what this site knows about you.

If you use the contact form

The form asks for your name, your email address and your message. It also offers optional fields — what you are after, a budget range, a timeline, your company, a link to your site, and how you heard about us — and lets you attach files. Everything you type is stored, and it is used to answer you and, if we end up working together, to run the project.

Your IP address is not stored in raw form

The form needs some way to stop the same source flooding it. Rather than write the raw address to the database, the server stores a salted SHA-256 value with the enquiry. It is a pseudonymous rate-limit key, not anonymous data: someone with the secret and a specific address to test could recompute it. We use it only to enforce the submission limit, and it is deleted with the enquiry.

Spam protection

Submissions pass through Cloudflare Turnstile and a hidden field that only automated scripts fill in. Turnstile checks the browser rather than the person — there are no puzzles, no image grids and no tracking cookie behind it. Rejections are counted, with a reason and a timestamp, and nothing else.

Privacy-limited usage measurement

The site records how its pages are used on our own server. What is recorded is the page path, the bare domain someone arrived from (never the full referring URL, and our own domain is dropped), how far down the page the visit reached, which labelled links were clicked, roughly how long the page was visible, and the page language.

To estimate visits in a day, the server briefly combines the network address and browser user-agent with a secret that changes by date. It writes only a shortened daily HMAC value, never the raw address or user-agent. The value cannot be linked across days. It is kept for up to two days, then deleted and replaced by a daily count. During that short window it is pseudonymous rather than anonymous: someone holding our secret plus the exact address and user-agent could recompute it.

There are no cookies, persistent visitor or session IDs, profiles, or cross-site tracking. If your browser sends Do Not Track or Global Privacy Control, nothing is sent at all — not a reduced version, nothing. Automated browsers are excluded too.

Cookies

This site sets no cookies. That is also why you have never seen a cookie banner on it — there is nothing to ask you about.

• Cloudflare — serves the pages, runs the form endpoint, stores enquiries in its database product, and provides Turnstile.
• Google Workspace — sends the form acknowledgement and our notification through the KUUP mailbox, and holds the resulting email in that mailbox. Gmail SMTP is the configured fallback for the same purpose.

Nothing is sold, rented or shared for advertising. There are no ad networks, no data brokers and no social media pixels on this site. No decisions about you are made automatically.

How long it is kept

An enquiry and its rate-limit key are kept while we are dealing with it, and for as long as we are working together afterwards. Ask us to delete them and we will. Per-day usage digests are erased after two days. What remains is aggregate page activity and a daily count with no visitor-level row to identify or delete.

Under the GDPR you can ask us to show you what we hold about you, correct it, delete it, hand it over in a portable form, restrict what we do with it, or object to it entirely. One email is enough, and there is no charge.

Write to sales@kuupstudio.com. We answer within one month. If you think we have handled your data badly you can also complain to your national data protection authority.

Our legal basis

Answering your enquiry and doing the work you asked for is contractual necessity. Keeping the form usable — spam checks and rate limiting — and understanding in aggregate which pages are useful is our legitimate interest, kept narrow on purpose: no cookies, no persistent or cross-day identifier, a short-lived daily pseudonymous value, and honoured opt-out signals.

Who we are

KUUP studio. Reach us at sales@kuupstudio.com.

Last updated 31 August 2026.