Privacy Policy

We only collect what you give us or what's needed to run the site:

• Contact details you submit: name, email, business name, and anything you write in a form or message.
• Project information you share with us while we scope and build your site.
• Technical data sent with a form submission: your IP address and browser user-agent, kept with the inquiry to help us prevent abuse and answer you.
• Basic usage data: pseudonymized analytics (with your consent) such as pages viewed, approximate region, and device type.

We do not collect payment card numbers on this site. Payments are handled by our payment provider, and we never see or store your full card details.

• To reply to your inquiry and send the homepage design or quote you asked for.
• To deliver, support, and improve the website we build for you.
• To send service messages about your project or hosting (not marketing, unless you opt in).
• To understand, in aggregate, how our site is used so we can make it better.

We do not sell your personal data, and we never will.

Where the GDPR applies, we rely on: your consent (for optional analytics and any marketing email), performance of a contract (to deliver a project you've engaged us for), and our legitimate interest in running and improving the site, balanced against your rights.

We use a small number of cookies to keep the site working. With your consent, we also use Microsoft Clarity, an analytics and session-replay tool, to understand how the site is used: it records page views, clicks, scrolling, and basic device and browser information.

With the same consent, we use Google Analytics 4 to see which pages people visit, where they arrive from, and which routes through the site lead to an inquiry. It is measurement only: we do not use it to build advertising audiences, and it never loads before you accept.

With the same consent, we use the Meta Pixel together with the Meta Conversions API to measure how our advertising performs, so we can see which visits and inquiries followed an ad. When you submit the contact form, we send Meta a record of that event that includes a one-way hashed (irreversible) version of your email address, plus your IP address and browser user-agent, which Meta uses to match the event to an account for measurement. We do not send Meta your name, message, or the plain-text email.

Nothing above loads or is sent until you say yes, and you can change your choice at any time via the “Cookie settings” link in the footer. See our Cookie Policy for the full detail.

If we design a homepage for your business, we may send you a private link to it, on an address of its own under nelanor.studio (for example yourbusiness.nelanor.studio). Opening the link sets one cookie on that address only, which keeps it open on that device and holds no personal data. The page records, on our own server and nowhere else, when it was opened, whether the design was scrolled, and which button was pressed, together with any note you type. No analytics, advertising or session-replay tool runs on these pages. We use the record to know whether you have seen the design and to follow up accordingly. An unanswered preview closes after 30 days; the design files are then deleted, and a “Not for me” answer is kept as an instruction not to contact you again about it.

If you approve the design, the same address becomes your project page. It keeps the order you confirmed (plan, pages, price, the time, and your IP address, as the record of the agreement), anything you send us through it (your logo, photos, domain details and notes, stored on our server and never published), and the state of the project. It stays open for as long as you are a client.

When you pay, you do so on a page hosted by Stripe (Stripe Payments Europe, Limited and Stripe, Inc.), which processes your name, email, card and billing details under its own privacy policy at https://stripe.com/privacy. We receive confirmation of the payment, the amount, and Stripe's reference numbers for you and your subscription. We never receive or store your card number.

We share data only with the service providers that help us operate, for example hosting, email, analytics, and payment processing. Each is bound to handle your data securely and only on our instructions. We may also disclose data if the law requires it.

If you consent to analytics, Microsoft Clarity (Microsoft Ireland Operations Ltd and Microsoft Corporation) acts as our data processor for analytics and session replay, processing page views, clicks, scrolling, and device and browser information on our behalf. Microsoft may process this data outside the EU under Standard Contractual Clauses. You can read the Microsoft Privacy Statement at https://privacy.microsoft.com/privacystatement.

If you consent to analytics, Google Ireland Limited (and Google LLC) acts as our data processor for Google Analytics 4, processing page views, referral source, approximate location derived from a truncated IP address, and device and browser information on our behalf. Google may process this data in the United States under Standard Contractual Clauses. You can read Google's Privacy Policy at https://policies.google.com/privacy.

If you consent, we also share advertising-measurement events with Meta Platforms Ireland Limited (and Meta Platforms, Inc.) via the Meta Pixel and Conversions API: a hashed email, IP address, and user-agent for the events described above. For this ad-measurement data Meta acts as an independent controller / joint controller under its own terms; it may process the data in the United States under Standard Contractual Clauses. See Meta's Privacy Policy at https://www.facebook.com/privacy/policy and its Cookies Policy at https://www.facebook.com/privacy/policies/cookies.

We keep inquiry data for as long as needed to follow up, and project and billing records for as long as the law requires. When data is no longer needed, we delete or anonymize it.

Depending on where you live, you may have the right to:

• Access the personal data we hold about you.
• Correct anything that's inaccurate.
• Ask us to delete your data.
• Object to or restrict certain processing.
• Receive a copy of your data in a portable format.
• Withdraw consent at any time, without affecting past processing.
• Lodge a complaint with your local data-protection supervisory authority (in Estonia, the Estonian Data Protection Inspectorate / Andmekaitse Inspektsioon).

To exercise any of these, email info@nelanor.studio. We'll respond within the time the law allows.

We protect your data with encryption in transit (HTTPS), access controls, and reputable infrastructure providers. No method of transmission is perfectly secure, but we take reasonable steps to keep your information safe.

Some of our providers may process data outside your country. Where that happens, we rely on appropriate safeguards (such as Standard Contractual Clauses) so your data stays protected.

Our services are for businesses and are not directed at children under 16. We don't knowingly collect their data.

If we make material changes, we'll update the date at the top of this page and, where appropriate, let you know directly.

Questions or requests about your privacy? Email info@nelanor.studio and we'll help.