Privacy Policy

1. Summary

In plain terms: the only personal information we collect is what you type into our contact form and voluntarily send us. That information is emailed to us and is not stored in any database. We keep those emails indefinitely rather than on a deletion schedule, and if your enquiry becomes a project we also keep your contact details in a private client tracker — both are described in Section 7, and you can ask us to delete either at any time. We set no cookies, run no advertising trackers or tracking pixels, and our visitor analytics is cookieless and anonymous.

Our typefaces are hosted on our own servers, so no third party is contacted to render the pages you read. Two services can receive limited technical information if you visit specific pages: Cloudflare (an invisible bot check that runs on our contact page) and Cal.com (only on our booking page, and only if you ask for it). Both are described in detail below.

2. Information You Give Us

The Website has one form: the contact form on our Contact page. When you submit it, we receive only the fields you complete:

• First name and last name (required)
• Email address and/or telephone number — at least one is required so we can reply
• Business name (optional)
• Your current website address (optional)
• Reason for contact / service of interest (required)
• Budget range (optional)
• How you heard about us (optional)
• Preferred contact method (required)
• A free-text description of your project (optional)
• Confirmation that you agree to be contacted about your enquiry (required)

3. Information Collected Automatically

Analytics. We use Vercel Web Analytics to count page views and see which pages are read. It is cookieless: it sets no cookie and writes nothing to your device. Visitors are counted using an anonymous hash derived from the request, which Vercel discards after 24 hours, so you cannot be tracked from one day to the next or from this Website to any other. We receive aggregate figures only and cannot identify you from them.

We use no advertising trackers, tracking pixels, or session-recording tools of any kind.

IP address (abuse prevention). Two parts of this Website use your IP address briefly to stop them being flooded: the contact form when you submit it, and the security-reporting address described below. In both cases the address is never stored in readable form. It is immediately converted into an irreversible one-way hash (SHA-256 with a random secret that is regenerated every time the server restarts) and held only in the server's temporary memory, where each counter deletes it automatically when its window expires. For the contact form there are two such counters — one that stops the same sender submitting repeatedly, which expires after three minutes, and one that limits repeated submission attempts, which expires after ten minutes — while the security-reporting address uses a single counter that expires after sixty minutes. Nothing is retained beyond sixty minutes. None of it is ever written to disk, placed in a database, or converted back into your IP address.

Security reporting. Every page is served with a browser security policy, which we currently run in report-only mode so we can see what a stricter policy would block before we enforce it. If your browser meets something that policy would have blocked, it sends a short automatic report to an address on our own servers. That report names the page you were on and the kind of content involved. We deliberately record only the page address itself — never the part of a web address after a '?', and never the sample of the offending content that browsers offer — because those are the parts that could carry personal information. It is written to our server log and to nowhere else.

Server logs. Like all websites, our hosting provider records standard technical request information (such as IP address, timestamp, requested page, and browser user-agent) for security, reliability and abuse prevention. These logs are generated and retained by the hosting provider under its own policies, not by us. The one exception is the security-reporting line described above, which we generate ourselves.

Browser storage. The Website stores two values in your browser's sessionStorage and nothing else anywhere: the vertical scroll position of the page you were viewing, so that refreshing returns you to the same spot, and a flag recording that you closed the short privacy notice shown on your first page view, so it is not shown to you again. Neither contains personal information, neither leaves your device, neither is transmitted to us, and both are erased automatically when you close the browser tab. Our Cookie Policy describes both in full.

4. Cookies

This Website does not set any cookies. Our analytics is cookieless, and we use no advertising cookies or tracking pixels. Because nothing requiring consent is stored on your device, there is no cookie banner. Our Cookie Policy explains this in full.

One third-party service on a specific page may set its own cookies in your browser, and only if you ask for it: the Cal.com booking widget on our booking page. It does not load when the page opens. The page shows a short explanation and a button, and nothing is requested from Cal.com — and no cookie of theirs can be set — unless you press it. If you would rather not, the same page offers to take your booking by message instead. Any cookies that do result are set by Cal.com under its own policies, not by us. See Section 6.

