Legal

Privacy Policy

Last updated: 13 April 2026

Who we are

Kiilu is a creative studio offering web development and UGC content services, operated by Malin and Jimmy, based in Algarve, Portugal. We are the data controller for personal information collected through this website.

You can reach us at hello@kiilu.io or via our contact page.

What data we collect

When you submit an inquiry through our contact form, we collect:

  • Your name
  • Your email address
  • Your brand or company name (optional)
  • The service you're interested in
  • The content of your message

We also collect anonymous usage statistics through Vercel Analytics and — with your consent — Google Analytics 4. See the Analytics section below for details.

Why we collect it

We collect this information solely to respond to your inquiry and, where relevant, to follow up about a potential project. We do not use your information for marketing purposes unless you have explicitly asked us to stay in touch.

The legal basis for processing your data is our legitimate interest in responding to business inquiries (Article 6(1)(f) GDPR).

How long we keep it

We retain inquiry data for up to 24 months from the date of last contact. If no project results from the inquiry, data is deleted after that period. You can request earlier deletion at any time.

Who we share it with

Your data is processed by Web3Forms (our form provider, based in the United States), Vercel, Inc. (our hosting and analytics provider), and — only if you accept cookies — Google LLC (Google Analytics 4, acting as data processor). Google may process analytics data on servers in the United States. This transfer is covered by the EU–US Data Privacy Framework (Google LLC is certified) and, where applicable, Standard Contractual Clauses. We do not sell, rent or share your personal data with any other third parties.

Analytics

We use Vercel Analytics to collect anonymous page view statistics. This includes: pages visited, referrer, device type, and approximate country (derived from a hashed and discarded IP address). No cookies are set and no personally identifiable information is stored.

We also use Vercel Speed Insights to measure page performance (Core Web Vitals). This collects no personal data whatsoever.

We use Google Analytics 4 (GA4) to understand how visitors interact with our site — pages visited, time on site, traffic sources, and general device/browser information. GA4 only activates if you accept cookies. We use Google's Consent Mode v2, meaning analytics is blocked by default until you give consent. Google may process this data on servers in the United States under appropriate transfer safeguards (Standard Contractual Clauses).

The legal basis for Vercel Analytics is our legitimate interest (Article 6(1)(f) GDPR). The legal basis for Google Analytics is your consent (Article 6(1)(a) GDPR).

Cookies

This website uses a small number of cookies:

  • Essential cookies — required for the contact form to function. Always active.
  • Analytics cookies (Google Analytics 4) — only set if you click "Accept" on the cookie banner. GA4 sets two cookies: _ga (identifies unique visitors, 2-year expiry) and _ga_5659WDDWSF (session state, 2-year expiry). You can withdraw consent at any time by clearing your browser cookies.

Vercel Analytics and Speed Insights set no cookies. We do not use advertising or behavioural tracking cookies.

Your rights

Under GDPR, you have the right to:

  • Access the personal data we hold about you
  • Correct any inaccurate information
  • Request deletion of your data
  • Object to processing based on legitimate interests
  • Data portability — receive your data in a structured format

To exercise any of these rights, contact us via the contact page. We will respond within 30 days.

Right to complain

If you believe your data has been handled incorrectly, you have the right to lodge a complaint with Portugal's data protection authority, the CNPD (Comissão Nacional de Proteção de Dados) at www.cnpd.pt.

Pricing and VAT

All prices on kiilu.io are quoted excluding VAT (value added tax). Private individuals will be charged VAT in accordance with applicable Portuguese and EU law. EU business customers with a valid VAT number will be invoiced without VAT under the reverse charge mechanism.

Changes to this policy

We may update this policy from time to time. The date at the top of this page reflects when it was last revised. Continued use of the site after changes constitutes acceptance of the updated policy.