We take your privacy seriously. This policy explains exactly what data we collect, who processes it, and how we protect it.
Divergent Studio is a digital production company registered in Plovdiv, Bulgaria. We build 3D city configurators, real estate marketing tools, drone productions, and custom software for property developers across Europe. We also offer a SaaS CRM subscription product. Services are purchased and managed directly through this website.
Contact and quote form submissions: When you submit a contact or quote request, we collect your name, email address, company name, project details, and any information you voluntarily provide. This data is stored in our database (Supabase, hosted in Frankfurt, Germany) and used to respond to your enquiry.
Account data: If you create an account, we store your email address, name, preferred language, and company details. Authentication is handled by Supabase Auth. You can also sign in with Google (OAuth 2.0), in which case Google shares your name and email with us.
Billing data: If you purchase a service or subscription, payment is processed by Stripe (Stripe Payments Europe Ltd, Dublin, Ireland). We store your Stripe customer ID and subscription status in our database. We do not store your card number, CVV, or full payment details — these are handled exclusively by Stripe under PCI-DSS compliance.
AI chat interactions: Our website includes an AI assistant powered by Claude (Anthropic PBC, San Francisco, USA). Messages you send to the assistant are transmitted to Anthropic's API to generate responses. We do not store the content of chat conversations beyond the duration of your session.
CRM lead data: When you submit a contact or quote form, your submission is also stored in our internal CRM as a lead record. This record contains your name, email, company, and the details of your enquiry. It is used solely to manage our sales process.
Analytics data: If you consent to analytics cookies, we load Plausible Analytics (Plausible Insights OÜ, Estonia). Plausible is privacy-first: it collects no personal data, sets no cookies, and cannot be used to track individuals across sites. Data collected includes page views, referrer, country, and device type — all aggregated and anonymous.
Error and performance monitoring: We use Sentry (Functional Software Inc., San Francisco, USA) to capture application errors. Error reports may include technical details such as browser type, operating system, page URL, and a stack trace. Sentry is configured to exclude personally identifiable information — no names, email addresses, authentication tokens, or session cookies are included in error reports. All Sentry data is stored in the EU (Frankfurt, Germany) under Sentry's EU data residency programme.
Security monitoring: We use Arcjet to protect our platform against bots, spam, and credential-stuffing attacks. Arcjet analyses IP addresses and request patterns. No personal data from your form submissions is shared with Arcjet beyond IP address and the technical request metadata needed for threat assessment.
Bot protection: We use Cloudflare Turnstile on our forms to distinguish humans from automated bots. Turnstile operates without persistent cookies and does not track users across websites. Cloudflare may process your IP address as part of this check.
Transactional email: We use Resend (Resend Inc., USA) to send confirmation emails and notification emails. When you submit a form, your name and email address are passed to Resend to deliver the email. Resend does not use this information for marketing purposes.
Necessary cookies: We set a small number of cookies required for the site to function — specifically your authentication session cookie (Supabase Auth) and your cookie consent preference. These cannot be disabled.
Analytics cookies: Only loaded if you explicitly consent. We use Plausible Analytics, which is cookie-free — it does not set any cookies in your browser.
Marketing cookies: We currently do not use advertising or retargeting cookies. The marketing category in our cookie banner is reserved for potential future use.
We do not use third-party advertising cookies or cross-site tracking cookies.
Contract performance (Article 6(1)(b)): Processing your account data, billing information, and order records is necessary to provide the services you have requested.
Legitimate interests (Article 6(1)(f)): We process enquiry and CRM lead data to respond to your messages, manage our sales pipeline, and protect our platform from abuse (security monitoring, error tracking). These interests do not override your rights.
Consent (Article 6(1)(a)): Analytics data (Plausible) is only collected when you explicitly consent through our cookie banner. You can withdraw consent at any time by clicking "Manage preferences" in the banner.
Primary database: Supabase, hosted in Frankfurt, Germany (AWS eu-central-1). All data is encrypted at rest and in transit (TLS 1.2+). Row-level security policies enforce that users can only access their own data.
Backups: Supabase performs automated point-in-time recovery backups within the EU region.
Retention: Contact form and quote data is retained for up to 24 months. Account data is retained for as long as your account is active. You may request deletion at any time.
We do not transfer personal data outside the European Economic Area except where necessary for the following processors: Anthropic (AI chat, USA — processing only, not stored), Resend (transactional email, USA), Sentry (errors, EU region). Each processor is bound by Standard Contractual Clauses or equivalent safeguards where applicable.
Right to access: You can request a copy of any personal data we hold about you.
Right to erasure: You can request that we delete all personal data we hold about you.
Right to rectification: You can request that we correct inaccurate or incomplete data.
Right to portability: You can request your data in a structured, machine-readable format.
Right to object: You can object to processing based on legitimate interests.
Right to withdraw consent: For analytics, you can withdraw consent at any time via the cookie banner.
To exercise any of these rights, email us at hello@divergent.studio. We respond within 30 days. You also have the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection (CPDP) or the supervisory authority in your country of residence.
Supabase Inc. — database and authentication (Frankfurt, Germany). Privacy policy: supabase.com/privacy
Stripe Payments Europe Ltd. — payment processing (Dublin, Ireland, PCI-DSS Level 1). Privacy policy: stripe.com/privacy
Anthropic PBC — AI chat (San Francisco, USA). Messages are processed transiently and not stored by us. Privacy policy: anthropic.com/privacy
Resend Inc. — transactional email (USA). Privacy policy: resend.com/privacy
Sentry (Functional Software Inc.) — error monitoring (EU region, Frankfurt). Privacy policy: sentry.io/privacy
Plausible Insights OÜ — analytics (Estonia, EU). Cookie-free, no personal data. Privacy policy: plausible.io/privacy
Cloudflare Inc. — bot protection via Turnstile. Privacy policy: cloudflare.com/privacypolicy
Arcjet Inc. — security monitoring (API-based, no persistent user data stored). Privacy policy: arcjet.com/privacy
Data controller: Divergent Studio, Plovdiv, Bulgaria. For privacy-related questions, data access requests, or erasure requests, contact us at hello@divergent.studio. We aim to respond within 5 business days for general enquiries and within 30 days for formal GDPR rights requests.