Privacy Policy

Who this policy covers

This policy applies to Noordpunt Studio, the operator of this website. If you have questions, contact ma.contentstudio@gmail.com.

The four kinds of data this site handles

This page keeps these separate on purpose, because they're kept for different lengths of time and for different reasons.

• Booking data — name, phone number, email address, appointment date and time, and any optional notes, submitted through a booking form (including the live demo).
• Contact / quote requests — name, email address, and any optional business name, phone number, selected "what do you need?" option, or message, submitted through the contact form.
• Email copies — when a booking or contact form is submitted, an email is also sent (via Gmail) to the business inbox, and, for bookings, a confirmation email to the address provided. These are separate from the stored records described below.
• Hosting-related technical data — the site is hosted on Vercel, which processes standard web request data (such as IP address) as a normal part of serving any page. No analytics or tracking scripts are added on top of this as of the date this page was last edited; if that changes, this section will be updated to name the specific service added.

Why it's collected

Booking details are collected to schedule and manage an appointment, and to send a confirmation. Contact form details are collected to respond to an enquiry or quote request. None of it is used for marketing, and none of it is sold.

Where it's stored

Booking data is stored in a Supabase database, reachable only through a private, server-side connection — not directly from a browser, and not visible to other website visitors. Contact/quote requests are not stored in that database at all; they're sent directly by email and then live wherever that inbox lives.

Which services are involved

Data may pass through the following third-party service providers:

• Supabase Inc. — database hosting for booking records
• Google LLC (Gmail) — sending notification and confirmation emails
• Vercel Inc. — website hosting

How long information is kept

Booking data is kept only for as long as needed to process the booking, and is deleted automatically within a maximum of 24 hours after it was submitted — this is a ceiling, not a fixed schedule, and it may be deleted sooner. The business receives the booking notification by email immediately, before that record is later deleted, and is responsible for keeping its own longer-term appointment records if it chooses to.

Deleting the stored booking record does not remove any copy that already exists in an email inbox from the notification or confirmation email — that copy sits outside this website's control and is the recipient's own responsibility.

Contact / quote request messages are kept for as long as needed to respond to and follow up on the enquiry, and are deleted or archived once that's resolved — in practice, typically within about 12 months if there's been no further contact. This isn't yet handled by an automated deletion process the way booking data is.

Data processing agreements (DPA)

Where Noordpunt Studio processes personal data on behalf of a client — for example, booking data collected through a client's own website — a separate Data Processing Agreement (DPA, sometimes called a verwerkersovereenkomst) may apply, as required under applicable data protection law. Having a DPA in place doesn't, by itself, make a client's overall data handling fully compliant — that depends on how the business as a whole handles data.

Your rights

You can ask what information is held about you, request a correction, or request deletion, by emailing ma.contentstudio@gmail.com. Deletion requests are honored where possible, subject to any legal or accounting obligation to keep certain records for a defined period. If you're contacting from the EU or UK, you may have further rights under GDPR-derived law — reach out and this will be handled on a case-by-case basis rather than a blanket promise made here.

A note on compliance

This page describes, in plain terms, what data this website actually collects, where it goes, and how long it's kept. It is not a substitute for legal advice, and using Supabase, Gmail and Vercel as described here does not by itself guarantee compliance with GDPR or any other law — that depends on how the business as a whole handles data, which hasn't been independently reviewed by a lawyer.