Privacy policy
Last updated 25 October 2026
This policy explains what happens to the details you send through the contact form on training.shaoyan.studio, or by email or WeChat. In short: I collect only what I need to answer you, store it in the European Union, never sell it, and delete it when it is no longer needed. Measurement only runs if you accept it.
1. Who is responsible
The data controller is Yan Shao, an individual based in Paris, France, who runs shaoyan.studio. shaoyan.studio is not a registered company. Contact for anything about your data: [email protected].
2. What I collect
- What you type in the form: name, work email, and optionally company, WeChat or phone, project type, timeline, budget range, your message and a link to your material.
- Files you choose to attach to the form (up to 5 files, 25 MB each).
- The date you sent it, the language of the page and the version of this policy you agreed to.
- How you found the site, if you accepted measurement in the cookie banner: the campaign tags of the link you followed (utm_…), an ad click identifier, the referring site, the first page you saw, the dates of your first and latest visit and how many pages you viewed. Without that consent, only the campaign tags and referring site of the page you sent the form from, if it has any.
- My own notes on our conversation (for example the date of a call or a quote), so I can follow up properly.
- To block spam, a one-way hash of your IP address is kept for at most 24 hours. Your IP address itself is not stored.
Please don’t attach confidential material, or files with other people’s personal data (such as employee names, photos or contact lists), before we have agreed how to handle them. I can sign an NDA first.
3. Why, and on what legal basis
I use your details only to answer your enquiry, prepare a proposal and, if we work together, run the project. The legal basis is taking steps at your request before entering into a contract (GDPR Art. 6(1)(b)). Spam protection relies on my legitimate interest in keeping the form usable (Art. 6(1)(f)). Measuring how visitors find the site relies on your consent (Art. 6(1)(a) and the French rules on cookies), which you can withdraw at any time under “Cookie settings” at the bottom of each page; it tells me which posts, sites and campaigns bring enquiries. Anonymous visit statistics (Cloudflare Web Analytics, see section 8) rely on my legitimate interest in knowing how the site is used (Art. 6(1)(f)): they set no cookie and I only see totals. I don’t send newsletters or marketing emails, and I don’t use your details for automated decisions or profiling.
4. Where it is stored and who processes it
| Provider | What for | Where |
|---|---|---|
| Cloudflare, Inc. | Hosting the site, the form’s database, storage of attached files (R2), the spam check (Turnstile), anonymous visit statistics (Web Analytics), email forwarding, sign-in to my admin page | Database and files kept in the EU; the network serves requests worldwide |
| Google LLC (Gmail) | My inbox, where new enquiries are notified and answered | EU and US |
| Google LLC (Google Fonts) | Delivers the fonts the pages use. Your browser connects to Google’s servers, which see your IP address; no cookies are set | Worldwide |
| jsDelivr and unpkg | Deliver the code libraries some interactive 3D demos run on. They see your IP address when you open such a demo | Worldwide |
Cloudflare and Google (for Gmail) act as processors under their data processing terms. Google Fonts and the two code libraries only receive the technical data any web request carries (IP address and browser details). Where data may leave the EU (for example to the United States), the transfer relies on the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses. Only I can read the enquiries and open the files.
5. How long I keep it
- Enquiries that don’t lead to a project: deleted 24 months after our last exchange.
- Clients: kept while we work together and for 24 months after, so I can handle follow-ups and the 30-day fixes. Invoices are kept for 10 years, as French accounting law requires, outside this contact database.
- Attached files: deleted together with the enquiry they belong to.
- Spam-protection hashes: 24 hours.
- Your cookie choice: 6 months, then the banner asks again. Measurement data in your browser: 90 days; once sent with the form, it is kept and deleted with your enquiry.
6. Your rights
You can ask to see, correct, export or delete your details, to restrict their use or to object to it. Write to [email protected]; I answer within one month. You can also complain to the French data protection authority, the CNIL, or the authority in your country.
7. Visitors from mainland China
If you are in mainland China, the details you send are transferred abroad and stored in the European Union (see section 4). The overseas recipient is the controller in section 1, reachable at [email protected]; you can exercise your rights there as described in section 6. The form asks for your separate consent to this transfer, as required by the Personal Information Protection Law. If you prefer not to transfer your details, contact me on WeChat (Hennry_ii) instead.
8. Cookies and similar storage
On your first visit a banner asks whether you accept measurement. Rejecting is as easy as accepting, nothing optional runs before you choose, and you can change your choice at any time with “Cookie settings” at the bottom of each page.
| Name | What for | Kept | Consent |
|---|---|---|---|
| sy_consent (cookie) | Remembers your choice in the banner | 6 months | Not needed: strictly necessary |
| sy_attr (browser storage) | How you found the site (see section 2), sent with the form if you write to me | 90 days | Only if you accept measurement |
| Cloudflare Turnstile (contact page) | A short-lived security cookie that tells people from bots | Short-lived | Not needed: strictly necessary |
| CF_Authorization (admin page) | My own sign-in; visitors never reach that page | 24 hours | Not needed: strictly necessary |
Visit statistics come from Cloudflare Web Analytics. It sets no cookie and stores nothing in your browser, so it runs without asking: like any web request, it sees the page address, the referring site, your browser and your country, and I only see totals (visits, pages viewed, referring sites, countries, devices).
No third-party analytics or advertising cookies are used at the moment. If I add tools such as Google Analytics or advertising tags (Google, LinkedIn or Meta), they will be listed here, they will only run if you accept them, and the banner will ask you again.
9. Publisher and host
This site is published by Yan Shao, Paris, France, [email protected]. It is hosted by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA (cloudflare.com).
10. Changes
If this policy changes, the new version is published here with a new date. The version you agreed to is recorded with your enquiry.