Privacy

Who we are

This site is operated by Ground Plane Studio, LLC, a California limited liability company trading as Groundplane Studio. We are the data controller. Reach us at hello@groundplanestudio.com, which is also the address for any request under this policy.

What we collect

When you send us a message

The contact form asks for your name, email address, an optional company name, and your message. We use it for one thing: replying to you and discussing the work you described.

There is no database behind the form. Submissions are delivered as email to our inbox, and if delivery fails the page hands the text back to you so you can send it yourself. If you email us directly, the same applies.

When you just read

We use Vercel Analytics and Vercel Speed Insights to count page views and measure load performance. Both are cookieless. Neither builds a profile of you, follows you to other sites, or lets us identify an individual reader. Because no tracking cookie is set and no personal information is sold or shared, this site shows no cookie consent banner. It does not need one.

Our host, Vercel, processes standard server request logs, including IP address, user agent and requested URL, as a normal part of serving the site and defending it from abuse. Those logs are short-lived and we do not mine them.

When you click an affiliate link

Some outbound product links are affiliate links, described in full on our disclosurepage. Clicking one normally sets a cookie on the retailer's website, or adds a tracking parameter to the URL, so a resulting purchase can be credited to us.

That happens on the retailer's domain, under the retailer's privacy policy, and outside our control. We receive only aggregate reporting from those programmes: counts of clicks and sales, and commission owed. We never receive your name, address, payment details or what else was in your basket.

What we never collect

• No accounts, passwords or logins. There is nothing to sign up for.
• No payment details. Nothing is sold through this site.
• No advertising or cross-site tracking cookies set by us.
• No special category data, and no attempt to infer any.

Why we are allowed to

For readers in the UK and EEA, our lawful bases under the UK GDPR and GDPR are:

• Legitimate interests, for running and securing the site and understanding in aggregate which pages are read. The processing is minimal and cookieless, which is what keeps that balance in your favour.
• Steps prior to entering a contract, for handling a message you send us about possible work.
• Legal obligation, where we have to keep business correspondence or records for tax or compliance reasons.

Who else touches it

We use a small number of processors, all under contract:

• Vercel, hosting, cookieless analytics and request logs.
• Resend, which delivers contact form submissions to our inbox as email.
• Supabase, which stores the articles the blog reads. It holds no reader data.
• Our email provider, which hosts the inbox your message arrives in.

We do not sell personal information, we do not share it for behavioural advertising, and we have no advertising network on this site. We may disclose information if the law requires it, or to establish or defend a legal claim.

Where it goes

We are based in the United States and our processors are primarily US based, so information you send us is processed there. For transfers of personal data out of the UK or EEA we rely on the UK Addendum and the European Commission's Standard Contractual Clauses, or the provider's certification under the EU-US Data Privacy Framework where they hold one.

How long we keep it

• Correspondence: for as long as it is useful to either of us, which for a business inquiry is typically several years, and longer where a project followed and records must be retained.
• Server logs: retained by our host on their own schedule, on the order of weeks.
• Analytics: aggregate counts only, with nothing tied to an individual to expire.

Ask us to delete a thread and we will, unless the law says otherwise.

Security

The site is served over HTTPS with a strict transport and referrer policy. No credentials are collected or stored. Our inbox is protected by multi-factor authentication. No system is perfect, and we will not pretend otherwise, but there is very little here to lose.

Your rights

Wherever you are, you can ask us what we hold about you, ask for a copy, ask us to correct it, ask us to delete it, ask us to restrict or stop a particular use, or object to processing based on legitimate interests. One email to hello@groundplanestudio.com starts any of them. There is no charge and we will not treat you differently for asking.

California residents have these rights under the CCPA as amended by the CPRA, including the right to know, to delete, to correct, and to opt out of the sale or sharing of personal information. We do not sell or share personal information as those terms are defined, and we do not use it for cross-context behavioural advertising, so there is no opt-out to give you. We do not knowingly process the personal information of anyone under 16.

UK and EEA readershave equivalent rights under the UK GDPR and GDPR, plus the right to complain to a supervisory authority. In the UK that is the Information Commissioner's Office. We would rather you came to us first so we can fix it.

Because the only personal data we hold is correspondence you chose to send, in practice a deletion request means we delete the email thread.

Global Privacy Control

This site honours Global Privacy Control and Do Not Track signals by default, in the sense that there is nothing for them to switch off: we run no cross-site tracking regardless of what your browser sends.

Children

This site sells engineering services to businesses. It is not directed at children, and we do not knowingly collect information from anyone under 16. If you believe a child has sent us something, tell us and we will delete it.

Other sites

We link to retailers, manufacturers, clients and reference material. Once you follow a link you are on someone else's site under their policy, and we have no control over what they collect.

Changes

If this policy changes, the date at the top of the page changes with it. We will not quietly start collecting something that is not listed here. For a material change affecting people who have written to us, we will say so directly.