Privacy Policy

This policy explains what personal information Citadels Development (“we”, “us”) collects through citadels.dev and its administration site, why, who processes it on our behalf, and the choices you have. We have kept it short because we collect very little.

What we collect

When you write to us

The contact form on The Council asks for your name, email address, a topic, an optional subject and your message. With each message we also store a one-way, salted hash of your IP address and your browser’s user-agent string. We use these only to stop spam and abuse; the hash cannot be turned back into your IP address.

When you apply for an opportunity

Applications include your name, email address and anything else you choose to give us: a portfolio link, your location and availability, a cover letter, answers to the role’s questions and, optionally, a CV as a PDF. We store a salted hash of your IP address for the same anti-abuse reason. CVs are kept in private storage that is never publicly accessible; only the studio’s owners and administrators can open them, and every download is logged.

When you email us

If you email us directly, we keep the correspondence so we can reply and keep a record of the conversation.

When you simply browse

The public site sets no cookies and uses no advertising, tracking or analytics cookies. Our hosting and network providers process technical information such as your IP address, browser type and the pages requested, in short-lived server logs, so that the site can be delivered and protected from attacks. If spam protection is switched on for our forms, our spam-protection provider checks your browser when you submit a form.

Studio staff

Accounts on the administration site belong only to people working with the studio. For them we store a name, email address, a hashed password, two-factor settings, session cookies, and an audit log of administrative actions with the IP address they came from.

How we use it

• To read and reply to your message.
• To consider your application and contact you about it.
• To run, secure and improve the site, and to prevent spam and abuse.
• To meet legal obligations.

We do not sell or rent personal information, we do not use it for advertising, and we do not build profiles of visitors.

Who processes it for us

We use a small number of service providers, who process information only on our instructions:

• a hosting provider, which runs the website and administration site;
• a database provider, which stores messages, applications and site content;
• a network and storage provider, which runs our domain, stores uploaded files (including CVs, in private storage), forwards email sent to our addresses and, if enabled, provides spam protection for our forms;
• an email delivery service, which sends the notification and account emails the site generates.

These providers may process information in the United States and other countries. We may also disclose information if the law requires it, or to protect the rights and safety of the studio and others.

How long we keep it

We keep messages and applications only as long as we need them: to reply, to consider an application and to keep a reasonable record of our conversations. We delete applications within twelve months of a decision on the role, unless you ask us to keep yours for future opportunities. You can ask us to delete your information sooner at any time.

Your choices and rights

You can ask us to show you the personal information we hold about you, to correct it, or to delete it. Write to support@citadels.dev and we will reply within 30 days. Depending on where you live (for example in the European Union, the United Kingdom or California), you may have further rights, such as objecting to certain uses or asking for a copy of your data in a portable format, and you may complain to your local data protection authority.

Security

Everything is sent over encrypted connections (HTTPS). The public site connects to the database with a restricted account that cannot read messages or applications. Staff sign in with strong passwords and two-factor authentication, and administrative actions are logged. No system is perfectly secure, but we take reasonable care to protect what you send us.

Children

This site is not directed at children under 13, and we do not knowingly collect their personal information. If you believe a child has sent us information, contact us and we will delete it.

Changes to this policy

If we change this policy, we will update it here and change the date at the top. If a change is significant, we will say so on the site.

Contact

Questions about this policy or your information: support@citadels.dev.