Effective Date: August 15, 2026
KRYLANE Studio Inc. is a United States company based in Irvine, California. Our Services are directed primarily to clients in the United States. However, our website krylane.com is accessible worldwide, and visitors from the European Economic Area (EEA), the United Kingdom, and Switzerland may reach us through it.
This page explains, in good faith, how we handle the personal data of visitors covered by the EU General Data Protection Regulation (GDPR) and the UK GDPR / Data Protection Act 2018, and how you can exercise your rights.
It supplements our Privacy Policy and Cookies Policy. Where there is any conflict for EEA or UK visitors, this page prevails.
KRYLANE Studio Inc. does not target the EEA or UK market, does not price in euros or pounds sterling, and does not monitor the behavior of individuals located in the EEA or UK as a business activity.
Even so, we apply GDPR-standard practices to any personal data we receive from EEA or UK visitors for example, when someone in Europe fills in our contact form, uses our chatbot, or subscribes to our newsletter because we believe those standards are good practice regardless of where a business is located.
If you are in the EEA or UK and you engage us as a client, we will agree appropriate contractual terms with you, including a Data Processing Agreement where one is required.
For personal data collected through krylane.com, the controller is KRYLANE Studio Inc., of 5 Queens Wreath Way, Irvine, CA 92612, United States. You can contact us by email at [email protected] or by phone at (949) 284-5707.
We have not appointed an EU or UK representative under Article 27 GDPR, because we do not offer goods or services to, or monitor the behavior of, individuals in the EEA or UK as a regular business activity. You may contact us directly at [email protected] on any data protection matter. If our activities change such that an Article 27 representative becomes required, we will appoint one and update this page.
We have not appointed a Data Protection Officer, as we do not meet the criteria in Article 37 GDPR. Data protection enquiries are handled by our management team at [email protected].
For EEA and UK visitors, the categories are the same as those described in Section 2 of our Privacy Policy.
We process identity and contact data, meaning your name, email address, phone number, and company name, and enquiry data, meaning project details, budget, timeline, and anything else you type into a form. We process chatbot data, meaning the messages you send to our AI assistant and our responses, and marketing data, meaning your subscription status, preferences, email opens, and clicks. We process technical data, such as your IP address, browser and device information, and cookie identifiers, along with usage data, such as the pages you viewed, time on page, referring source, and navigation path. Where you become a client, we also process client data, meaning the billing, project, and access information needed to deliver the Services.
We do not intentionally collect special category data under Article 9 or criminal offence data under Article 10. Please do not send us such data.
We rely on Article 6(1)(b) – Contract when we respond to a contact form, quote request, or chatbot enquiry, because these are steps taken at your request prior to entering a contract, and when we deliver the Services you have engaged us for.
We rely on Article 6(1)(a) – Consent for analytics and performance cookies, for advertising, remarketing, and pixel tracking, and for marketing emails sent to prospective clients.
We rely on Article 6(1)(f) – Legitimate Interests when we market services similar to those already purchased to existing clients (a soft opt-in, with an opt-out in every message), when we operate and secure the Site and prevent fraud and spam, when we keep business records and work to improve our Services, and when we establish, exercise, or defend legal claims.
We rely on Article 6(1)(c) – Legal Obligation for our accounting, tax, and regulatory records.
Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before you withdrew. Where we rely on legitimate interests, we have carried out a balancing assessment and concluded that our interests are not overridden by your rights and freedoms. You may ask us for a summary of that assessment, and you have the right to object, as explained in Section 6.
Purposes are set out in Section 3 of our Privacy Policy, and retention periods are set out in Section 10 of the same policy.
In summary, enquiries that do not convert are kept for up to 24 months from last contact, chatbot transcripts for up to 12 months, and client project records for the length of the engagement plus 3 years. Contracts, invoices, and financial records are kept for 7 years as a legal obligation. Marketing subscriptions are kept until you unsubscribe, after which we retain a minimal suppression record.
We do not keep personal data longer than necessary for the purpose it was collected for.
If you are in the EEA or UK, you have the following rights.
Your right of access under Article 15 allows you to obtain confirmation of whether we process your data, receive a copy of it, and be told how it is used. Your right to rectification under Article 16 allows you to have inaccurate data corrected and incomplete data completed. Your right to erasure under Article 17 allows you to have your data deleted where there is no continuing lawful reason for us to hold it, and your right to restriction under Article 18 allows you to have processing limited while a dispute about accuracy or lawfulness is resolved.
Your right to portability under Article 20 allows you to receive the data you gave us in a structured, commonly used, machine-readable format, and to have it transmitted to another controller where that is technically feasible. Your right to object under Article 21 allows you to object to processing based on our legitimate interests; where direct marketing is concerned, that right is absolute and we will stop immediately. Under Article 7(3), you may withdraw consent for cookies or marketing at any time.
