Privacy policy

The short version

This website sets no cookies, runs no analytics, carries no advertising or tracking technology, and loads nothing from third-party servers — the typefaces are served from this domain rather than from a font CDN. Nothing about you is collected for our own purposes as you read these pages. The one exception is the technical connection data that every web server records in order to deliver a page at all, described under “Website hosting and server logs” below.

The only personal data we receive is what you deliberately send: the contact form, the newsletter form, or an email you write to us.

Who is responsible

The controller for the processing described here is:

Northlight LLC
30 N Gould St Ste N
Sheridan, WY 82801
United States

Email: info [at] this domain

Website hosting and server logs

This site is hosted by Netlify, Inc. (United States). Like every web server, its infrastructure processes technical connection data — including your IP address, the time of the request, the page requested, and the browser and operating system reported by your device — in order to deliver the page and to keep the service secure and available.

These logs are generated and retained by the hosting provider under its own retention schedule. Northlight LLC does not use them to identify individual visitors, does not combine them with other data, and does not build profiles from them.

Legal basis, where the GDPR applies: our legitimate interest in operating a secure and functioning website (Art. 6(1)(f) GDPR).

Contact form

The contact form asks for your name, your email address and your message. All three are used for one purpose: reading your inquiry and answering it.

Submissions are received and stored by Netlify Forms, part of the hosting service described above, and forwarded to our business email address as a notification. We keep an inquiry for as long as it takes to answer it and for as long as we may need it to document a business relationship; after that it is deleted.

You also receive an automatic acknowledgement by email confirming that your message arrived. It is sent through Brevo (see below) and contains fixed text only — your own message is deliberately not quoted back, because anyone can type someone else's address into a form.

Legal basis, where the GDPR applies: steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR), or our legitimate interest in responding to inquiries addressed to us (Art. 6(1)(f) GDPR).

The newsletter form asks for your email address and nothing else. It is used to send occasional short updates about the studio and its products — a few times a year at most.

The newsletter uses double opt-in. Submitting the form does not subscribe you: it sends one email to the address entered, containing a confirmation link, and the subscription begins only when that link is clicked. An address that is never confirmed is not added to the list and receives nothing further. This is deliberate — it means nobody can be signed up by someone else typing their address into our form.

Subscribing is entirely voluntary and you can unsubscribe at any time: every message carries an unsubscribe link, and you can also simply write to the address above. We do not use the list for advertising by third parties and we do not sell, rent or share it.

Legal basis, where the GDPR applies: your consent (Art. 6(1)(a) GDPR), evidenced by the confirmation click, which you may withdraw at any time with effect for the future.

Brevo, our email service provider

The confirmation email, the newsletter itself and the automatic acknowledgement for the contact form are sent through Brevo (Sendinblue SAS, 106 boulevard Haussmann, 75008 Paris, France), acting as our processor under a data processing agreement.

Brevo stores the newsletter list and the data needed to send to it and to evidence consent: the address, its subscription status, and the date and time at which the confirmation link was clicked. That timestamp is kept precisely so that the consent can be demonstrated later. Brevo is established in the European Union. Details are in Brevo's own privacy policy.

Between submitting the form and clicking the link, the address is held in no list at all: it exists only inside the signed confirmation link in that one email. An address that is never confirmed therefore leaves no subscription record behind, and the link itself stops working after seven days.

Form submissions continue to be recorded by Netlify independently of this, so an inquiry is never lost if the email service is unavailable — only the automatic acknowledgement would be missing.

Spam protection

Both forms contain a hidden field that is invisible to people and normally filled in only by automated submission scripts. It collects nothing about you; it exists so that obvious spam can be discarded without any further analysis of you or your device. No CAPTCHA service, fingerprinting or behavioural scoring is used.

Email correspondence

If you write to us directly, we receive the information you choose to send, including your address and anything in the message. It is used to respond and to conduct the business you contact us about. Email is stored in our business email system for as long as the correspondence remains relevant, and is subject to the retention obligations that apply to business records.

Transfers outside your country

Northlight LLC is a United States company and its hosting provider operates in the United States. If you are located in the European Economic Area, the United Kingdom or Switzerland, personal data you send us is therefore processed in the United States. We limit what we collect to what is described above precisely because it keeps that exposure small.

Our email service provider, Brevo, is the exception: it is a French company and the newsletter list is held within the European Union.

What we never do

We do not sell or rent personal data.
We do not share it with third parties for their own marketing.
We do not run advertising, analytics, heat-mapping or session-recording tools.
We do not use automated decision-making or profiling.

Your rights

Depending on where you live, you have rights over the personal data we hold about you. These generally include the right to ask what we hold, to have it corrected, to have it deleted, to restrict or object to its processing, to receive it in a portable form, and — where processing rests on consent — to withdraw that consent at any time.

To exercise any of these, write to the address or email above; a plain sentence is enough and no particular form is required. If you are in the EEA, the UK or Switzerland, you also have the right to lodge a complaint with your local data protection supervisory authority.

Children

This website is aimed at businesses and professionals. It is not directed at children, and we do not knowingly collect personal data from them.

Changes to this policy

If what we do with data changes, this page changes with it and the effective date at the top is updated. Material changes affecting the newsletter will be announced to subscribers before they take effect.

Questions

For any privacy question, write to info [at] this domain. Company details are on the legal information page.