What I actually collect.

The contact form

The form collects a name, an e-mail address and a message, which are required, and a company and a service choice, which are optional. It also reads a «ref» value from the address if one is present. That is a tracking parameter which exists in the code but which no link on this site sets today.

The server adds a timestamp and a cryptographic checksum of the e-mail address and the message. The checksum is used to notice the same message arriving twice, and cannot be turned back into the content.

The form has a hidden field a machine fills in and a person never sees. If it is filled in, the submission is discarded and nothing is stored.

What happens to what you send

The content is sent as e-mail via Resend to markus@westengenstudio.com, with the reply address set to your own. The e-mail contains the name, the e-mail address, any company, the service choice and ref, the time it arrived, and the message itself.

In production nothing is written to disk. The site runs on Vercel, where the file system is ephemeral, and file storage is switched off there for exactly that reason. E-mail is the only destination. If no delivery channel is configured, the submission is refused with an error rather than reported as received.

There is no admin page and no way to read submitted enquiries back out of the site. The server log holds four error messages and never form content.

The purpose is to answer the enquiry and, if relevant, make you an offer. The legal basis is GDPR Article 6(1)(b) (steps taken at your request before a contract), and for enquiries that are not about a project, Article 6(1)(f) (a legitimate interest in answering the person who wrote).

The e-mail stays in the inbox while the conversation is ongoing. If no project follows, it is deleted no later than twelve months after the last contact. If a project follows, the retention period under Payment applies.

The WestengenGPT demo

The demo page sends your question and the earlier messages in the conversation to Google (the Gemini API) to produce the answer. The call is made from my server, so Google gets the text but not your IP address.

Westengen Studio does not store the messages, neither in a database nor in a log, and does not use them for anything else. The conversation lives only in your browser and is gone when you start a new conversation, reload the page or close the tab.

To count the messages, the demo sets one cookie, ws_assistent, when you send a message. It holds a random conversation number, the number of messages in the conversation, the date, the number of messages sent from the browser on that date and a checksum, never what you wrote. The count for the date is not reset when you start a new conversation, only when the date changes, and the cookie expires after a day.

At Google, Google’s own terms for the Gemini API apply. The demo runs on Google’s paid tier, where Google does not use questions and answers to improve its products. Google logs them for a limited period, only to detect and stop violations of its usage rules and for disclosures the law requires, and they may be cached in any country where Google has facilities.

Do not enter personal information, your own or anyone else’s. If what you want to ask about is personal, use the contact form.

The legal basis is GDPR Article 6(1)(b): you ask the demo for an answer, and the text has to be sent to Google to produce it. The cookie rests on Article 6(1)(f), a legitimate interest in preventing abuse of the demo.

IP address

Your IP address is read from the request and used only to limit how often something can be submitted: at most five form submissions per ten minutes.

It is held in the server process’s own memory for as long as that process lives. It is never written to disk, never logged and never passed on. The legal basis is GDPR Article 6(1)(f), a legitimate interest in stopping spam and abuse.

The visitor statistics in 05 derive an anonymous value from the same request. That value is not stored alongside your IP address, and your IP address is not stored there.

Cookies, tracking and statistics

The site sets no cookies, with one exception: the WestengenGPT demo in 03 sets one when you send a message there. The site collects aggregated visitor statistics with Vercel Analytics: which page was opened, where the visit came from, and roughly which browser, operating system, device type and place (country, region, city).

Visitors are counted without a cookie. The count rests on a value derived from the request itself: it is not stored in your browser, it is not stored alongside your IP address, and it is discarded after a day. It cannot be traced back to you, and it does not follow you from one site to another.

When a form submission has been delivered, one event is recorded saying that it happened. It carries no name, email address, company or message text.

The statistics store nothing in your browser and read nothing from it. The legal basis is GDPR Article 6(1)(f), a legitimate interest in knowing which pages are read. There is no Google Analytics, no Tag Manager and no advertising tracking.

Your browser stores four things: the colour theme you chose (ws-theme), a marker that stops the same form being sent twice (ws_lead_sent), and two markers that last only until the tab is closed, whether the logo animation has played (ws-mark-revealed) and where the navigation marker stood (ws-nav-glide). None contains form content, is used for statistics or marketing, or follows you to other websites.

Everything the site stores in your browser is needed to deliver something you asked for yourself. Under section 3-15 of the Norwegian Electronic Communications Act that needs no consent, so the site shows no consent banner.

