PRIVACY POLICY

INFORMATION WE COLLECT

We collect two categories of information:

• Information you give us. When you submit the contact form or email us directly, we receive your name, company or brand name, email address, any budget or model preferences you choose to share, and the content of your message.
• Information collected automatically. When you load the site, our hosting provider and analytics tools record technical data such as approximate location (city / country level), device type, browser, referring URL, and pages viewed. This data is aggregated and is not used to identify individual visitors.

HOW WE USE INFORMATION

We use the information we collect to:

• respond to inquiries and prepare proposals;
• send transactional emails relating to projects you have engaged us on;
• measure aggregate traffic to the site and improve its content and performance;
• comply with legal obligations and prevent abuse of the site.

We do not sell your personal information. We do not use your contact details to train AI models. We do not use the contact form to send unsolicited marketing.

LEGAL BASIS (EEA / UK VISITORS)

For visitors in the European Economic Area or the United Kingdom, we rely on the following lawful bases under the GDPR / UK GDPR:

• Legitimate interests - running and securing our website, responding to business inquiries, and measuring aggregate traffic.
• Consent - where you voluntarily provide information via the contact form or subscribe to a newsletter.
• Contract - where processing is necessary to deliver work to a client.

ANALYTICS

We use Vercel Analytics, a privacy-preserving analytics product that does not set cookies and does not fingerprint individual visitors. Aggregated metrics such as page views, country, and device type are recorded.

If we add additional analytics or advertising trackers in the future, this policy will be updated and (where required by law) a cookie banner will be shown.

SHARING

We share personal information only with:

• Service providers who operate the site and our business infrastructure under contract - currently Vercel (hosting and analytics) and Resend (transactional email delivery).
• Legal authorities where required by law, court order, or to protect our rights.
• Successors in connection with a merger, acquisition, or sale of assets, subject to confidentiality obligations.

We do not sell, rent, or trade personal information.

DATA RETENTION

Contact form submissions and related correspondence are kept for as long as needed to respond to your inquiry and, where relevant, for the duration of an engagement plus a reasonable period afterwards for tax, contractual, and legal reasons. Aggregate analytics data is retained for up to 24 months.

INTERNATIONAL TRANSFERS

May Kogel is based in Israel. Our service providers may store and process data in the United States, the European Union, and other jurisdictions. Where personal data is transferred outside the EEA or UK, we rely on adequacy decisions, Standard Contractual Clauses, or equivalent safeguards provided by the receiving party.

YOUR RIGHTS

Depending on where you live, you may have the right to:

• access the personal information we hold about you;
• request that we correct or delete it;
• object to or restrict certain processing;
• port your information to another service;
• withdraw consent at any time (without affecting past processing);
• lodge a complaint with your local data-protection authority. EU/UK residents can also contact the relevant supervisory authority directly.

To exercise any of these rights, message us via the contact form. We respond within 30 days.

AI-GENERATED CONTENT

May Kogel produces AI-generated imagery, video, and audio. The faces and bodies of our models are synthetic and do not depict real people. Where a campaign incorporates a real person (e.g., a client's spokesperson), we use their likeness only with their written permission and under the terms agreed with the client. We do not use information submitted through the contact form to train generative models.

SECURITY

We use reasonable technical and organisational measures to protect personal information - including encrypted transport (HTTPS), access controls on internal systems, and contractual confidentiality with service providers. No system is perfectly secure; if we become aware of a breach affecting your information, we will notify you where required by law.

CHILDREN

This site is not directed at children under 16, and we do not knowingly collect personal information from them. If you believe a child has provided us with personal information, please contact us and we will delete it.

CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date at the top of this page. Material changes will be highlighted on the site or communicated to you directly where appropriate.

CONTACT

For questions about this Privacy Policy, or to exercise your rights, message us via the contact form.

See also our Terms of Use.