A short note on what we keep, and why.
Last updated . This is plain English. If anything is unclear, write to [email protected] and we will rewrite it.
Who we are
WindowMaps is a small studio creating bespoke laser-plotted cartographic art applied directly to residential windows. We are the data controller for any personal information you share with us. Our registered correspondence address is on our Studio page.
What we collect
Only what we need, and only when you give it to us. There are three moments at which we hold any personal information:
When you write to us. The inquiry form on windowmaps.com/inquire/ records your name, email, optional phone number, location, and the details you choose to share about your window and your project. These details are stored privately in our Cloudflare account (encrypted at rest, EU region), emailed to us for response, and retained for up to 24 months so that we can return to long conversations gracefully.
When you subscribe to the Studio Letter. Just your email address, used solely to send you the seasonal letter (four times a year, never more). You can unsubscribe with one click from any letter.
When you visit the site. If you accept analytics cookies, Google Analytics 4 records anonymised page views with IP-anonymisation enabled and ad-signals disabled. This tells us which pages are read most; it does not tell us who you are. You can decline this entirely — see our cookies note or open the .
Why we collect it
For one purpose only: to respond to your inquiry and, if you ask us to, to send you the Studio Letter. We do not build profiles, we do not target advertising, we do not enrich your data with third-party sources, and we do not sell or share your information with anyone for marketing purposes.
Who we share it with
Three processors handle parts of the technical pipeline:
· Cloudflare — hosts the site and stores inquiry records (data centres in the EU/EEA). Cloudflare privacy.
· Brevo (formerly Sendinblue, EU-based) — sends our reply emails and Studio Letter dispatches. Brevo privacy.
· Google Analytics 4 — collects anonymised usage statistics, only with your explicit consent. Google may process this data in the United States under Standard Contractual Clauses. Google privacy.
That is the entire list. No advertising networks, no data brokers, no social-media pixels.
International transfers
Inquiry records and Studio Letter subscriber data are stored within the EU/EEA. If you accept analytics cookies, Google Analytics may transfer anonymised usage data to the United States. This transfer is covered by the EU-US Data Privacy Framework and Standard Contractual Clauses as approved by the European Commission.
How long we keep it
· Inquiry records: 24 months from your last contact with us, then deleted.
· Studio Letter subscribers: until you unsubscribe or for 36 months of inactivity, whichever comes first.
· Analytics: anonymised at point of collection. We retain aggregate reports indefinitely; individual session data is auto-deleted by Google after 14 months.
· Cookie consent record: 6 months, after which we ask again.
Your rights
Wherever you live, you have the right to know what information we hold about you, to ask us to correct it, to ask us to delete it, and to receive a copy of it in a portable format. Depending on your jurisdiction, you may also have additional rights:
If you are in the EU, UK, or Switzerland: you have rights under GDPR / UK-GDPR including the right to lodge a complaint with your supervisory authority (in the UK, the ICO; in the Netherlands, the Autoriteit Persoonsgegevens).
If you are in California: you have rights under the CCPA / CPRA including the right to know what personal information has been collected, the right to delete it, the right to correct it, the right to opt out of any sale or sharing of personal information for cross-context behavioral advertising, and the right not to be discriminated against for exercising these rights. We do not sell or share your personal information — you can confirm this by visiting our Do Not Sell or Share page. We also recognise the Global Privacy Control (GPC) signal as a valid opt-out request.
If you are in Virginia, Colorado, Connecticut, Utah, Texas, or any other US state with a comprehensive privacy law: equivalent rights apply. The mechanism is the same — write to us.
If you are in Brazil: LGPD rights apply.
To exercise any right, write to [email protected]. We will respond within 30 days, usually much sooner. We may need to verify your identity (matching the email address on file is normally sufficient).
Children
Our site and services are not directed at children under 16. We do not knowingly collect personal information from children. If you believe a child has shared information with us, please write to us and we will delete it immediately.
Cookies
The full cookie list and our consent mechanism are documented on a separate page: windowmaps.com/cookies/. You can change your preferences at any time by clicking .
Changes
If we change this notice meaningfully — new processors, new purposes — we will reset the cookie consent so that you see the banner again, and we will note the change at the top of this page. We will not change it quietly.
Contact
Write to [email protected]. A human reads every email.
— The studio