5. How We Use Your Information

We use the information you submit only to:

• Reply to your enquiry and discuss your project
• Prepare a quote, scope or timeline you have asked for
• Schedule a call or meeting you have requested
• Keep ordinary business records of our correspondence
• Detect and prevent spam, fraud and abuse of the contact form
• Comply with law and enforce our agreements

We do not use your information for automated decision-making or profiling, and we do not add you to any marketing list. We will not send you promotional email unless you separately ask us to.

6. Third-Party Services We Actually Use

The following is a complete list of third parties that may receive information as a result of your use of this Website. Each provider handles that information under its own privacy policy.

Cal.com (Cal.com, Inc.)

Our booking page offers Cal.com's scheduling widget. It loads only on that page, and only when you press the button that asks for it — until then your browser contacts Cal.com not at all. If you load it and book a session, Cal.com collects the details you enter — typically name, email address, chosen date and time, and any notes — and processes them as an independent data controller under its own privacy policy.

Cloudflare Turnstile (Cloudflare, Inc.) — contact page only

Our contact form is protected by Cloudflare's invisible bot check. When you open the contact page, your browser contacts Cloudflare to run the check, transmitting your IP address and basic browser and network information for that purpose. It sets no cookie and stores nothing on your device. Cloudflare states this data is used only to distinguish humans from automated traffic, not for advertising or cross-site tracking. It runs on no other page.

Google (Gmail / Google Workspace)

Contact form submissions are delivered to us by email through Google's mail servers, and our inbox is hosted by Google. Google therefore processes and stores the contents of your message as our email provider. If your enquiry becomes a project, we also keep a client tracker in Google Sheets, which is part of the same Google account — so Google stores that record too. See Section 7.

Vercel Web Analytics (Vercel Inc.)

We use Vercel's cookieless analytics to count page views. It sets no cookie and stores nothing on your device. Vercel derives an anonymous hash from your request to count you once, then discards it after 24 hours. We see aggregate page-view figures, approximate referral source and general device type — never anything that identifies you. Vercel does not use this data for advertising.

Website hosting

The Website is hosted by Vercel Inc., which processes requests and maintains standard server logs in order to serve the site.

We have no advertising partners, no CRM, no payment processor, no chat widget, no maps embed and no video embeds on this Website. Our Facebook page is linked as an ordinary hyperlink only — no Facebook tracking code runs on this Website, and no information is sent to Facebook unless you click that link.

7. How Your Information Is Stored and Retained

Contact form submissions are not written to any database. They arrive as an email and stay in our email account, which is hosted by Google and can be read only by the owner of the business.

We do not delete them on a schedule. An enquiry stays in that account indefinitely unless you ask us to remove it. We would rather say that plainly than publish a tidy retention period we do not actually keep to — you can ask us to delete your enquiry at any time, and we will.

If your enquiry becomes a project, we also copy your contact details and information about the work into a client tracker kept in Google Sheets, so that we can run the project. Enquiries that do not become projects are never added to it. That file is private to the owner's Google account and is not shared with anyone. It is kept indefinitely on the same basis, and you can ask us to remove your entry.

The hashed IP values used for abuse prevention are deleted automatically, as described in Section 3 — after three minutes for the repeat-submission counter, after ten minutes for the repeated-attempt counter, and after sixty minutes for the security-reporting counter — and none is ever retained beyond that.

You may ask us to delete your enquiry sooner at any time using the contact details in Section 12.

8. Who We Share Information With

We do not sell personal information. We do not share personal information for cross-context behavioral advertising or targeted advertising, as those terms are defined under United States state privacy laws. We do not trade, rent or license your information to anyone.

We disclose information only in these situations:

• Service providers — the providers listed in Section 6, strictly to operate the Website and deliver our email
• Professional advisers — our accountant, attorney or insurer, where reasonably necessary and under a duty of confidentiality
• Legal and safety — where required by law, to respond to a lawful request, to enforce our agreements, or to protect the rights, property or safety of NuuLux, our clients or the public
• Business transfer — if our business is merged, acquired or sold, information may transfer to the successor, which would remain bound by this policy
• With your direction — where you ask us to share it

9. Information Security

We take security seriously and apply the following measures to this Website:

• All traffic is served over HTTPS encryption, with HTTP Strict Transport Security enforced
• A Content Security Policy restricts which external services the site may contact at all
• Contact form submissions are validated and sanitized on the server before use
• The form is protected by rate limiting and a spam honeypot
• Submissions are transmitted to our email provider over an encrypted TLS 1.2+ connection
• IP addresses are one-way hashed and automatically discarded, never stored in readable form
• Credentials are held in server-side environment variables and are never exposed to the browser

No website or method of transmission can be guaranteed to be completely secure. While we work to protect your information, we cannot guarantee that unauthorized access, loss, misuse or disclosure will never occur.

