Privacy at Oxbury X.

The operator responsible for your information

The controller is Oxburyx, trading at oxburyx.com. The public studio name on this website is Oxbury X. The postal address is 42 Oak Lane, Floor 2, Austin, Texas 23250, Austin, Texas, United States. Questions about the use of personal information reach the operator at [email protected].

This statement covers the public website, inquiries sent through its form and the support chat. The terms of use explain the separate boundary between an inquiry and agreed work. Reading a service page or sending a request does not create an account or purchase a service.

What the website records

The inquiry form records your name, phone, email, address, kind of inquiry, message, requested specification and consent tick. Phone and email are optional individually; one reply route is needed. Material described in your message can itself contain personal information, so leave out details that are not needed to understand the work.

With the submission, the website automatically records the IP address, browser user-agent string, referring URL, the moment the form was rendered and the moment it was sent. Server and access logs contain technical request information used to operate the site. A referring URL can contain an advertising click identifier.

Support chat keeps the conversation, the optional contact information you supply and your consent choice for that conversation. A token in your browser lets you return to the chat. The site stores the browser's cookie-consent choice under site_consent_v2; no other storage on this site persists that choice.

Cookie and advertising information includes storage identifiers and the click identifiers gclid, msclkid and fbclid. There is no account, password, payment or card data collected by this site. Nothing is sold through the website and no payment is taken here.

Why each record exists

Inquiry details let the studio read a request, decide what clarification is needed and reply to the person who sent it. A requested specification helps distinguish a project brief review from a request for a finished piece of work. The consent tick records permission to use the submission for that reply; it is not permission for unrelated marketing.

Chat content is used to answer the question in the conversation. Its token connects a returning browser to the same exchange. Technical submission information and access logs help identify failed requests, misuse and unwanted automated submissions. They also support diagnosis when a form cannot be delivered.

The consent record applies your storage preference on later visits. Advertising identifiers connect paid clicks with measurement, subject to your choices. Optional analytics and advertising processing help assess how visitors reach the site and use its inquiry routes; declining that storage does not prevent you from contacting the studio.

The basis for processing

US state privacy law applies as relevant to the visitor and the processing. For visitors from Europe, the following table states the legal bases under the General Data Protection Regulation. Consent to optional advertising is separate from the information needed to answer a request.

You can object to processing based on legitimate interest. Where a law requires a record to be retained or a request to be answered, legal obligation is the basis for that limited processing. No automated decision on this website determines whether you receive a service.

Advertising clicks reach this site today

Google Ads, Microsoft Advertising and Meta Ads send paid traffic to oxburyx.com. Google Ads uses gclid; Microsoft Advertising uses msclkid; Meta Ads uses fbclid. These parameters can appear in the link that brings you here and can also be present in a referring URL.

For clarity, the platform-to-identifier pairs are google ads / gclid, microsoft advertising / msclkid and Meta Ads / fbclid. A click identifier describes an advertising interaction, not the content of a project inquiry. Optional storage and related measurement remain subject to the consent choice and opt-out described in this statement.

Your choice controls optional storage

Consent Mode v2 holds ad_storage, ad_user_data, ad_personalization and analytics_storage denied until you allow storage. The consent mode signals are set back to denied the moment you decline or withdraw permission. A previous allowance is not a permanent instruction.

Use Cookie choices in the footer to change your choice. The banner does not block the page, and a denial does not prevent an inquiry. Consent signals can be sent to advertising systems while optional storage is denied; denial is not a claim that the website receives no advertising traffic or makes no network requests.

The cookie statement explains the distinction between necessary browser storage and optional measurement. Clearing browser storage removes the stored choice and may also remove your chat token. It does not itself delete a submitted inquiry held by the operator.

Who receives information

These recipients handle information for the stated functions. Their roles differ: the providers that deliver an inquiry are not the same as the platforms measuring an advertising click.

• Google Ireland Ltd / Google LLC provides Google Ads, attaches gclid to a click and receives the consent signals. Its own privacy information is at Google's privacy policy.
• Microsoft Ireland Operations Ltd provides Microsoft Advertising and attaches msclkid. Its handling is described at privacy.microsoft.com/privacystatement, the Microsoft privacy statement.
• Meta Platforms Ireland Ltd provides Meta Ads and attaches fbclid to clicks from its campaigns. See Meta's privacy policy for its own processing.
• The hosting provider serves this site and stores the inquiry database. This hosting function also supports the website's form handling and chat records.
• The mail provider carries the notification to the operator's inbox. An email copy of an inquiry therefore passes through the mail route as well as the website.

The operator uses inquiry and chat records to respond. Advertising measurement does not require you to put project documents into an advertising platform. Ask the operator for information about the hosting or mail recipient relevant to your record; no unconfirmed provider name is substituted here.

Information can cross a national border

The operator is in the United States. A visitor sending information from Europe or another country sends it to an operator outside that country. Hosting, mail and advertising providers can also process information in countries other than the country where it was collected.

