Privacy Policy

1. Summary

In plain terms: the only personal information we collect is what you type into our contact form and voluntarily send us. That information is emailed to us and is not stored in any database. We set no cookies, run no advertising trackers or tracking pixels, and our visitor analytics is cookieless and anonymous.

Our typefaces are hosted on our own servers, so no third party is contacted to render the pages you read. Two services can receive limited technical information if you visit specific pages: Cal.com (only on our booking page) and Google Fonts (only on our hidden design-simulations page). Both are described in detail below.

2. Information You Give Us

The Website has one form: the contact form on our Contact page. When you submit it, we receive only the fields you complete:

• First name and last name (required)
• Email address and/or telephone number — at least one is required so we can reply
• Business name (optional)
• Your current website address (optional)
• Reason for contact / service of interest (required)
• Budget range (optional)
• How you heard about us (required)
• Preferred contact method (required)
• A free-text description of your project (optional)
• Confirmation that you agree to be contacted about your enquiry (required)

3. Information Collected Automatically

Analytics. We use Vercel Web Analytics to count page views and see which pages are read. It is cookieless: it sets no cookie and writes nothing to your device. Visitors are counted using an anonymous hash derived from the request, which Vercel discards after 24 hours, so you cannot be tracked from one day to the next or from this Website to any other. We receive aggregate figures only and cannot identify you from them.

We use no advertising trackers, tracking pixels, or session-recording tools of any kind.

IP address (contact form only). When you submit the contact form, our server briefly uses your IP address for abuse prevention. It is never stored in readable form: it is immediately converted into an irreversible one-way hash (SHA-256 with a random secret that is regenerated every time the server restarts) and held only in the server's temporary memory. Two separate counters use that hash and each deletes it automatically: one that stops the same sender submitting repeatedly, which expires after three minutes, and one that limits repeated submission attempts, which expires after ten minutes. Nothing is retained beyond ten minutes. It is never written to disk, never placed in a database, and cannot be converted back into your IP address.

Server logs. Like all websites, our hosting provider records standard technical request information (such as IP address, timestamp, requested page, and browser user-agent) for security, reliability and abuse prevention. These logs are generated and retained by the hosting provider under its own policies, not by us.

Browser storage. The Website stores a single value in your browser's sessionStorage — the vertical scroll position of the page you were viewing — so that refreshing returns you to the same spot. It contains no personal information, never leaves your device, is never transmitted to us, and is erased automatically when you close the browser tab.

4. Cookies

This Website does not set any cookies. Our analytics is cookieless, and we use no advertising cookies or tracking pixels. Because nothing requiring consent is stored on your device, there is no cookie banner. Our Cookie Policy explains this in full.

One third-party service embedded on a specific page may set its own cookies in your browser when that page loads: the Cal.com booking widget on our booking page. Those cookies are set by Cal.com under its own policies, not by us. See Section 6.

5. How We Use Your Information

We use the information you submit only to:

• Reply to your enquiry and discuss your project
• Prepare a quote, scope or timeline you have asked for
• Schedule a call or meeting you have requested
• Keep ordinary business records of our correspondence
• Detect and prevent spam, fraud and abuse of the contact form
• Comply with law and enforce our agreements

We do not use your information for automated decision-making or profiling, and we do not add you to any marketing list. We will not send you promotional email unless you separately ask us to.

6. Third-Party Services We Actually Use

The following is a complete list of third parties that may receive information as a result of your use of this Website. Each provider handles that information under its own privacy policy.

Google Fonts (Google LLC) — one hidden page only

The typefaces used across this Website are hosted on our own servers, so ordinary browsing contacts Google not at all. A single unlisted page — our design-simulations gallery, which is not linked from the site and is excluded from search engines — loads three decorative typefaces from Google's font servers. If you reach that page, your browser transmits your IP address and basic browser information to Google in order to fetch them. No other page does this.

Cal.com (Cal.com, Inc.)

Our booking page embeds Cal.com's scheduling widget. It loads only on that page. If you book a session, Cal.com collects the details you enter — typically name, email address, chosen date and time, and any notes — and processes them as an independent data controller under its own privacy policy.

Cloudflare Turnstile (Cloudflare, Inc.) — contact page only

Our contact form is protected by Cloudflare's invisible bot check. When you open the contact page, your browser contacts Cloudflare to run the check, transmitting your IP address and basic browser and network information for that purpose. It sets no cookie and stores nothing on your device. Cloudflare states this data is used only to distinguish humans from automated traffic, not for advertising or cross-site tracking. It runs on no other page.

Google (Gmail / Google Workspace)

Contact form submissions are delivered to us by email through Google's mail servers, and our inbox is hosted by Google. Google therefore processes and stores the contents of your message as our email provider.

Vercel Web Analytics (Vercel Inc.)

We use Vercel's cookieless analytics to count page views. It sets no cookie and stores nothing on your device. Vercel derives an anonymous hash from your request to count you once, then discards it after 24 hours. We see aggregate page-view figures, approximate referral source and general device type — never anything that identifies you. Vercel does not use this data for advertising.

Website hosting

The Website is hosted by Vercel Inc., which processes requests and maintains standard server logs in order to serve the site.

We have no advertising partners, no CRM, no payment processor, no chat widget, no maps embed and no video embeds on this Website. Our Facebook page is linked as an ordinary hyperlink only — no Facebook tracking code runs on this Website, and no information is sent to Facebook unless you click that link.

