What gets
stored.
Short version: the contact form keeps what you type so a reply can be sent, and analytics only run if you accept them. Nothing is sold, and nothing is shared for advertising.
Last updated 15 August 2026. This describes what the site actually does today; it is rewritten when the site changes rather than left to drift.
Who is responsible.
OOPUO, based in Amsterdam, the Netherlands, decides what is collected here and why — the data controller under the GDPR. For anything in this document, including a request to see or delete your data, write to hello@oopuo.com.
The contact form.
The form asks for a name, an email address, and a description of what needs hardening. It is submitted to HubSpot, the CRM used to keep track of enquiries, and stored there in the European Union (HubSpot's eu1 region).
Why: to read your enquiry and reply to it. You tick a box confirming that before anything is sent, and that tick is stored alongside the message so there is a record of what was agreed.
How long: for as long as there is a live conversation or an active client relationship, and up to 24 months after the last contact, so a returning enquiry has context. Ask and it is deleted sooner.
The form does not set a tracking cookie. HubSpot's tracking script is not loaded on this site, so a submission is not linked to any earlier anonymous browsing.
Analytics, only if you accept.
If you accept on the cookie banner, Google Analytics 4 loads and counts visits, which pages are read, roughly where visitors come from, and which links are followed. IP addresses are anonymised.
If you decline, the analytics tag is never loaded at all. It is not present in the page and does not run in the background — the banner is what causes it to be added, not merely what hides it. Declining costs one click and nothing on the site stops working.
Your choice is remembered in your browser's local storage under oopuo:consent:v1. That is not a cookie and is not sent to any server; it exists so you are not asked on every page. You can change it any time from cookie choices in the footer.
Who else sees it.
HubSpot
CRM. Receives what you type into the contact form. Data is held in HubSpot's EU region.
BasisProcessor acting on OOPUO's instructions.
Google Analytics
Traffic measurement. Loaded only after you accept. Involves a transfer to Google, including outside the EU under the applicable transfer safeguards.
BasisYour consent, withdrawable at any time.
Hostinger
Hosting. Serves the site and keeps standard server logs, which include IP addresses for a short period for security and troubleshooting.
BasisLegitimate interest in running the site securely.
Nobody else
No advertising pixel, no data broker, no profiling, no sale of personal data. Fonts and 3D libraries are served from this domain rather than a CDN, so loading the site does not announce you to a third party.
BasisNot applicable — no processing takes place.
What you can ask for.
Under the GDPR you can ask for a copy of what is held about you, ask for it to be corrected or deleted, ask for it in a portable format, object to processing based on legitimate interest, and withdraw consent at any time without affecting what happened before you withdrew it.
Write to hello@oopuo.com. Expect a reply within 30 days, and usually far sooner. If you are unhappy with the outcome you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens.
Still want the review?
The form asks for three things and stores exactly those three.