Privacy Policy

What we collect

• Essential cookies to keep the site working and secure (Cloudflare edge), plus one localStorage entry recording your privacy choices.
• Analytics. We run our own OpenPanel instance on a server we control in the EU. For each page view it records: the page address and title, the site that referred you, your browser, operating system and device type, screen size, browser language, and an approximate country, region and city. Session replay is not enabled.
• Emails you send us at hi@brandnuits.com, and anything you choose to include in them.

How analytics handles your IP address

Your browser never transmits your IP address as a field in the analytics payload. Our server reads it from the connection and uses it for two things only: an approximate geographic location, and (combined with your browser's user-agent string, the project identifier and a secret that rotates daily) a one-way hash that lets us count a visit without knowing who you are. The IP address and user-agent are then discarded and are never written to the database. Because the secret rotates every day, these identifiers do not persist indefinitely and cannot be used to follow you over the long term.

Purpose & legal basis

• Responding to inquiries and providing services: legitimate interest, or performance of a contract where one exists.
• Operating and securing the site: legitimate interest (Art. 6(1)(f) GDPR).
• Aggregate audience measurement: legitimate interest. It is first-party, strictly statistical, stores nothing on your device for measurement and is never used for advertising. You may object at any time using the control below.

Retention

• Analytics records are retained for no longer than 12 months, after which we delete them.
• Inquiry emails are kept up to 12 months unless you request deletion sooner, or longer where an engagement or a legal obligation requires it.
• Your privacy choices stay on your device until you clear them.

Sharing

• Hosting and edge delivery via Cloudflare Workers; traffic may route globally. Standard Contractual Clauses apply where required.
• Analytics is self-hosted on infrastructure we control in the EU/EEA. No third-party analytics provider receives your data, and it does not leave the EU/EEA.
• Email provider for correspondence.
• No advertising networks, no data brokers, no sale of data, and no profiling or automated decision-making.

Our subprocessors are listed on the data processing page.

Your rights (EU/EEA)

• Access, rectify, erase, restrict, or object to processing. Where we rely on legitimate interest, including analytics, you have an unconditional right to object.
• Portability, and the right to withdraw consent at any time without affecting processing carried out before withdrawal.
• Complain to your supervisory authority in Finland (Tietosuojavaltuutetun toimisto).

Note that because analytics data is stored against a rotating one-way hash and no identifier is kept on your device, we usually cannot link a given record back to you. Under Art. 11 GDPR we may be unable to action access or erasure requests for analytics specifically, but you can stop the collection outright:

Contact

Email hi@brandnuits.com for any privacy requests. We respond within 30 days.