7. How Your Information Is Stored and Retained

Contact form submissions are not written to any database. They are sent to us as an email and retained in our email account for as long as needed to handle your enquiry and keep reasonable business records — ordinarily up to twenty-four (24) months from our last correspondence with you, unless a longer period is required for tax, accounting, insurance, legal or dispute-resolution purposes.

The hashed IP value used for spam prevention is deleted automatically — after three minutes for the repeat-submission counter and after ten minutes for the repeated-attempt counter, as described in Section 3 — and is never retained beyond that.

You may ask us to delete your enquiry sooner at any time using the contact details in Section 12.

8. Who We Share Information With

We do not sell personal information. We do not share personal information for cross-context behavioral advertising or targeted advertising, as those terms are defined under United States state privacy laws. We do not trade, rent or license your information to anyone.

We disclose information only in these situations:

• Service providers — the providers listed in Section 6, strictly to operate the Website and deliver our email
• Professional advisers — our accountant, attorney or insurer, where reasonably necessary and under a duty of confidentiality
• Legal and safety — where required by law, to respond to a lawful request, to enforce our agreements, or to protect the rights, property or safety of NuuLux, our clients or the public
• Business transfer — if our business is merged, acquired or sold, information may transfer to the successor, which would remain bound by this policy
• With your direction — where you ask us to share it

9. Information Security

We take security seriously and apply the following measures to this Website:

• All traffic is served over HTTPS encryption, with HTTP Strict Transport Security enforced
• A Content Security Policy restricts which external services the site may contact at all
• Contact form submissions are validated and sanitized on the server before use
• The form is protected by rate limiting and a spam honeypot
• Submissions are transmitted to our email provider over an encrypted TLS 1.2+ connection
• IP addresses are one-way hashed and automatically discarded, never stored in readable form
• Credentials are held in server-side environment variables and are never exposed to the browser

No website or method of transmission can be guaranteed to be completely secure. While we work to protect your information, we cannot guarantee that unauthorized access, loss, misuse or disclosure will never occur.

10. Do Not Submit Sensitive Information

Please do not send us sensitive personal information through the contact form. That includes Social Security numbers, government identification numbers, financial account or payment card numbers, login credentials, health or medical information, or precise geolocation.

We do not request or need this information to quote or deliver our services. If a project ever requires sensitive information, we will arrange a secure method separately.

11. Children's Privacy

This Website is intended for businesses and adults. It is not directed to children under 13, and we do not knowingly collect personal information from children under 13.

If you believe a child under 13 has submitted information to us, contact us at NuuLuxStudios@gmail.com and we will delete it promptly.

12. Your Privacy Rights and How to Exercise Them

Depending on where you live, you may have the right to request that we:

• Confirm whether we hold personal information about you, and provide a copy of it
• Correct information that is inaccurate or incomplete
• Delete information we hold about you
• Restrict or object to certain processing
• Withdraw consent you previously gave, at any time
• Not be discriminated against for exercising any of these rights

To make a request, email NuuLuxStudios@gmail.com with the subject line "Privacy Request," or call (910) 557-2032. Because we hold enquiries only as email, it helps if you tell us the email address or phone number you originally used so we can locate your message.

We will acknowledge your request within 10 business days and respond substantively within 45 days, extendable once by a further 45 days where reasonably necessary, and will tell you if we need more time. We may need to verify your identity before acting, which we will normally do by replying to the email address used in your original enquiry. Exercising these rights is free.

If you are unhappy with our response you may appeal by replying to our decision, and depending on your state you may also complain to your state Attorney General.

13. United States State Privacy Laws

Residents of states with comprehensive privacy laws — including California (CCPA/CPRA), Virginia, Colorado, Connecticut, Utah, Texas, Oregon and Montana, among others — have the rights described in Section 12, subject to the conditions of their state's law.

For California residents specifically: in the preceding 12 months we have collected the categories of 'identifiers' (name, email address, telephone number) and 'commercial information' (the details of the services you enquired about) described in Sections 2 and 3, from you directly, for the business purposes in Section 5. We have not sold or shared personal information as those terms are defined by the CCPA, and we do not process sensitive personal information. You may designate an authorized agent to make a request on your behalf; we may ask for proof of that authorization.

14. International Visitors and the GDPR/UK GDPR

We operate from the United States and our service providers are located in the United States. If you access the Website from outside the United States, your information will be transferred to and processed in the United States, where privacy laws may differ from those in your country.

If you are in the European Economic Area, the United Kingdom or Switzerland, our legal bases for processing are: your consent (which you give by ticking the box and submitting the contact form, and may withdraw at any time); our legitimate interests in responding to enquiries, keeping business records and preventing abuse of the form; and steps taken at your request prior to entering into a contract.

Where information is transferred to the United States, we rely on your explicit consent and on the necessity of the transfer to respond to your enquiry. Note that our typefaces are self-hosted, so normal browsing of this Website transmits nothing to any third-party font provider.

In addition to the rights in Section 12, you have the right to data portability and the right to lodge a complaint with your national data protection authority.

15. Links to Other Websites

The Website links to websites we do not control, such as our social media pages and, where we showcase completed work, client websites we have built. We are not responsible for the content, security or privacy practices of those websites. Review the privacy policy of any website you visit.

16. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices, the technology used on the Website, or the law. The current version is always posted on this page with its effective and last-updated dates.

If we make a material change — for example, if we begin using analytics or cookies — we will update this policy before that change takes effect.

17. Contact Us

Questions or requests about this Privacy Policy can be sent to:

Entity

NuuLux LLC

Email

NuuLuxStudios@gmail.com

Phone

(910) 557-2032

Website

nuulux.net (formerly nuuluxstudios.com)