does not sell personal information or share personal data for cross-context behavioral advertising.

Global Privacy Control (GPC). We recognize and respect the Global Privacy Control signal. If your browser transmits a valid `Sec-GPC: 1` header, our website automatically treats it as a persistent opt-out from advertising storage and analytics tracking without prompting you again.

Protection of Children’s Privacy. Omelvix provides web architecture and copywriting services strictly to commercial entities and professional practice owners. We do not knowingly solicit, collect, or maintain personal information from individuals under the age of 18. If a parent or guardian discovers that a minor has submitted personal information through our intake forms, please notify us at [email protected], and we will purge the record immediately.

Regulatory Complaints. You have the right to register a formal complaint regarding our data handling practices with your local supervisory authority. In California, complaints may be lodged with the California Privacy Protection Agency (CPPA) or the Office of the Attorney General. Oregon residents may contact the Oregon Department of Justice Consumer Protection Division. In Europe, complaints may be directed to your national Data Protection Authority.

Exercising Your Data Rights (DSAR). To exercise your right to access, rectify, or erase your information, submit a formal Data Subject Access Request (DSAR) by emailing [email protected] with the subject line “Data Subject Request” or mailing our physical address at 1201 Northwest Irving Street, Portland, Oregon 97209. To safeguard confidentiality, we verify your identity by confirming your originating email address or telephone number. We acknowledge and fulfill verified requests without charge within 7 days of receipt.

Policy Amendments. We review our governance practices periodically. Any updates to this policy are posted directly to this URL with an updated effective date header. Material changes altering data collection practices will be accompanied by an updated notice on our primary consultation pages.

Direct Privacy Contact. Inquiries regarding this policy, data governance, or studio security should be directed to Anna Ivanova, lead consultant, at [email protected], by calling +1 (324) 555-2313, or by writing to Omelvix, 1201 Northwest Irving Street, Portland, Oregon 97209, United States.