Privacy policy

The short version

This website sets no cookies, runs no analytics, carries no advertising or tracking technology, and loads nothing from third-party servers — the typefaces are served from this domain rather than from a font CDN. Nothing about you is collected for our own purposes as you read these pages. The one exception is the technical connection data that every web server records in order to deliver a page at all, described under “Website hosting and server logs” below.

The only personal data we receive is what you deliberately send: the contact form, the newsletter form, or an email you write to us.

Who is responsible

The controller for the processing described here is:

Northlight LLC
30 N Gould St Ste N
Sheridan, WY 82801
United States

Email: info [at] this domain

Website hosting and server logs

This site is hosted by Netlify, Inc. (United States). Like every web server, its infrastructure processes technical connection data — including your IP address, the time of the request, the page requested, and the browser and operating system reported by your device — in order to deliver the page and to keep the service secure and available.

These logs are generated and retained by the hosting provider under its own retention schedule. Northlight LLC does not use them to identify individual visitors, does not combine them with other data, and does not build profiles from them.

Legal basis, where the GDPR applies: our legitimate interest in operating a secure and functioning website (Art. 6(1)(f) GDPR).

Contact form

The contact form asks for your name, your email address and your message. All three are used for one purpose: reading your inquiry and answering it.

Submissions are received and stored by Netlify Forms, part of the hosting service described above, and forwarded to our business email address as a notification. We keep an inquiry for as long as it takes to answer it and for as long as we may need it to document a business relationship; after that it is deleted.

The website confirms receipt after Netlify accepts your submission. We do not automatically email an address entered into the contact form. Contacting us does not subscribe you to a newsletter.

Legal basis, where the GDPR applies: steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR), or our legitimate interest in responding to inquiries addressed to us (Art. 6(1)(f) GDPR).

Newsletter

The newsletter form asks for your email address and your explicit consent. It is used to send occasional short updates about the studio and its products — a few times a year at most.

The newsletter uses double opt-in. Submitting the form does not subscribe you: we request a confirmation email from Brevo, containing a confirmation link, and the subscription begins only after you open that link and confirm on the website. An address that is never confirmed is not added to this newsletter list. Pending requests and delivery events may still be recorded by Brevo. This is deliberate — it means nobody can be signed up by someone else typing their address into our form.

Subscribing is entirely voluntary and you can unsubscribe at any time: every newsletter carries an unsubscribe link that stops marketing emails from Northlight LLC across its brands, and you can also simply write to the address above. We do not use the list for advertising by third parties and we do not sell, rent or share it.

Legal basis, where the GDPR applies: your consent (Art. 6(1)(a) GDPR), evidenced by the confirmation click, which you may withdraw at any time with effect for the future.

Brevo, our email service provider

The confirmation email and the newsletter are sent through Brevo. Your consent is specific to the Northlight newsletter; signing up does not add you to our other brands. Existing opt-outs are not automatically reversed by this form.

Brevo stores the newsletter list and the data needed to send to it. We keep your email address, the wording and language of your consent, request and confirmation times, and the delivery reference in private Netlify storage to document the request and confirmation. For our US company, Brevo's country-specific terms identify Brevo, Inc. (United States) as the contracting entity. Processing can involve its affiliates and subprocessors in the EU and other countries; it is not restricted to the EU. See Brevo's terms and Data Processing Agreement and Brevo's privacy policy.

Brevo processes your address before confirmation to send the requested confirmation email and record the request and delivery. The address is added to the selected newsletter list only after confirmation. Confirmation links expire after 24 hours and can be used only once. Unconfirmed requests and their delivery references are removed after seven days by a daily cleanup. Opening the link alone does not confirm a subscription. Necessary confirmation evidence and a minimal suppression record may be retained to document consent and respect an opt-out.

Brevo uses measurement pixels and may redirect email links to record opens and clicks. We have enabled anonymous reporting and indicate when sending confirmation emails that consent to personal pixel tracking has not been given. However, contact-linked events, such as an opening status or timestamp, may still be visible in Brevo. We therefore cannot currently guarantee fully anonymous or tracking-free processing. We do not use opening and click events to build individual profiles or select advertising content. Delivery and consent records remain identifiable where needed to operate the service and document consent.

Brevo's transactional email logs are configured for one month. Storage of new email previews is disabled; this setting does not remove previously stored previews. These settings do not determine how long contacts, consent evidence or suppression records are retained.

Contact messages are stored separately in Netlify Forms. Newsletter requests are processed by a server function, private Netlify storage and Brevo; they are not stored as Netlify Forms submissions.

Spam protection

Both forms contain a hidden field that is invisible to people and normally filled in only by automated submission scripts. It collects nothing about you; it exists so that obvious spam can be discarded without any further analysis of you or your device. The newsletter endpoint also checks the request origin, limits request size and applies rate limiting. Netlify applies its spam protection to contact submissions. No third-party CAPTCHA widget is loaded by this website.

Email correspondence

If you write to us directly, we receive the information you choose to send, including your address and anything in the message. It is used to respond and to conduct the business you contact us about. Email is stored in our business email system for as long as the correspondence remains relevant, and is subject to the retention obligations that apply to business records.

Transfers outside your country

Northlight LLC is a United States company and its hosting provider operates in the United States. If you are located in the European Economic Area, the United Kingdom or Switzerland, personal data you send us is therefore processed in the United States. We limit what we collect to what is described above precisely because it keeps that exposure small.

Brevo describes its processing locations and safeguards in its privacy documentation linked above. Email correspondence is handled through Google Workspace. Hosting, email delivery and support services may involve processing in other countries.

What we never do

• We do not sell or rent personal data.
• We do not share it with third parties for their own marketing.
• We do not run advertising, analytics, heat-mapping or session-recording tools.
• We do not use automated decision-making or profiling.

Your rights

Depending on where you live, you have rights over the personal data we hold about you. These generally include the right to ask what we hold, to have it corrected, to have it deleted, to restrict or object to its processing, to receive it in a portable form, and — where processing rests on consent — to withdraw that consent at any time.

To exercise any of these, write to the address or email above; a plain sentence is enough and no particular form is required. If you are in the EEA, the UK or Switzerland, you also have the right to lodge a complaint with your local data protection supervisory authority.

Children

This website is aimed at businesses and professionals. It is not directed at children, and we do not knowingly collect personal data from them.

Changes to this policy

If what we do with data changes, this page changes with it and the effective date at the top is updated. Material changes affecting the newsletter will be announced to subscribers before they take effect.

Questions

For any privacy question, write to info [at] this domain. Company details are on the legal information page.