Effective and last updated: 1 October 2026.
This notice explains how Prototyper.com handles personal information on its website and private client portal.
1. Your data controller
Prototyper.com, is responsible for this processing. For privacy questions or requests, email Email Prototyper.
2. Information we collect
- Enquiries: your name, email, optional company, message, project goals, scope, timeline, budget range and reference links supplied in a brief.
- Accounts: account identifiers, email, display name, password hashes and verification/reset information. Do not send us your password by email.
- Client workspaces: assigned projects, milestones, review versions, approvals, requested changes, comments, shared files and activity records.
- Technical information: hosting and security systems can record IP addresses, request details, browser information, login attempts and email-delivery information. Consent settings use a browser cookie.
Required contact and account fields are needed to respond or provide access. Without them we may be unable to answer your enquiry or create a working account. Optional fields are identified on the forms. Please do not submit unnecessary sensitive information or personal data about others.
3. Purposes and legal bases
- Responding to a requested enquiry and preparing a project: steps before entering a contract, Article 6(1)(b) GDPR; ordinary business correspondence may also rely on our legitimate interest in answering requests.
- Providing agreed services and client account access: performance of a contract, Article 6(1)(b). Where you act for a business client, our legitimate interest in delivering that client’s project and communicating with its representatives applies.
- Protecting accounts, resolving problems and maintaining review/approval records: legitimate interests in secure service delivery and documenting project decisions, Article 6(1)(f), subject to your rights.
- Records required by applicable tax, accounting or other laws: legal obligation, Article 6(1)(c).
- Optional cookies, where used: consent, Article 6(1)(a). Essential authentication and security cookies support the services you request.
An enquiry or account signup is not consent to unrelated promotional emails. We do not use this portal to make automated decisions producing legal or similarly significant effects about you.
4. Access, service providers and external links
Access is limited to the operator, authorised project personnel where needed, and service providers supporting hosting, email, security and maintenance. Client workspace access is restricted by project assignment. We may disclose relevant information when legally required or necessary to establish, exercise or defend legal claims.
The website and hosting-based email use Namecheap hosting infrastructure. WordPress runs the website; GoSMTP supports email handling, Loginizer supports login security, CookieAdmin manages cookie choices, and Backuply stores the configured website backups locally on the hosting account. These installed tools are not themselves evidence that project files are sent to a separate cloud backup or AI service.
Our public theme serves its fonts from our own hosting. Third party integrations and administrative tools may load their own resources, including fonts, under their respective privacy terms. Social-share links connect to LinkedIn, X or Facebook when you activate them; email sharing uses your chosen email application. These services process information under their own policies. Reference or prototype links can take you to other websites.
5. International processing
Cloudflare Turnstile protects our public enquiry and client-account forms against spam and automated abuse. Your browser connects to Cloudflare, which processes technical signals such as your IP address, browser/User-Agent information, TLS fingerprint, site key and website origin. Our server sends the verification token to Cloudflare; it does not send your form message or password as part of this verification. Our purpose is secure service delivery and preventing abuse, based on our legitimate interests under Article 6(1)(f) GDPR. Cloudflare acts as a processor for website protection and separately as a controller when improving its bot-detection capabilities, as described in its Turnstile Privacy Addendum. Processing may take place outside the EEA; see Cloudflare’s Privacy Policy for its processing and transfer information. Contact Email Prototyper with questions about our use of this security service.
Our operator is based in Lithuania, but hosting/support and external services can involve processing outside the European Economic Area, including the United States. Namecheap publishes a Data Processing Addendum containing standard contractual clauses for applicable transfers, alongside its privacy policy. You can request information about safeguards relevant to your data by emailing Email Prototyper. A provider policy does not mean all data stays within Lithuania or the EEA.
6. How long information is kept
Retention depends on the purpose, rather than a single automatic deletion period. Enquiries are kept while correspondence or a potential project remains relevant. Accounts and project materials are kept while needed for active service, agreed handover, support or outstanding obligations. Approval records and essential correspondence may be retained where needed to resolve disputes or substantiate contractual decisions. Accounting and legally required records follow applicable statutory requirements.
Technical and security records are assessed according to troubleshooting needs, investigation of abuse and any legal preservation requirement. Backup copies are retained for recovery needs and may contain older records until replaced or removed. Deleting a live record does not necessarily immediately remove it from a backup. Records no longer needed for these purposes should be deleted or anonymised; this site does not promise an automated account, project or backup deletion schedule. Contact us for an assessment or erasure request concerning your records.
Email verification links expire after 24 hours. Consuming a verification link removes its stored token record, not the entire account or related correspondence.
7. Your rights and complaints
Depending on the circumstances, you may request access, correction, erasure, restriction or portability, and object to processing based on legitimate interests. You may withdraw consent without affecting processing lawfully undertaken before withdrawal. Rights are subject to applicable conditions and exceptions, including legal recordkeeping and claims.
Send requests to Email Prototyper. We may verify identity proportionately and normally respond within one month; where GDPR permits an extension, we will explain it. You may complain to Lithuania’s State Data Protection Inspectorate (VDAI), or the supervisory authority where you live, work or consider an infringement occurred.
8. Cookies and updates
Use Cookie Settings to review or change optional-cookie choices. Authentication requires essential cookies. You may also delete stored cookies using your browser settings.
We will update this notice when processing changes and communicate material changes where required. Questions: Email Prototyper.