Privacy policy

The controller for personal data on this site is:

• Name: Pluton Studio
• Represented by: Adrian Fusha
• Address: Prishtina, Kosovo
• Email: hello@pluton.studio
• Phone: +383 49 200 124

We collect what the site needs to work, what we need to answer you, and, through the Meta Pixel, what we need to measure our ads. We never store an IP address ourselves: it is used for a moment by the abuse limiter and by a checksum that rotates daily, then discarded. The Meta Pixel sends it to Meta from your browser, as described below.

The legal bases are those of Article 5(1) of Law No. 06/L-082; the point that applies is named in brackets.

• One advertising tool, the Meta Pixel (see below). No Google Analytics, no Tag Manager, no other ad network.
• Fonts are bundled at build time and served from our own domain, so no request goes to a font network.
• Push notifications exist only in our internal admin panel, for our own devices. Visitors never receive one.
• There is no automatic reply, no newsletter and no marketing sequence of any kind.

When you use the chat, your message and the last few turns of the conversation are sent to our AI service provider in the United States, which generates the reply. We then store the question and the reply in our own database so we can see what is being asked.

Please do not write anything confidential or any sensitive category of personal data there. For anything confidential, email is the right channel. We will delete a conversation on request.

Every page of this site loads the Meta Pixel, a script from Meta, the company behind Facebook and Instagram, for every visitor in every country. Your browser sends Meta the data listed in the table above, and Meta can link it to your Facebook or Instagram account if you have one. We use the reports and audiences Meta builds from it to see which of our ads bring visits and enquiries, and to show our ads to people who have visited the site.

We send Meta only the fact that a form was sent, never what you wrote in it. When Meta's automatic advanced matching is switched on for our pixel, the pixel can also read the email address or phone number typed into a form and send it to Meta in hashed form, to match the visit to an account.

We and Meta are jointly responsible for collecting this data on our site and passing it to Meta. What Meta does with it afterwards is Meta's own responsibility, under its privacy policy at facebook.com/privacy/policy.

To stop it, block the _fbp cookie or connect.facebook.net in your browser (most content blockers do this), or disconnect your activity from other businesses in your Meta account, under Accounts Center, "Your activity off Meta technologies". The site works exactly the same.

Each kind of data has its own period:

• Enquiries and contact history: for as long as the relationship or the interest in one lasts. If nothing comes of it, we delete the record as soon as you ask.
• Invoices, contracts and the correspondence attached to them: for as long as tax and bookkeeping law requires us to keep them.
• Visit log: deleted automatically after 13 months.
• Meta Pixel: the _fbp cookie expires 90 days after your last visit; how long Meta keeps the events is set by Meta's own policy.
• Chat conversations on this site, including the copy of a chat's first question in our internal notification feed: deleted automatically after 12 months.
• Sooner on request: we delete the chat conversation you point us to and, if your browser carries our pl_vid id, every row tied to it.

We do not sell data. Besides the providers that keep this site running, one advertising provider receives visit data: Meta, through the pixel.

The data from this site sits on European infrastructure: our server functions are pinned to Frankfurt and the database is in eu-central-1. The engineer with access to it works from Prishtina, and the chat and email providers are in the United States. The Meta Pixel sends its data from your browser straight to Meta's servers, which include the United States.

Transfers of personal data out of Kosovo are governed by Articles 44 to 49 of Law No. 06/L-082.

When we process personal data on a client's behalf, we sign a processing agreement under Article 27 of the same law. The detail is on the data processing agreement page.

This site sets one advertising cookie, the Meta Pixel's _fbp, in every country. Everything else is our own, and what our statistics set depends on your country, which our hosting reads from your IP address as the page is served; the IP address is not stored.

• _fbp: set by the Meta Pixel for every visitor, in every country. A random id that lets Meta recognise your browser across visits to this site, kept for 90 days from your last visit. If your browser allows third-party cookies, Meta's own facebook.com cookies travel with the pixel's requests too.
• In the EU and EEA, Switzerland and the UK: no statistics cookie of ours, and nothing stored in your browser for our statistics. A pl_vid cookie from an earlier visit is deleted on your next page load. We count your visit with a checksum made from your IP address, your browser and a key that changes every day, so you cannot be recognised from one day to the next. If your country cannot be determined, you are counted this way too.
• Everywhere else, Kosovo and Albania included: pl_vid, a random id that recognises your browser so our own visit statistics do not count one person's two pageviews as two people. httpOnly, roughly 13 months, first-party only, never shared. If you would rather not carry it, tell us or block the cookie: the site works exactly the same.
• pluton_lang: remembers the language you pick in the language menu, so pluton.studio opens in it next time. It is set only when you pick a language, and kept for 12 months.
• The site chat keeps your own conversation, for up to 30 days, and a count of your questions in your browser's local storage, only so the chat works for you. Starting the chat over deletes the saved conversation; clearing this site's data in your browser deletes both.
• The internal admin panel uses one session cookie and two interface cookies. Only we receive those after logging in, and any browser carrying our session cookie is excluded from every statistic.

Under Law No. 06/L-082 you have the right of access (Article 14), rectification (Article 15), erasure (Article 16), restriction of processing (Article 17), data portability (Article 19) and objection to processing based on legitimate interests (Article 20). Any consent you give can be withdrawn at any time, with effect for the future.

An informal email to hello@pluton.studio is enough; we answer within a month, usually far sooner.

You can also complain to the Information and Privacy Agency (Agjencia për Informim dhe Privatësi, AIP), Rr. "Zejnel Salihu" Nr. 22, 10000 Prishtina, aip.rks-gov.net, under Article 52 of the law.

When the technology behind the site changes, this page changes with it. The date of the last change is shown at the top; earlier versions are available on request.