Privacy Policy

This website is operated by Nandez Design Studio LLC, a Florida limited liability company (“Nandez Design Studio”, “we”, “us”), at the address shown in the footer of every page. Questions about this policy, or requests about your information, can be sent to info@nandezdesign.com.

The contact form asks for your name, your email address, the type of project (chosen from a list) and a description of your vision. Your budget is optional. Anything else you choose to write in the description, such as a phone number or an address, is stored along with it.

With your enquiry we also record the page you sent it from, the website that referred you to us, any campaign parameters in the link you followed (for example utm_source), and your approximate city and country. The location is estimated by our hosting provider from your IP address; we do not store the IP address itself.

The enquiry also carries the random identifier of your current browser tab (described under “How we measure use of the site”), which lets us see how you reached the form during that visit. It is not attached if your browser sends a Global Privacy Control or Do Not Track signal.

We use this information to reply to you and, if we go on to work together, to prepare a proposal. A copy of the enquiry is emailed to the studio staff who handle new projects. We do not add you to a mailing list, we do not sell your information, and we do not use it to advertise to you.

The form uses Cloudflare Turnstile to check that it is being sent by a person rather than an automated script. Turnstile runs only on the contact page and processes technical signals from your browser under Cloudflare's own privacy policy.

To limit how many times the form can be sent from one connection, we keep a hashed value derived from your IP address and a secret key, together with a count and a timestamp. It is not stored alongside your enquiry, is not used for anything else, and is cleared out after about two hours.

We run our own analytics to understand which projects and pages people find useful. It sets no cookies.

We record the pages you view and their titles, how far you scroll and how long a page is actively in view, which project images you open, clicks on project cards, buttons, email and phone links and links to other websites, whether the homepage video is played, basic performance timings, and whether the contact form was started, sent or showed an error on a particular field. We never record what you type into the form through analytics.

For each visit we also record the website that referred you, any campaign parameters in the link, the page you arrived on, your approximate country, region and city (estimated by our hosting provider from your IP address), and your type of device, browser and operating system, read from the information your browser sends with every request.

We do not store your IP address. To recognise a returning visitor within the same day, we combine the IP address, your browser's user-agent string, a secret key and the date, and keep only a shortened one-way hash of the result. Because the date is part of it, the same visitor produces a different value the next day, so visits cannot be linked from one day to another.

Within a visit, a random identifier, the campaign parameters and the landing page are kept in your browser's session storage. They are removed when you close the tab.

If your browser sends a Global Privacy Control or Do Not Track signal, our analytics records nothing at all and stores nothing in your browser. The contact form still works normally.

We also log visits from search engine and AI crawlers, identified by their user-agent string, with the page they requested. These records describe automated software, not people.

We also use Google Analytics, loaded through Google Tag Manager. On your first visit a banner asks whether you accept analytics cookies.

Until you decide, and if you decline, Google Analytics runs in Consent Mode without cookies: Google receives limited, cookieless measurement signals, together with the technical information any website request includes, such as your IP address and browser type.

If you accept, Google Analytics sets first-party cookies (named _ga and _ga_<ID>) that, by Google's default, last up to two years. Accepting only permits analytics: we do not advertise, so advertising storage, advertising data and ad personalisation stay denied whatever you choose, and Google Signals and ad-personalisation signals are switched off.

Your choice is stored in your browser's local storage under the key nandez_consent, not in a cookie. To change it, clear this site's data in your browser and the banner will ask again. Browser privacy signals (Global Privacy Control, Do Not Track) apply to our own analytics; the banner is how you control Google Analytics.

You can read how Google uses this information at policies.google.com/technologies/partner-sites, and install Google's opt-out browser add-on at tools.google.com/dlpage/gaoptout.

Apart from Google Analytics, the public pages of this site set no cookies of their own. Signing in to the private admin area sets cookies that are strictly necessary to keep the session secure; they are only relevant to studio staff.

We use a small number of providers to run the site. They process information on our behalf and for these purposes only:

Vercel hosts the website, estimates approximate location from IP addresses and keeps short-lived technical request logs. Supabase stores our database, including enquiries and analytics, and our images and video; the homepage video is loaded by your browser directly from Supabase. Resend delivers the email that notifies the studio of a new enquiry. Cloudflare provides the Turnstile check on the contact form. Google provides Google Analytics and Google Tag Manager.

These providers are based in, or process information in, the United States. If you visit from another country, your information will be processed there.

We do not sell personal information. We may disclose information if the law requires it, or to establish, exercise or defend a legal claim.

We keep enquiries for up to one year after we receive them. If an enquiry leads to a project, we keep it with that project's records instead. You can ask us to delete an enquiry sooner at any time. When an enquiry is changed or deleted, a copy of it remains in our internal change log for twelve months and is then removed automatically.

Detailed analytics records and crawler logs are deleted automatically after thirteen months. We keep daily totals, such as the number of views each page received, which contain no information about individual visitors.

Rate-limiting values are cleared out after about two hours. Google Analytics keeps its data for the period set in our Google Analytics account.

You can ask us what information we hold about you, and ask us to correct or delete it. Email us at info@nandezdesign.com and we will respond within a reasonable time. We may need to confirm that the request comes from you.

You can decline analytics cookies in the banner, turn on Global Privacy Control in your browser, or block cookies and clear site data through your browser settings. The site works normally either way.

The site is served only over encrypted HTTPS connections. Enquiries and analytics are stored in a database that only authorised studio staff can read, according to their role, and staff accounts can be protected with two-factor authentication. No method of transmission or storage is completely secure, but we work to protect what you share with us.

This site is aimed at people looking for architecture and construction services. It is not directed at children under 13, and we do not knowingly collect information from them. If you believe a child has sent us information, contact us and we will delete it.

If we change this policy we will update the date at the top of this page. Material changes will be highlighted on the site.