All typefaces are self-hosted. No request goes to Google Fonts or any other font service when you open a page here.

Payment

Payment is handled by Stripe, which is the payment processor and its own controller for the card details. Card data never reaches my server: you enter it with Stripe, and all I am told is that the payment went through.

The payment carries your name, e-mail address, any company and phone number, and what you ordered. That is used to deliver the order and for the accounts, which Norwegian bookkeeping law requires to be kept for five years.

The order confirmation is sent to you via Resend, with a copy to me. The legal basis is GDPR Article 6(1)(b) (the contract) and Article 6(1)(c) (the bookkeeping obligation).

Who processes the data for me

Vercel Inc. hosts the site and the visitor statistics. Resend sends the e-mail from the contact form and the order confirmations. Google answers in the WestengenGPT demo through the Gemini API. All three are data processors and handle only what the task needs.

Stripe is an independent controller for the card payment, see 06.

Vercel, Resend and Google are American companies, and data may be processed outside the EEA. The transfer rests on the European Commission’s standard contractual clauses or the EU-U.S. Data Privacy Framework.

None of the projects in the portfolio is shown as an embedded site. The screenshots are served from this site, and the links to the projects open only when you click them.

Your rights

You have the right to see what information I hold about you, to have it corrected, to have it deleted, to restrict or object to the processing, and to receive it in a machine-readable format. Ask at the e-mail address above and I will answer.

If you believe the processing breaches the privacy rules, you can complain to the Norwegian Data Protection Authority, Datatilsynet (datatilsynet.no).

When I contact your business

Westengen Studio (sole proprietorship, org. no. 937 785 704, Nittedal) is the data controller. Contact: Markus Westengen, markus@westengenstudio.com.

What I do. I look for Norwegian businesses that could benefit from my services (websites, systems, AI and security). I collect public information about the business, look at the business’s website and sometimes send a short e-mail to the business’s general e-mail address, with one follow-up if I get no reply. I read and approve every e-mail myself before it is sent.

Where the information comes from. From the Brønnøysund Register Centre (the Central Coordinating Register for Legal Entities, the register of roles and the Register of Company Accounts) and from the business’s own website. I use Brave Search to find the address of the website.

What information. About the business: name, organisation number, legal form, industry, municipality, number of employees, turnover and registration date. About people: the name and role of the general manager, owner and chair of the board (not date of birth or address); e-mail addresses and phone numbers listed on the website or in the Brønnøysund registers; and what you write if you reply to me. From the website: technical measurements (for example speed and security settings), short text excerpts and screenshots of the front page.

Purpose and legal basis. To offer my services to businesses that appear to need them. The legal basis is my legitimate interest in marketing my services to other businesses (GDPR Article 6(1)(f)). I have assessed that this interest outweighs the inconvenience to you when I write to the business’s general address, use only public information, send few e-mails and stop as soon as you say no. You can ask for the assessment. I do not send marketing to personal e-mail addresses without consent.

Automated assessment. A computer program assesses the website and suggests whether the business should be contacted, and a language model writes a draft of the e-mail. The assessment concerns the business, not you, and has no legal effect on you. I decide myself whether the e-mail is sent.

Who processes the information for me. Supabase (database, in Frankfurt), Google (language model in Frankfurt, e-mail and speed measurement), Vercel (hosting, in Frankfurt) and Brave (search; receives only the company name and postal town). The suppliers with a parent company in the USA process the information in the EU, under data processing agreements with the EU standard contractual clauses and/or the EU-US Data Privacy Framework. The information is not sold or shared with anyone else.

How long. If I do not contact the business, the information is deleted after 60 days. If I have contacted the business and get no reply, it is deleted 90 days after the last e-mail. If you reply, the conversation is deleted 6 months after the last message, or earlier if you ask. If you ask me to get in touch later, I keep the information until then (at most 12 months ahead) and delete it 6 months after that. If you say no, I keep only an unreadable code (a cryptographic hash) of the organisation number, domain and e-mail address, so that I never contact you again.

Your rights. You can ask for access to what I hold about you and the business, for correction and for deletion. You can object to the marketing at any time: reply “NEI” (no) to the e-mail or write to markus@westengenstudio.com, and I will stop at once and not contact you again. You can also ask for the processing to be restricted. You can complain to the Norwegian Data Protection Authority, Datatilsynet (datatilsynet.no), but I would appreciate it if you contacted me first.

Changes

The statement changes when the site changes what it collects. Last updated 14 October 2026.