Privacy Policy
Last updated: 20 August 2026
1. Who runs this site
SA STUDIO is an independent project run by Aleksandar Stojkovic, based in Serbia. It offers Discord server design, custom bot development and a few free tools, at https://sa-studio.xyz.
It isn't currently a registered company or freelance business, which is why there's no registration number or business address on this page. That may change if SA Studio grows into something that needs to be registered, and this page will be updated if it does.
For anything to do with privacy, or to use any of the rights in section 9, email contact@sa-studio.xyz and put "Privacy request" in the subject line so it doesn't get lost among project emails.
2. Who might see your information
Most of the time it's just me. If a project needs an extra pair of hands, I sometimes bring in a trusted collaborator and give them their own login to the admin area, scoped to what they actually need for that project. They're expected to keep whatever they see confidential and use it only for the work I've asked them to do, not for anything else.
This isn't a permanent team and it doesn't happen on every project. It's occasional help, and it's still under my direction.
3. What we collect, and when
When you send an order
The order form asks for your name, email address and Discord username, plus what you want built, your budget range and any deadline. You can attach one image or PDF if you have something to show us. Everything in the description and the attachment is whatever you choose to type or upload, so please keep it to what the project needs.
Two things are recorded alongside that without you filling them in. If you reached the order form by clicking a link on another page of this site, we record which page that was, so we can see what actually leads to enquiries. We also record the IP address the order came from, which is there to stop the form being flooded with spam. It isn't used for anything else, and we clear it after 90 days while keeping the order itself.
When we email each other
Emails we send you about an order are saved so there's a record of what was agreed and when. Emails you send us sit in our mailbox in the ordinary way. If you send us something sensitive by email it stays there until we delete it, the same as any other message.
When you just visit
We keep a basic record of which pages get viewed and which site referred you, so we know what's worth working on. To count visits without tracking anyone, your IP address is run through a one way hash together with the current date before anything is stored. We can't use the stored value to work back to your IP address, and because the date is part of it, the value changes every day, so it can't be used to follow you from one day to the next. No cookie is involved. We don't use Google Analytics or any other outside analytics service.
When you use one of the free tools
The Webhook Sender, Timestamp Generator and QR Code Generator run entirely in your browser. What you type into them never reaches us. When one of them successfully does its job, the page tells our server which tool it was and nothing else. What gets stored is the tool name, the word "use" and the time. No IP address, no identifier, and nothing you entered.
The Discord Profile Lookup works differently. The Discord ID you enter is sent to our server, which asks Discord for that user's public profile using our own credentials, so your Discord account is never involved. We hold on to the profile Discord sends back for a short time so that repeated lookups of the same ID don't hammer their API. A cached copy stops being used after five minutes, and it's deleted at the next cleanup, which runs daily and usually much sooner than that.
Logging and security
Failed admin login attempts and rate limiting records include an IP address. They're there to stop people brute forcing the admin area and abusing the forms, and they're deleted after 90 days. Actions taken inside the admin dashboard are recorded too, so there's a trail of who changed what.
Our AI design tool
We use an AI tool internally to draft server structures. It lives in our admin area, not on the public site. It doesn't automatically pull anything from your order, your name or your contact details. What it receives is a short description of the kind of community being built, typed in by us, and we're asked not to put personal information in there unless it's genuinely needed for the request.
Your browser
This site stores a small amount of information in your own browser, including a login and form security cookie and your Light or Dark preference. Our Cookie Notice lists all of it.
4. What we don't do
- We never see or store your card or PayPal details. If we agree on paid work, payment happens between you and PayPal, not on this site.
- No advertising trackers, no marketing pixels, no third party analytics.
- We don't sell your data, and we don't hand it to anyone for their own marketing.
- We don't ask for anything sensitive, like health, financial or identity documents. If a project description happens to touch on something personal, we'd rather you left out whatever we don't need to know.
