Privacy

Last updated 22 September 2026.

This policy covers horoma.studio, horoma.school, and critiques.horoma.school. All three are run by the same company, so one policy covers all three rather than three that could drift out of sync.

Who we are

Horoma Ltd, 19 Lavele Str, 1000 Sofia, Bulgaria, is the data controller for everything below. For anything privacy-related, write to admin@horoma.school (school platform, critiques, course) or admin@horoma.studio (studio site, client work). Either reaches the same person: Simon Oudiette, the founder, who reads and answers these himself.

What we collect, and why

If you're a student on the school platform: your email address, and your country (used to apply purchasing-power parity pricing and VAT, not to track you). Login is a magic link sent to your email, so we don't store a password. We keep a record of your enrollment, what you've paid, and your progress through the course, because that's what makes the course actually work: knowing where you left off, what you've unlocked, and what you're owed if something goes wrong with a payment. If you write yourself a note on a lesson or favorite something, that's stored too, tied to your account, so it's there next time you log in.

If you buy a critique (a one-off teardown, not the full course), the same purchase and account records apply, scoped to that purchase.

If you're a studio client, using the client portal: your project name, whatever files you send or receive through it, and, if you fill in the intake or survey forms, whatever you write there. Uploaded files are deleted from storage once you've retrieved them; the portal link itself expires after 180 days of inactivity.

If you contact us, through a contact or support form: whatever you put in the message, plus your email so we can reply. If a Turnstile challenge runs on a form, that's Cloudflare checking you're not a bot, not us profiling you.

If you're invoiced, for the course, a critique, or studio work: your name, billing address, and VAT number, held in our invoicing system, because tax law requires it.

We do not sell, rent, or trade any of this to anyone, for any reason.

Who else touches this data

We're a small operation and we keep as much in-house as we can, but a few services are genuinely necessary to run a course platform and a studio:

• Cloudflare hosts the sites, the database, file storage, and payment gating. Cloudflare processes data on our behalf under its own data processing terms.
• Stripe handles payment. We never see or store your card details; Stripe does, under its own terms, and is itself PCI-compliant.
• SMTP2GO delivers transactional email (login links, receipts, notifications). It sees your email address and the content of what we send you.
• Proton hosts our business mail.
• Invoice Ninja, our invoicing system, runs on our own hardware, not a third party's, so client and student billing data stays under our own roof rather than passing through another company's servers.

None of these companies get to use your data for their own purposes. They process it because we've asked them to, to make the thing you're using work.

What we do not do

This is worth being specific about, because it's unusual and it's deliberate:

• No analytics, no tag manager, no advertising pixel, no session recording.
• No Google Fonts or other third-party font or script loading that phones home.
• No third-party tracking cookies. The only cookie either site sets is the one that keeps you logged in, and it only exists because you logged in.
• The only third party your browser ever talks to directly, on either site, is a YouTube embed on critique pages (using YouTube's privacy-enhanced youtube-nocookie mode, and only loading after you click play, not automatically) and, on the client portal, a map lookup through OpenStreetMap's geocoder if you enter a project address.

Cookies

The only cookie we set is a login session cookie, and it exists purely to keep you signed in between page loads. It's strictly necessary for the site to function; without it you'd have to reconfirm who you are on every click. Because it's strictly necessary and we set no other cookie, no tracking cookie, no advertising cookie, no analytics cookie, there's no consent banner. That's not an oversight; there's genuinely nothing here that needs your consent to run.

How long we keep things

Account and enrollment records are kept for as long as your account is active, and for as long afterward as tax and accounting law requires us to keep payment records (typically several years, set by Bulgarian and EU tax law, not by us). Support and contact messages are kept as a record of the conversation. Client portal files are deleted from storage once retrieved, as noted above; the database record of what was sent stays as a project record.

We don't currently run an automatic deletion schedule for account data beyond what's described above. If you want something deleted sooner, see the next section.

Your rights

Under GDPR, you can ask us to:

• See what we hold about you.
• Correct it, if it's wrong.
• Delete it, where we're not legally required to keep it (payment and invoicing records tied to tax law are the main exception).
• Export it, in a portable format.
• Object to how we're using it, or withdraw any consent you'd previously given.

Write to admin@horoma.school or admin@horoma.studio and we'll handle it by hand. We're a small operation with no self-service deletion button yet, so this goes through a real person, not a form that silently does nothing. If you're unhappy with how we've handled a request, you can complain to Bulgaria's data protection authority, the Commission for Personal Data Protection (CPDP), or your own country's equivalent if you're elsewhere in the EU.

Where your data goes

Cloudflare, Stripe, and SMTP2GO may process data outside the EU as part of their global infrastructure. Each operates under its own GDPR-compliant transfer safeguards (standard contractual clauses, in each case). Invoice Ninja and our business mail archive stay on our own hardware in the EU.

Children

The course and the studio's services are aimed at working professionals and students of architecture and visualization, not children. We don't knowingly collect data from anyone under 16.

Changes

If this policy changes in a way that matters, we'll update the date at the top. Significant changes, anything that changes what we collect or who we share it with, get a note on the site, not a silent edit.