Privacy policy

This site is run by Ridge Nelson, trading as ÜMBE Studio, a one-person design studio in Northern Utah, United States. In this policy, "I" and "me" mean Ridge Nelson. You can reach me at ridge@umbe.studio.

What you send me. If you fill in the brief form, I receive the answers you give: what you need, your budget range and timing, your name, your email address, your company if you add one, your message, and a link if you add one. The form also passes along the estimate you built on the page, if any. It also notes how you reached the site: a referral code if you followed a shared link, or the name of the website that linked you here, the address of the page you sent the brief from, and any campaign tags on the link you followed. Nothing is stored in your browser to do this. If you email me, I receive your address and what you write.

Booking a call. The "Book a call" buttons open a page on Cal.com. Cal.com collects the details you enter there, such as your name, email address and any notes, under its own privacy policy. I receive those details so I can hold the call.

Server logs. The site is hosted by Netlify. Like any host, it processes technical data when a page is requested, such as your IP address, browser type, the page requested and the time. I do not run third-party analytics, advertising pixels or tracking scripts on this site. I do count visits with a small first-party counter. It records the page path, the host of the site that linked you here, a short label when you click a booking, email or phone link or send the brief form, and whether you are on a phone or a computer. I store no IP address, browser user agent, cookie or query string with it, and it sends nothing if your browser signals Do Not Track or Global Privacy Control.

• To read your brief, reply to you and answer your questions.
• To prepare a proposal and, if we agree to work together, to do the work and keep normal business records.
• To keep the site working and secure, including filtering spam.

If you are in the European Economic Area or the United Kingdom, my legal bases are taking steps at your request before a contract (your brief and any proposal), performing a contract, my legitimate interest in running and protecting a small business, and, where the law requires it, legal obligations such as tax records.

I do not sell your personal information and I do not share it for cross-context advertising. It passes only through the services needed to run the studio:

• Netlify, Inc. hosts the site.
• Formspree, Inc. receives what you send through the brief form and passes it to my email. It keeps a copy in my Formspree account, which I delete on the schedule below, and may check submissions with automated spam filtering.
• Google Workspace carries my email and calendar.
• Cal.com handles bookings if you use the booking page.
• Supabase, Inc. receives the visit counter's requests and stores its small records.

These providers process data in the United States and elsewhere. If you are outside the United States, your information will be transferred to and processed in the United States. I may also disclose information if the law requires it.

If we do not work together, I delete your brief and any emails within 24 months of our last contact. Visit counter records are deleted after 400 days. If we do work together, I keep project records for as long as tax and accounting rules require, generally seven years. You can ask me to delete something sooner.

You can ask me to tell you what I hold about you, to correct it, to delete it, to give you a copy, or to stop using it. Write to ridge@umbe.studio and I will reply within 30 days. I will not treat you differently for asking.

Depending on where you live, laws such as the GDPR, the UK GDPR and several United States state privacy laws give you these rights and, in some places, the right to complain to your local data protection authority or attorney general. I honor them for everyone, wherever you are. I do not sell or share personal information, so there is nothing to opt out of. Nothing on this site follows you across other sites or builds a profile of you, and the visit counter honors Global Privacy Control and Do Not Track by sending nothing.

This site sets no cookies. The details are on the cookies page.

The site is served over HTTPS only. I keep the number of people and services that can see a brief as small as I can. No method of sending data over the internet is perfectly secure, so if a brief holds anything sensitive, leave it out and we can cover it on a call instead.

This site is for businesses and adults. It is not aimed at children under 13 and I do not knowingly collect their information. If you think a child has sent me something, tell me and I will delete it.

If I change this policy, I will change the date at the top of the page. If the change is significant, I will say so on the home page.