Almost nothing
is collected here.

CLOUD RIFT, a motion design studio run by Andrii, in Ukraine. Everything below is decided and done by one person, and that person can be reached at hello@cloudrift.team.

In the language of the GDPR that makes CLOUD RIFT the data controller for anything you send through this site.

What you type into the brief form: your name, your email address, the company if you give one, what the work is, when you need it by, and the file if you attach one. That is the only place on this site that asks you for anything.

If you ask for it: your email address, for word of new builds of the plugin. With it, the day you asked, the sentence you agreed to, and the day you confirmed the address was yours. Nothing else — not what you downloaded, not whether you installed anything. The file sits at a public address, so no list here knows or could know who has it.

And a plain record of visits, so that a reel sent to someone can be told apart from a link fetched by a machine. One line is written when a page opens and one more if a film is played: the time, the address of the page, the label carried in the link if it has one, the site you arrived from, the country, and whether the device was a phone.

That record deliberately holds no IP address, sets no cookie, and stores nothing on your device — no identifier survives the tab closing. Two visits on two days cannot be joined together, by us or by anyone reading the table. It is a tally of arrivals, not a profile of a person.

There are no advertising tags, no third-party analytics and no scripts from anyone else watching the page. There is no cookie banner because there is no cookie to consent to: the only one this site can set is on a password-protected page, to remember that the password was already given, and it holds nothing but an expiry and a signature.

To read your brief, answer it, and do the work if we go ahead. And, for the record of visits, to know whether a reel that was sent has actually been watched — which is the difference between following up and guessing.

The lawful basis is Article 6(1)(b) of the GDPR — steps taken at your request before entering into a contract — for as long as we are talking about a job, and Article 6(1)(f), legitimate interest, for keeping a record of enquiries so that a past conversation can be picked back up.

The build notices are the one thing here that runs on consent, Article 6(1)(a). You ask for them, and nothing is sent until you have pressed a button in a letter to prove the address is yours. Every letter carries a link that ends it in one press.

There is one mailing list, and it covers three things: new builds of a plugin you have, new plugins and panels when they are released, and the teaching platform when it opens. It is not used for client work, for anything else the studio does, or for anyone else's mailing — that would be a different thing to have agreed to.

The exact sentence you agreed to is stored with your address, with the date and a version number. It changes from time to time, and a change never applies backwards: if you agreed to hear about one plugin, a later wording that covers more does not make you have agreed to more.

You are asked for an address next to the download, never in front of it. The file is the same file either way, and the button that declines is the same size as the one that accepts.

An address does nothing until it is confirmed. If you never press the button in that first letter, the address is deleted after seven days and never written to again — which is what stops a typo, or somebody entering an address that is not theirs, from turning into mail somebody else did not ask for.

If a letter bounces for good, or is reported as unwanted, the address is blocked here and stays blocked. Filling the form in again does not undo that; it should not be possible for anyone to sign you back up.

Purchases are handled by a third-party payment provider, named at the checkout. The checkout is theirs, on their pages: your card details are typed into it and never reach this site. Nobody here sees them, at any point.

When an order goes through, the provider passes on what is needed to stand behind it: your name, your email address, your country, what you bought, the licence key if the product has one, and the order number.

That is used for three things: to get you the product, to answer you when you write about it, and to tell you about updates to products you own — a new build of something you paid for is part of what you paid for. It does not put you on the mailing list. That is still only for the people who asked to be on it.

The basis is Article 6(1)(b) of the GDPR, the contract you entered by buying, and Article 6(1)(c) for the records that tax and accounting law requires to be kept.

Order records are kept for as long as tax and accounting law requires, and for as long as the licence they record is valid — that record is what lets you download a product again, or get a lost key back, long after you bought it.

The seller is Andrii Osypenko, a sole proprietor (FOP) registered in Ukraine, trading as CLOUD RIFT — the same person named above, under the name the tax office knows.

Some products ask for a licence key the first time they run, and check it again about once a day. Each check is a small request from your computer to license.cloudrift.team, a Cloudflare Worker run by this studio, which checks it against the record of your purchase. The Worker keeps nothing: no database, no log of its own.

What is sent: the licence key, the name of the product, and an installation ID that is given to that computer when the key is first used. On first use there is also a short label for the installation, such as win-3fa91c07b2d4e865. It is worked out on your computer from the product, the computer's name and the name of the account you are logged in to — and only the result leaves it, never the names themselves. It is a code, not a name, but it is derived from yours, so it counts as pseudonymous rather than anonymous. It is stored against the licence; it is how one of your machines can be told from another when a seat has to be freed.

It is used to check that the key is real, belongs to the product, and has not been used on more computers than the licence allows. Nothing else is read from your machine, and nothing is sent about what you make with the product.

The basis is Article 6(1)(b) of the GDPR: checking the licence is part of delivering what you bought. Cloudflare sees the request as it passes, with your IP address, and keeps its own operational logs as any host does — see the section on the site itself. If you are offline, the product keeps working for seven days before it needs to check again.

A product with no licence key makes none of these requests.

The same server shows you your key and your download straight after you pay. The payment provider sends you back to a page on this site with your order in the address; the page passes that to the licence server, which checks that the order is paid and answers with your key and a download link that works for fifteen minutes. Nothing is stored: not the order, not the key, not who asked. The files themselves are kept in private storage with no public address, so they cannot be reached without a paid order. Cloudflare sees these requests as it sees any others.

A brief is stored so it is not lost and forwarded by email so it is read. Storage is Cloudflare D1, an attached file goes to Cloudflare R2, and the mail goes through Resend. Each of them sees the contents, because keeping and delivering it is the job they are doing.

They act as processors: they handle it on instruction and for no purpose of their own. Both are in the United States, so your data leaves the European Economic Area — the transfer rests on the Standard Contractual Clauses in their own data processing terms.

Purchases are the exception to all of that. The payment provider is not a processor of ours: it is an independent controller of the payment and of what it needs to take one — the card, the billing address, its fraud checks, and the tax records it is obliged to keep. That is covered by its own privacy policy, which is available at the checkout, not by this page.

It is not sold, not shared with anyone else, and never used to send you anything you did not ask for.

The pages are static files served by Cloudflare, and films come from Cloudflare R2. Cloudflare handles the request and keeps its own operational logs, including IP addresses, as any host does — that is covered by their privacy terms rather than by this page.

Fonts and video are served from this site's own domain, so no request leaves for anyone else while you read.

A brief is kept while the conversation is live, and afterwards for as long as the work it led to might need referring back to — three years is the working rule. An enquiry that goes nowhere is deleted within a year.

Visit records are kept for twelve months and then deleted. They are of no use once the conversation they belonged to is over.

An address on the list stays until you leave it. After that only the fact of having left is kept, and nothing else — enough to make sure the same address cannot be signed up again by accident, and not enough to write to.

Ask for any of it to go sooner and it goes.

A copy of what is held. A correction. Deletion. A pause on using it. A machine-readable export. Or an objection to it being held at all under legitimate interest.

Write to hello@cloudrift.team and say which. It is one person reading, so the answer comes from a person, within a month.

If the answer does not satisfy you, you can complain to a data protection authority — in Ukraine the Ombudsman's office, and in the EU the authority where you live.

This is a studio's portfolio and a form for commissioning work. It is not aimed at children and nothing here is knowingly collected from them.

The date below is when this page was last touched. Anything that changes what happens to a brief already sent will be told to whoever sent it, not quietly edited in here.