Under Article 22, you have the right not to be subject to automated decision-making that produces legal or similarly significant effects based solely on automated processing. And under Article 77, you have the right to lodge a complaint with a supervisory authority.
On automated decision-making, we do not make decisions producing legal or similarly significant effects about you based solely on automated processing. Our AI chatbot generates responses automatically, and we may use automated tools to prioritize or categorize incoming enquiries, but these are administrative aids only. A human at KRYLANE Studio reviews and decides on every proposal, engagement, and material communication. You can bypass the chatbot entirely by emailing [email protected] or calling (949) 284-5707.
Email [email protected] with the subject line “GDPR Request” and tell us which right you wish to exercise, your name and the email address or phone number you used with us, and any detail that helps us find your records, such as roughly when you contacted us.
We respond within one month of receiving your request. Where a request is complex or you have made several, we may extend by up to two further months, and we will tell you within the first month if we do. Requests are free of charge; we may charge a reasonable administrative fee, or refuse, only where a request is manifestly unfounded or excessive, and we will explain why. We may need to verify your identity before disclosing personal data, and we will ask only for what is necessary. If we cannot act on your request, we will tell you why and explain your right to complain.
KRYLANE Studio Inc. is located in the United States. If you contact us from the EEA or UK, your personal data will be transferred to and processed in the United States, and potentially in other countries where our service providers operate.
The United States has not received an unconditional adequacy decision from the European Commission covering all recipients, so we rely on safeguards for transfers. These include the Standard Contractual Clauses (SCCs) adopted by the European Commission, incorporated into our agreements with service providers where applicable, and the UK International Data Transfer Addendum to the SCCs for transfers from the United Kingdom. We also apply supplementary measures such as encryption in transit, access controls, and data minimization, and we rely on EU–US Data Privacy Framework certification where a given provider is certified.
By submitting a form, using the chatbot, or subscribing to our emails, you understand that your data will be transferred to and processed in the United States. You may request a copy of the safeguards we rely on by emailing [email protected].
The categories of recipients are listed in Section 8 of our Privacy Policy, and include hosting and CDN providers, analytics and advertising platforms, email and CRM providers, AI model providers, payment processors, accounting providers, cloud storage, and vetted contractors.
We enter into written agreements with our processors that require them to process personal data only on our instructions, to keep it confidential, to apply appropriate security measures, and to assist us with data subject requests.
We do not sell personal data.
For visitors detected as being in the EEA or UK, we operate our cookie banner on an opt-in basis: non-essential cookies, including analytics, advertising, and remarketing, are not set until you give consent.
You can withdraw or change your consent at any time through the Cookie Settings link in the Site footer. Full detail is in our Cookies Policy.
We apply the technical and organizational measures described in Section 11 of our Privacy Policy.
In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it. Where the breach is likely to result in a high risk to you, we will notify you directly without undue delay.
When KRYLANE Studio builds or operates a website, SEO campaign, automation, or chatbot for a client, the client is the data controller for the personal data flowing through that system, and KRYLANE Studio acts as a processor on the client’s documented instructions.
In that role we process personal data only on the client’s documented instructions, ensure personnel and contractors are bound by confidentiality, and apply appropriate security measures under Article 32. We engage sub-processors only with the client’s general or specific authorization and impose equivalent obligations on them. We assist the client with data subject requests, security, breach notification, and impact assessments, taking into account the nature of the processing. At the end of the engagement we delete or return personal data at the client’s choice, unless we are required by law to retain it, and we make available the information reasonably necessary to demonstrate compliance.
Where required, we will sign a Data Processing Agreement (DPA) with the client. You can request one at [email protected].
Client end users who wish to exercise rights over data held in a system we built should contact the client directly, as the client controls that data. If you contact us instead, we will forward your request to the client where we can identify them.
If you believe we have handled your personal data unlawfully, we would like the chance to put it right, so please contact [email protected] first.
You also have the right to complain to a supervisory authority, in particular in the EU or UK country where you live, work, or where the alleged infringement took place. In the European Union, you can find your national authority through the European Data Protection Board at edpb.europa.eu. In the United Kingdom, contact the Information Commissioner’s Office (ICO) at ico.org.uk or on 0303 123 1113. In Switzerland, contact the Federal Data Protection and Information Commissioner (FDPIC) at edoeb.admin.ch.
We may update this GDPR statement to reflect changes in our practices or in applicable law. The “Last Updated” date shows when the current version took effect.
If you have any questions about this GDPR or how we handle your data, please reach out to us:
KRYLANE Studio Inc.
5 Queens Wreath Way, Irvine, CA 92612, United States
Email: [email protected]
Phone: (949) 284-5707
Website: https://krylane.com
KRYLANE Studio Inc. is registered in the State of South Dakota and maintains its operating office in the State of California.
