What I actually collect.

The contact form

The form collects a name, an e-mail address and a message, which are required, and a company and a service choice, which are optional. It also reads a «ref» value from the address if one is present. That is a tracking parameter which exists in the code but which no link on this site sets today.

The server adds a timestamp and a cryptographic checksum of the e-mail address and the message. The checksum is used to notice the same message arriving twice, and cannot be turned back into the content.

The form has a hidden field a machine fills in and a person never sees. If it is filled in, the submission is discarded and nothing is stored.

What happens to what you send

The content is sent as e-mail via Resend to markus@westengenstudio.com, with the reply address set to your own. The e-mail contains the name, the e-mail address, any company, the service choice and ref, the time it arrived, and the message itself.

In production nothing is written to disk. The site runs on Vercel, where the file system is ephemeral, and file storage is switched off there for exactly that reason. E-mail is the only destination. If no delivery channel is configured, the submission is refused with an error rather than reported as received.

There is no admin page and no way to read submitted enquiries back out of the site. The server log holds four error messages and never form content.

IP address

Your IP address is read from the request and used only to limit how often something can be submitted: at most five form submissions per ten minutes.

It is held in the server process’s own memory for as long as that process lives. It is never written to disk, never logged and never passed on.

The visitor statistics in 04 derive an anonymous value from the same request. That value is not stored alongside your IP address, and your IP address is not stored there.

Cookies, tracking and statistics

The site sets no cookies. It collects aggregated visitor statistics with Vercel Analytics: which page was opened, where the visit came from, and roughly which browser, operating system, device type and place (country, region, city).

Visitors are counted without a cookie. The count rests on a value derived from the request itself: it is not stored in your browser, it is not stored alongside your IP address, and it is discarded after a day. It cannot be traced back to you, and it does not follow you from one site to another.

When a form submission has been delivered, one event is recorded saying that it happened. It carries no name, email address, company or message text.

Because the statistics store nothing in your browser and cannot identify you, the site does not ask for consent to them. There is no Google Analytics, no Tag Manager and no advertising tracking.

Your browser stores your chosen colour theme and local markers for navigation and form submission. None contains form content, is used for statistics or follows you to other websites.

All typefaces are self-hosted. No request goes to Google Fonts or any other font service when you open a page here.

Payment

Payment is handled by Stripe, which is the payment processor and its own controller for the card details. Card data never reaches my server: you enter it with Stripe, and all I am told is that the payment went through.

The payment carries your name, e-mail address, any company and phone number, and what you ordered. That is used to deliver the order and for the accounts, which Norwegian bookkeeping law requires to be kept for five years.

The projects shown as live sites

Three of the projects in the portfolio are shown as the real site inside an embedded frame. If you open one, your browser contacts that site directly, and it sees your IP address exactly as if you had visited it. The frame passes on no referrer and runs sandboxed.

Your rights

You have the right to see what information I hold about you, to have it corrected, to have it deleted, to restrict or object to the processing, and to receive it in a machine-readable format. Ask at the e-mail address above and I will answer.

If you believe the processing breaches the privacy rules, you can complain to the Norwegian Data Protection Authority (Datatilsynet).