05 // legal & data protection
privacy policy, telemetry transparency, and cookie management.
2sh operates with an engineering-first, minimal-telemetry standard. We believe clients and visitors deserve total clarity regarding what runs in their browser, what data leaves their device, and how commercial inquiries are handled.
2sh (Thorian Security OÜ)
Tallinn, Estonia (HQ)September 2026
Version 1.2AKI (Estonia)
GDPR Art. 56hello@2sh.studio
Direct response within 48hyour current cookie preferences
You can modify or revoke your analytics cookie consent at any time. Revoking consent instructs HubSpot's tracking code to cease non-essential tracking immediately (doNotTrack) and clears analytics state.
data controller & studio entity
This website is operated by 2sh (Thorian Security OÜ), registered in Tallinn, Estonia (European Union). For all inquiries regarding data protection, consent withdrawal, or supervisory inquiries under the General Data Protection Regulation (GDPR), contact us directly at hello@2sh.studio.
telemetry & tracking code
We operate our marketing site with a zero-hydration, minimal-telemetry architecture. We load the HubSpot tracking code (hosted via HubSpot's EU infrastructure at js-eu1.hs-scripts.com) solely to analyze aggregate site traffic, evaluate campaign performance, and understand how visitors discover our engineering services. HubSpot scripts run with async and defer attributes and respect your explicit cookie choices.
information we collect
We collect personal information through two primary vectors: direct inquiries and analytical telemetry.
• Inbound Inquiries: Direct inquiries arrive by email to hello@2sh.studio. The self-serve check form at /check collects a page URL, an email address, and a Cloudflare Turnstile token; the form is processed at the edge via Cloudflare Workers and dispatched to our internal n8n orchestration system, which runs the page-speed check, emails you the full report, and records the inquiry. • Bot Mitigation: We verify contact submissions using Cloudflare Turnstile, a privacy-preserving challenge that mitigates automated spam without harvesting behavioral or biometric data across the web. • Analytics Data: When analytics cookies are accepted, HubSpot processes anonymized IP addresses, browser and device user-agent data, referring domains, session duration, and pages viewed.
legal bases for processing (GDPR)
Under Article 6 of the GDPR, we process personal data under the following legal frameworks:
• Consent (Art. 6(1)(a) GDPR): Analytics and marketing telemetry cookies are placed and read only after your explicit, affirmative opt-in via our cookie banner. • Contractual & Pre-Contractual Measures (Art. 6(1)(b) GDPR): Inbound project inquiries and diagnostic qualification requests are processed to evaluate project fit and prepare engineering proposals. • Legitimate Interests (Art. 6(1)(f) GDPR): Edge caching, request routing, serverless security logs, and DDoS mitigation via Cloudflare protect our infrastructure against malicious traffic.
cookie inventory & storage
We believe in complete transparency regarding client-side state. We partition storage into two distinct categories:
| name / token | provider | purpose | category | duration |
|---|---|---|---|---|
| theme | 2sh (First-party) | Persists your preferred interface appearance (light or dark mode) in localStorage. | Strictly Essential | Persistent (Local Storage) |
| cookie_consent | 2sh (First-party) | Records your cookie consent preference (accepted or declined) to prevent repetitive prompts. | Strictly Essential | 1 year (Local Storage) |
| __hstc / hubspotutk / __hssc / __hssrc | HubSpot EU (js-eu1.hs-scripts.com) | Monitors visitor sessions, unique visitor identifiers, and navigation paths for site analytics. | Analytics / Telemetry | Up to 13 months |
sub-processors & edge infrastructure
We do not sell, rent, or trade your personal data. We engage a minimal set of proven infrastructure providers to deliver our services:
• Cloudflare, Inc. (USA & Global Edge): Global CDN, edge compute (Workers/Pages), Turnstile challenge verification, and DNS routing under Standard Contractual Clauses (SCCs). • HubSpot Ireland Ltd. (EU): Telemetry and inbound contact record management, hosted in HubSpot's EU data center cluster. • n8n: Self-hosted/isolated workflow automation for secure routing of qualification inquiries to our principal engineers.
data retention & sovereignty
Commercial inquiry data is retained for the duration of the scoping dialogue and subsequent active contracts, plus applicable statutory commercial record-keeping periods (up to 7 years for tax and accounting compliance under Estonian law). Unconverted sales inquiries are purged after 24 months. Telemetry data in HubSpot is retained in accordance with HubSpot's data lifecycle or until an erasure request is received.
your statutory rights & deletion requests
Under the GDPR and international privacy regulations, you possess the right to:
• Access the personal data we hold about you (Art. 15 GDPR). • Request rectification of inaccurate or incomplete records (Art. 16 GDPR). • Request erasure of your data when retention is no longer justified (Art. 17 GDPR). • Restrict or object to processing under certain conditions (Arts. 18 & 21 GDPR). • Data portability for data provided under consent or contract (Art. 20 GDPR). • Withdraw consent for analytics tracking at any time with immediate effect.
You can initiate a formal data privacy request (including data erasure and access) directly via our privacy portal.
supervisory authority & contact
If you believe our processing of your personal data infringes applicable data protection legislation, you have the right to lodge a complaint with our lead supervisory authority:
Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate) Tatari 39, 10134 Tallinn, Estonia Email: info@aki.ee | Website: www.aki.ee
For any questions or to exercise your rights, email our team at hello@2sh.studio.
have questions about our data practices?
Contact our systems engineering team directly at hello@2sh.studio.