10. Do Not Submit Sensitive Information

Please do not send us sensitive personal information through the contact form. That includes Social Security numbers, government identification numbers, financial account or payment card numbers, login credentials, health or medical information, or precise geolocation.

We do not request or need this information to quote or deliver our services. If a project ever requires sensitive information, we will arrange a secure method separately.

11. Children's Privacy

This Website is intended for businesses and adults. It is not directed to children under 13, and we do not knowingly collect personal information from children under 13.

Separately, our Terms of Service require anyone using the Website to be at least 18, because that is the age at which a person can enter a binding contract. So while the under-13 rule above is the one COPPA sets, the Website is not intended for anyone under 18.

If you believe a child under 13 has submitted information to us, contact us at NuuLuxStudios@gmail.com and we will delete it promptly.

12. Your Privacy Rights and How to Exercise Them

Depending on where you live, you may have the right to request that we:

• Confirm whether we hold personal information about you, and provide a copy of it
• Correct information that is inaccurate or incomplete
• Delete information we hold about you
• Restrict or object to certain processing
• Withdraw consent you previously gave, at any time
• Not be discriminated against for exercising any of these rights

To make a request, email NuuLuxStudios@gmail.com with the subject line "Privacy Request," or call (910) 557-2032. Because we hold enquiries only as email, it helps if you tell us the email address or phone number you originally used so we can locate your message.

We will acknowledge your request within 10 business days and respond substantively within 45 days, extendable once by a further 45 days where reasonably necessary, and will tell you if we need more time. We may need to verify your identity before acting, which we will normally do by replying to the email address used in your original enquiry. Exercising these rights is free.

If you are unhappy with our response you may appeal by replying to our decision, and depending on your state you may also complain to your state Attorney General.

13. United States State Privacy Laws

Residents of states with comprehensive privacy laws — including California (CCPA/CPRA), Virginia, Colorado, Connecticut, Utah, Texas, Oregon and Montana, among others — have the rights described in Section 12, subject to the conditions of their state's law.

For California residents specifically: in the preceding 12 months we have collected the categories of 'identifiers' (name, email address, telephone number) and 'commercial information' (the details of the services you enquired about) described in Sections 2 and 3, from you directly, for the business purposes in Section 5. We have not sold or shared personal information as those terms are defined by the CCPA, and we do not process sensitive personal information. You may designate an authorized agent to make a request on your behalf; we may ask for proof of that authorization.

14. International Visitors and the GDPR/UK GDPR

We operate from the United States and our service providers are located in the United States. If you access the Website from outside the United States, your information will be transferred to and processed in the United States, where privacy laws may differ from those in your country.

If you are in the European Economic Area, the United Kingdom or Switzerland, our legal bases for processing are: your consent (which you give by ticking the box and submitting the contact form, and may withdraw at any time); our legitimate interests in responding to enquiries, keeping business records and preventing abuse of the form; and steps taken at your request prior to entering into a contract.

Where information is transferred to the United States, we rely on your explicit consent and on the necessity of the transfer to respond to your enquiry. Note that our typefaces are self-hosted, so normal browsing of this Website transmits nothing to any third-party font provider.

In addition to the rights in Section 12, you have the right to data portability and the right to lodge a complaint with your national data protection authority.

15. Links to Other Websites

The Website links to websites we do not control, such as our social media pages and, where we showcase completed work, client websites we have built. We are not responsible for the content, security or privacy practices of those websites. Review the privacy policy of any website you visit.

16. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices, the technology used on the Website, or the law. The current version is always posted on this page with its effective and last-updated dates.

If we make a material change — for example, if we begin using analytics or cookies — we will update this policy before that change takes effect.

17. Contact Us

Questions or requests about this Privacy Policy can be sent to:

Entity

NuuLux LLC

Email

NuuLuxStudios@gmail.com

Phone

(910) 557-2032

Website

nuulux.net (formerly nuuluxstudios.com)