Where European or UK transfer rules apply, a restricted transfer requires a lawful safeguard: an applicable adequacy decision or approved contractual safeguards, with additional protection where required. Consent to optional storage is not a substitute for those transfer obligations. Contact the operator to ask which safeguard applies to a particular recipient or to request information about it; this statement does not assert an unverified certification for a provider.

Records have specific retention periods

These periods describe the site's own records, not every record held independently by an advertising platform. The providers' statements explain their separate retention. A click identifier contained in an inquiry's referring URL follows the inquiry record's retention; one in an access log follows the log period.

You can ask for deletion before a period ends. If a legal requirement prevents deletion of a particular record, the operator explains the reason rather than treating the retention period as a reason to refuse every request. Removing a browser token does not remove the corresponding transcript from the server.

Keep the first message proportionate

The website uses HTTPS for its public connection. Submission validation and hidden anti-spam fields help reject malformed or automated inquiries. A conversation token connects a browser to its chat; do not share that token or include it in a public message.

These measures do not make an internet submission risk-free. Do not send passwords, card details, identity documents or sensitive information about someone else in an initial inquiry. A description of the document is usually sufficient to start a project brief review. If you think information has reached the wrong person, contact the operator using the details below.

Rights for visitors from Europe

Under the GDPR, you can request access to your personal data and rectification of inaccurate information. You can request erasure, restriction of processing and portability of eligible information in a usable format. You can object to processing based on legitimate interest, including any applicable direct marketing processing.

You can withdraw consent at any time without affecting the lawfulness of processing before withdrawal. Use Cookie choices for storage permission and write to the operator for consent connected with an inquiry or conversation. These gdpr rights depend on the relevant legal conditions; a refusal must be explained, not assumed from the fact that a record still exists.

US state privacy rights

US state privacy law applies, including California's CCPA/CPRA and other state laws in force where their conditions are met. Depending on the applicable law, you can ask to know or access the personal information held about you, correct inaccuracies, delete eligible records and obtain a portable copy. You can also ask about categories of information, their sources and the recipients to whom they are disclosed.

You can opt out of sale or sharing, including sharing for cross-context behavioral advertising, and targeted advertising where the applicable law provides that right. Advertising disclosure can fall within those definitions even without a cash payment for data. Decline optional storage or send a request marked ccpa or state privacy request; legal terminology is not required to exercise a right.

You are entitled to exercise applicable rights without discrimination. An authorized agent can submit a request with evidence of authority. If a request is refused, you can ask for the reason and appeal where state law provides an appeal route. The site does not require a purchase or an account to receive a privacy response.

A browser opt-out is respected

Global Privacy Control, communicated through the Sec-GPC header, is honored as an opt-out without asking again. The global privacy control signal is not treated as permission for optional storage, sale or sharing. It applies to the browser communicating the signal; it does not identify every browser or device you use.

For a request about information already submitted, contact the operator as well. A browser signal controls the current privacy preference; it cannot by itself identify which named inquiry should be returned or deleted.

This site is not for children

The services and inquiry routes are intended for adults arranging project work. The site does not seek or knowingly collect personal data from children. Children should not submit an inquiry or start a support chat.

If a parent or guardian believes a child has supplied personal information, write to the operator with enough context to locate the submission. Do not send further sensitive details about the child. The operator can address removal through the data-request route.

You can take a concern beyond the studio

You may complain to your state Attorney General. In California, you may also complain to the California Privacy Protection Agency. European visitors have the right to complain to a data protection authority, including the authority in their place of habitual residence, work or the location of an alleged infringement.

You do not need to obtain the studio's permission before making a complaint. Writing to the operator first can help locate a missing record or correct an error, but it does not replace your right to contact the relevant authority.

Ask for access, correction or deletion

Send your request to [email protected], or use the data-request route. A data request is answered within 7 days. Say what you want to happen and, if possible, write from the same contact route you used for the original inquiry.

Include the approximate date of the inquiry or chat and enough context to find it. Do not attach identity documents to the first message. A proportionate identity check may be needed before information is disclosed or removed, particularly if you use a different reply address. If clarification is needed, the response explains what is missing and why.

You may also write to Oxburyx at 42 Oak Lane, Floor 2, Austin, Texas 23250, United States. You do not have to state a legal section number or use a special form. A plain request such as “send me the information from my inquiry” is sufficient to start.

Changes stay visible here

An updated policy is published at this same privacy page with a revised effective date. Material changes are identified on the page so a returning visitor can see that the handling of information has changed. A new purpose that requires fresh consent is not authorized merely by changing this wording.

The date at the top identifies the policy currently in effect. Keep a copy if you need to compare the statement that applied when you sent your inquiry with a later version.

Reach the operator, not an automated policy service

This is the contact route for a human response about information held by the studio. For a service question rather than a privacy request, use the direct inquiry form. The accessibility page also explains how to report a barrier that prevents you from using a privacy control.