Legal.
Company identity, data practices, and exactly what the cookie banner does — which is the bare minimum we need to handle a contact form without tracking you.
Who runs this site.
KEYSER SOZE SRL is a Belgian private limited company (société à responsabilité limitée) registered in Brussels. This website is the sole property of the company. Editorial responsibility and data-controller duties sit with the managing partner.
For press, partnership, or legal notices, use the contact page. Written correspondence to the registered seat above is also accepted.
Data practices.
The short version: this site doesn’t profile you. No advertising pixels, no session replay, no fingerprinting, no cross-site trackers, no third-party embeds that phone home. The only measurement we run is privacy-first and cookieless — Plausible for aggregate visit counts and Sentry for error monitoring — and only if you accept analytics in the banner. Fonts are self-hosted, so your browser never calls a CDN just to render a headline.
What the cookie banner actually does
On your first visit you’ll see a small banner at the bottom
of the page asking you to pick “Necessary only” or
“Accept all.” Your choice is stored in your
browser’s localStorage under the key
ks-consent so the banner doesn’t nag you on the
next page load. We don’t set HTTP cookies for the banner
itself. The record expires when you clear site data.
What “Necessary” covers
- Sending your contact-form message to us by email so we can read and reply.
- Anti-spam checks on that submission (rate limiting, basic heuristics — no third-party captcha today).
- The consent record itself, so the banner remembers your choice.
That is the entire scope of “Necessary.” It does not include analytics, personalisation, advertising, or any profile we could build about you.
What “Analytics” covers
Privacy-first analytics via Plausible (cookieless, aggregated, no personal identifiers) and error monitoring via Sentry. Neither service sets tracking cookies or builds personal profiles. If you choose “Necessary only,” these services are not loaded.
What we don’t collect
- No HTTP cookies. The consent record is the only client-side state we write, and it lives in
localStorage. - No Google Analytics, Meta Pixel, Hotjar, or equivalent.
- No cross-site trackers or advertising identifiers.
- No social media widgets that load third-party scripts.
What we do collect
Only what you voluntarily send us through the contact form. That is: your name, email address, an optional company or role, and the message body. When you submit, that message is delivered to us by email (sent through Resend) and kept in our inbox — we don’t store it in a database. If you tick the opt-in on the form, your email address is also added to our Mailchimp audience for occasional notes from the operator — you can unsubscribe from any email we send, in one click.
Server-side logs
This site is hosted on Vercel. As the platform serving the pages, Vercel keeps the standard operational logs any web host keeps: request timestamp, status code, IP address, and user agent. These platform logs are short-lived, governed by Vercel’s own retention, and not joined by us to any identity, profile, or marketing system.
Where your data lives
- Site hosting — Vercel (US-based, global edge network; EU transfers under Standard Contractual Clauses).
- Form submissions — delivered to our inbox by email via Resend (US-based, under Standard Contractual Clauses); not stored in a database.
- Mailing list (opt-in only) — Mailchimp, under its Standard Contractual Clauses for US transfers.
The Client Dashboard
Active clients access their deliverables through a separate application — the Client Dashboard at client.keysersoze.be. It is access-controlled: you sign in with a one-time magic link (or a password) and see only the documents assigned to your company. Sign-in and the deliverables are handled by Supabase; magic-link emails are sent via Resend. The marketing site you are reading now and the dashboard are distinct systems — nothing you do on this site creates a dashboard account.
Your rights under GDPR
You can ask us to access, export, correct, or delete your personal data at any time. We comply within one month and usually much faster — this is a small shop. You can also complain to the Belgian Data Protection Authority if we fall short.
Reach us.
Data-access, correction, or deletion requests go through the contact page. Put “DSR” or “GDPR request” in the subject so it lands on the right reading pile. You can also write to the registered seat printed above.