We do not collect anything.

The site

What the site does not do.

We set no cookies, so no consent banner either: there would be nothing to consent to.

Visitor analytics, third-party scripts, tracking pixels, embedded maps and videos: nothing of the kind runs here. The typefaces come off the same machine as the page. No font service ever learns that you visited.

The one thing that stays on your device is your choice of language and of lighting mode, kept in your own browser and gone the moment you clear the site’s data.

The machines

The three companies in the path.

The site is static and served from one machine. There is no database of visitors anywhere.

Project work is a separate matter and this page does not cover it. Data of yours that the studio touches inside a project is governed by your contract with us, and that contract is signed before the access exists. It names every machine and every service that will hold the data, the country each of them stands in, and the day everything comes back to you.

• Hetzner Online GmbH, Germany. Holds the machine the files sit on. The web server on it writes no access log.
• Cloudflare, Inc., USA. Stands in front of the domain and carries the traffic, keeping its own security and abuse records under its own terms. When it challenges suspicious traffic, that check can leave a technical cookie of Cloudflare’s own. We set none.
• Fastmail Pty Ltd, Australia, with mail servers in the USA. Carries the email, which means every letter you send passes through it.

Two of the three move data outside the European Economic Area, each under a safeguard the European Commission recognises. Cloudflare is certified under the Data Privacy Framework between the European Union and the United States, and Fastmail works under the Commission’s standard contractual clauses.

The mail

Where your letter goes.

When you write to us, we receive what you wrote: your address, the subject, the text and anything attached. We use it to answer you and to do the work you wrote about, and for nothing else.

We keep the correspondence while the conversation is alive, and after that for as long as the law makes us keep a contract and the accounting behind it. We do not sell it, do not hand it to advertisers and do not add you to any list you did not ask to be on.

The law has a name for each of those. Answering you and doing the work rest on a contract being prepared or performed, and what we keep afterwards we keep because another law requires it. Where a letter leads to no contract at all, as with a question from the press or a vulnerability someone reports, the ground is our legitimate interest in replying.

If you want it deleted, write to the same address and we will delete what we are not obliged to keep.

Your rights

What you can ask for.

You can ask what data we hold about you and get a copy of it. Correction, deletion, restriction of the processing and an objection to it are all yours to ask for. Whatever you gave us can come back in a form a machine can read, so you can carry it somewhere else. Write to hello@kirilov.studio and a person will answer.

The law also gives you the right to lodge a complaint with a supervisory authority. In Bulgaria that is the Commission for Personal Data Protection.

Answerability

Who is responsible.

This site is made and published by STUDIO KIRILOV EOOD, registered in Bulgaria as СТУДИО КИРИЛОВ ЕООД under company number 208911968. On this page “we” means the studio, which is the controller of everything described above, and the address for any question or request is hello@kirilov.studio.

No data protection officer has been appointed, because the scale of the processing here does not require one.

This text last changed on 17 August 2026.