Privacy policy

Information we collect

Information you give us

We collect information you choose to provide, including:

• your name, email address, phone number, and other contact details;
• your company, role, website, project details, and messages;
• information you provide when you book a call, submit a form, email us, or work with us; and
• business and payment information needed to prepare or perform a contract.

Please do not send sensitive personal information unless we specifically ask for it and it is necessary for the purpose we explain.

Information collected automatically

When you use the site, our hosting, content-delivery, and security providers may receive technical information needed to deliver and protect it. This can include your IP address, browser and device type, operating system, referring page, pages requested, timestamps, and diagnostic or security events.

If you allow optional analytics and media, Google Analytics and Wistia may also collect information about how you use the site or an embedded video. See “Cookies and similar technologies” below.

Information from other sources

If you book through Calendly or communicate through another service, that provider may send us the information needed to arrange and respond to your request. We may also receive business contact information from referrals, public professional profiles, clients, and partners.

How we use information

We use personal information to:

• respond to inquiries and communicate with you;
• arrange calls and prepare proposals;
• provide, operate, maintain, secure, and improve the site and our services;
• understand site performance when you allow optional analytics;
• play embedded case-study media when you allow optional media;
• administer client and supplier relationships, contracts, billing, and records;
• detect abuse, troubleshoot problems, and protect our rights and systems; and
• comply with legal obligations and resolve disputes.

Where applicable law requires a legal basis, we rely on your consent for optional analytics and media; steps requested before entering a contract and performance of a contract; our legitimate interests in operating, securing, and improving our business; and compliance with legal obligations. You can withdraw consent at any time through “Privacy choices” in the footer. Withdrawal does not affect processing that occurred before it.

Cookies and similar technologies

The site stores your privacy choice in your browser so it can remember whether you allowed or declined optional technologies. This preference is necessary to respect your selection.

Optional technologies stay off until you allow them:

• Google Analytics, loaded through Google Tag Manager, helps us understand aggregated site use and performance.
• Wistia delivers case-study videos and may use browser storage to operate the player and remember video progress.

Declining optional technologies does not prevent you from using the rest of the site. You can change your selection at any time through “Privacy choices” in the footer. If your browser sends a Global Privacy Control signal, we keep optional analytics and media off for that browser. Because there is no uniform industry standard for Do Not Track signals, the site does not respond separately to them.

Cloudflare Turnstile may process limited browser and device information when a protected form is present. We use it to distinguish people from automated abuse and protect the site.

When we share information

We disclose personal information only as needed for the purposes in this policy, including to:

• Vercel, which hosts and delivers the website;
• Sanity, which provides website content and media infrastructure;
• Google, for email and workspace services and, only after permission, Google Analytics and Google Tag Manager;
• Wistia, only after permission, to deliver embedded case-study videos;
• Cloudflare, for form security and abuse prevention;
• Calendly, when you choose to use its booking service;
• professional advisers, contractors, and service providers that support our business under appropriate obligations; and
• authorities or other parties when required by law, necessary to protect rights and safety, or involved in a merger, financing, acquisition, reorganization, or sale of assets.

Third-party services process information under their own terms and privacy notices. You can review the notices from Vercel, Sanity, Google, Wistia, Cloudflare, Calendly.

We do not sell personal information for money, and we do not use this site to share personal information for cross-context behavioral advertising.

How long we keep information

We keep personal information only as long as reasonably necessary for the purpose for which it was collected, including to provide services, maintain business and financial records, meet legal and contractual obligations, resolve disputes, and enforce agreements. The period depends on the type of information, our relationship with you, legal requirements, and whether the information is needed for security or an active claim. We delete or anonymize information when it is no longer needed, subject to backup and legal-retention requirements.

International transfers

Norml Studio is based in the United States, and our providers may process information in the United States and other countries. Those countries may have different privacy laws from the place where you live. Where applicable law requires it, we use recognized safeguards for international transfers.

Your privacy rights

Depending on where you live and which law applies, you may have the right to:

• ask for access to or a copy of your personal information;
• ask us to correct or delete it;
• object to or restrict certain processing;
• receive certain information in a portable format;
• withdraw consent; and
• appeal a decision or complain to a privacy regulator.

We do not discriminate against people for exercising applicable privacy rights. To make a request, email maxtymosh@norml.studio. We may need to verify your identity and authority before acting. You may also use an authorized agent where local law permits.

Security

We use reasonable administrative, technical, and organizational measures designed to protect personal information. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

Children

Our site and services are intended for businesses and are not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided it, contact us so we can review and delete it where appropriate.

Third-party sites

The site links to services and websites we do not control. Their privacy practices are governed by their own notices, not this policy.

Changes to this policy

We may update this policy as our practices or legal obligations change. We will post the updated version here and change the “Last updated” date. When required, we will provide additional notice or ask for consent.

Contact us

For privacy questions or requests, contact: