Your data, handled plainly.

This policy explains what Schmitdy collects, why, which services help us run the site, how cookies and analytics work here, and the choices you have.

Last updated: 5 October 2026Effective: 5 October 2026

Who we are

Schmitdy helps companies get found and recommended in AI search. It was founded by Marco Lobo and works from London, United Kingdom, and Cologne, Germany.

Schmitdy is a trading name of Hyphen by Lobo Limited, which decides how your personal data is used on this website (the data controller).

For anything about your data, email marco@schmitdy.com. A person reads every message.

What we collect

We collect what you choose to give us, plus limited technical data about how the site is used.

Contact and company details when you request an audit, book a call or get in touch: name, work email, company, website, role and industry.
Audit context you share: competitors, the questions you want to be found for, current tools, how you heard about us, budget range, timing and notes.
Request data such as page address, referrer and time. To stop abuse of the audit form, we store a one-way hash of your IP address that changes every day, never the address itself.
Usage data: pages viewed, clicks, time on page, device type, browser and approximate country. How much of this we link to a returning browser depends on your cookie choice, explained below.
Session recordings, only if you allow cookies: a replay of how the page moved, where you scrolled and clicked. Anything typed into form fields is hidden before the recording leaves your browser.

How we use your data

We use your details to answer your request, prepare or deliver an audit, decide whether we can help, and tell you about closely related Schmitdy services. We use usage data to see which pages help visitors, fix what confuses them and keep the site secure. When you have allowed cookies and then fill in a form, we link your earlier visits to your enquiry so we understand what you read before getting in touch.

We do not sell personal data and we do not build advertising profiles.

Legal basis

Where UK GDPR or EU GDPR applies, we rely on:

Steps you ask for before a contract, and performing a contract, for audit requests, calls and client work.
Consent for analytics cookies, session recordings and linking your visits to your enquiry. You can withdraw it at any time with the cookie settings button below.
Legitimate interests for anonymous visit counting without cookies, abuse prevention, site security and following up on an enquiry you sent us.
Legal obligations, for example tax and accounting records for clients.

Cookies and analytics

When you first visit, we ask whether you are happy with analytics cookies. Until you choose, and if you say no, we set no analytics cookies and store nothing for analytics in your browser.

We still count visits anonymously. Vercel Web Analytics and PostHog's cookieless mode count page views without storing anything on your device. PostHog turns your IP address and browser details into a code that changes every day and cannot be traced back to you, then discards the IP address. That means we see a visit, not a visitor.

If you allow cookies, PostHog can recognise your browser when you come back, follow your path across pages and make session recordings. You can change your mind at any time. Saying no later stops recordings and deletes the analytics cookies we set.

These are the cookies and browser storage the site uses:

Cookies and browser storage on schmitdy.com
Name	Set by	What it does	How long	Needs your consent
schmitdy_consent	Schmitdy	Remembers your cookie choice so we stop asking	6 months, or 30 days if you close the banner	No, it stores your choice
schmitdy_analytics_opt_out and schmitdy:analytics-opt-out (cookie and local storage)	Schmitdy	Keeps our own team's visits out of the numbers	Cookie: 12 months. Local storage: until you clear it	No
schmitdy:audit-booking (session storage)	Schmitdy	After you request an audit, carries your name, email, how you heard about us, whether the request qualifies for a call, a booking reference and where your visit came from to the booking calendar, so you do not type them twice	Until you close the tab	No, it delivers the booking you asked for
ph_…_posthog and __ph_opt_in_out_… (cookie and local storage)	PostHog, on our domain	Recognises a returning browser, joins pages into one visit, runs session recordings and remembers that you allowed this	12 months	Yes
schmitdy:acquisition-visit (session storage)	Schmitdy	Remembers which page or campaign brought you, so a booking is credited correctly	Until you close the tab	Yes
schmitdy:analytics-navigation-ledger (local storage)	Schmitdy	Spots automated browsing so bots do not skew the numbers	Until you clear it. Entries older than 10 minutes are ignored and removed on your next page view	Yes
schmitdy:deliverable-visits:… (local storage)	Schmitdy	Counts return visits to a report or proposal we shared with you	Until you clear your browser storage	Yes
NEXT_LOCALE	Schmitdy	Remembers your language version of the site	12 months	No, it shows the site in your language
CANVAS_CCY and CURRENCY_OVERRIDE	Schmitdy	Show prices in your currency	30 days and 12 months	No, it shows prices in your currency
Calendly cookies	Calendly, inside the booking calendar	Run the booking calendar when one is shown on the page	Set by Calendly	Calendly's own policy applies

Service providers

We use a small number of providers to run the site and handle enquiries. They act on our instructions and may only use the data for these purposes.

Vercel (United States and EU): website hosting, cookieless web analytics and BotID abuse protection on our own domain.
PostHog (United States): product analytics and, with your consent, session recordings. Events reach PostHog through our own domain.
Supabase: secure storage of form submissions and leads.
Resend: transactional emails, such as confirming your audit request.
Calendly: call booking. After an audit request, the booking calendar receives your name and email as prefilled details when it loads, even if you do not book.

How long we keep data

We keep personal data only as long as we need it for the reason we collected it.

Enquiries and audit requests: while we are in contact, then up to three years after our last contact, unless a contract requires longer.
Client records: as long as tax and accounting law requires, usually six years after the end of the financial year.
Analytics events: up to two years, then deleted.
Session recordings: deleted automatically after 30 days.
The daily IP hash used against form abuse: cannot be linked back to an address and is not kept beyond its purpose.

Security

We use proportionate technical and organisational safeguards, including encrypted connections, access controls and masking of form fields in recordings. No internet service is free of risk, and we will tell you and the regulator if a breach affects you where the law requires it.

International transfers

Vercel and PostHog process data in the United States. Where data leaves the UK or the EU, we rely on recognised safeguards: the UK and EU adequacy arrangements for certified US companies, or standard contractual clauses with the UK addendum.

Your rights

Depending on where you live, you can ask to see, correct, delete or receive a copy of your data, to restrict or object to how we use it, and to withdraw consent at any time. Email marco@schmitdy.com and we will reply within one month.

You can also complain to a data protection authority. In the UK that is the Information Commissioner's Office (ico.org.uk). In Germany you can contact the authority in your state; ours is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (ldi.nrw.de). We would welcome the chance to sort it out with you first.

Changes to this policy

We update this policy when our website, services or legal duties change. The date at the top shows the current version. If a change matters, for example a new kind of tracking, we will ask for your cookie choice again.