5. Why we're allowed to use it
Under the Serbian Law on Personal Data Protection we need a proper reason for using your information. Ours are:
- Doing what you asked. Reviewing your order, quoting for it, talking to you about it and delivering the work. That covers your name, contact details, project description and any file you send. In legal terms this is a contract, or the steps leading up to one that you asked us to take. It isn't consent, so there's no consent here for you to withdraw. If you'd rather we stopped, tell us and we'll stop.
- Keeping the site working and safe. Rate limiting, spam prevention, login protection, and knowing which pages people actually use. That's our legitimate interest, and it's why those records are kept short.
- Keeping records we're required to keep. Some paperwork around paid work has to be retained for a set period. See section 7.
6. Who else is involved
- Our hosting and email provider. The site, its database, uploaded files and our mailbox all sit on hosting we rent, so the provider holds that data on our behalf.
- Discord. Only when you use the Profile Lookup, and only the user ID being looked up. Your browser also loads avatars and banners straight from Discord's image servers while you're on that page. SA STUDIO isn't affiliated with, endorsed by or sponsored by Discord.
- Anthropic. They run the AI model behind our internal design tool. What goes to them is the short project description we type in ourselves. Nothing is pulled from your order, your name or your contact details automatically, and we're asked to keep personal information out of that description unless it's genuinely needed.
- PayPal. Only if we agree on paid work, and entirely between you and them. Nothing about the payment passes through this site.
We used to load fonts from Google on every page, which quietly handed Google your IP address for no good reason. Those font files are served from our own server now, so that no longer happens.
7. How long we keep things
Different things need keeping for different lengths of time, so here's the actual list rather than a vague promise. A cleanup job runs daily and removes whatever has passed its point, so the times below are when something becomes due for deletion rather than the exact second it disappears.
- Failed logins and rate limiting records: 90 days.
- The IP address attached to an order: cleared after 90 days. The order stays.
- Visit statistics: 14 months, in the hashed form described above.
- Tool use counts: kept indefinitely. A row is a tool name and a timestamp, so there's nothing in it that relates to a person.
- Discord lookup cache: stops being used after five minutes and is deleted at the next cleanup. Cleanup runs daily, and normally sooner.
- Uploaded files: deleted along with the order they belong to.
- Orders and the emails about them: kept while we're working on the project, and afterwards as a business record. Records connected to paid work have to be kept for a period set by Serbian accounting and tax rules, and we're confirming exactly what that period is. Rather than print a number we're not sure of, we'll update this line once it's settled. If you want your order data gone before then, ask us and we'll delete whatever we aren't required to keep.
8. Providers outside Serbia
Some of the companies above are based outside Serbia, and their systems may be as well. That means your information can be handled in another country when we use those services.
We're still working through which safeguards apply to each provider, and we'd rather say so plainly than claim an arrangement is in place before we've checked it. If this matters to you, email us about a specific provider and we'll tell you what we know.
9. Your rights
You can ask us to:
- tell you what we hold about you, and give you a copy
- correct anything that's wrong
- delete your data
- stop or limit what we're doing with it, including objecting to it
- hand over a copy in a portable format, where that right applies
Email contact@sa-studio.xyz to use any of these. So that we're not handing someone's project details to a stranger, please write from the email address on the order and quote your order number, or give us enough detail to find the right record. For deletions we'll write back to that address to confirm before anything is removed. We won't ask you for a copy of your ID.
We'll normally come back to you within a month. If something has to stay because the law requires it, we'll tell you what and why rather than quietly keeping it.
If you're in Serbia and you're unhappy with how we've handled it, you can complain to the Commissioner for Information of Public Importance and Personal Data Protection (Poverenik). If you're in the EU or EEA, you can complain to your national data protection authority.
10. Children
This isn't a service aimed at children, and Discord itself requires users to be at least 13. We don't knowingly collect information from children. If you think a child has sent us something, email us and we'll remove it.
11. Changes to this page
If the site changes, this page changes with it. The date at the top is set by hand and only moves when something here has actually been rewritten.
12. Contact
Questions about any of this? Email contact@sa-studio.xyz.