Privacy Policy

Last updated: 20 July 2026

This policy explains what personal data York Studio collects through yorkstudio.io, why it is collected, and what you can do about it. It covers this website only — individual products in the portfolio have their own policies.

Who is responsible

York Studio is run by Kris York as an individual based in Spain, and he is the data controller for information collected through this site. There is no company standing between you and him. For anything in this policy — including any request described below — email kris@yorkstudio.io.

What is collected

Contact form. When you use the form on the contact page, you submit your name, your email address and your message. That is the whole of it — there are no hidden fields gathering anything else, and nothing is pre-filled from elsewhere.

Analytics. This site uses Vercel Web Analytics to count page views and see which pages are read. It is aggregate and privacy-preserving: no cookies are set, no advertising identifiers are used, and visitors are not tracked across other websites. That is why you have not been asked to dismiss a cookie banner.

Server logs. The site is hosted on Vercel, which records standard technical request data such as IP address, browser type and the page requested. This is ordinary infrastructure logging used for security and reliability.

No account is created, no newsletter list is maintained, no payment details are taken, and no special category data is knowingly collected on this site.

Why it is collected, and the legal basis

• To reply to you. Contact form details are used to respond to your enquiry and to continue that conversation. Legal basis: legitimate interests — answering someone who has deliberately written in.
• To understand what is read. Analytics inform what gets written and built next. Legal basis: legitimate interests, using a method chosen specifically because it does not identify individuals.
• To keep the site up and secure. Server logs support availability and abuse prevention. Legal basis: legitimate interests.

Your data is never sold, rented, or shared for advertising, and it is not used to train machine learning models.

Who else processes it

A small number of service providers process data in order to run the site. Each acts on instructions, under contract:

• Vercel — hosting, and the privacy-preserving analytics described above.
• Resend — delivers contact form submissions to the studio inbox as email.
• Google Workspace — where that email is then received and stored.

Some of these providers operate servers outside the EEA. Where data is transferred internationally, it is done under the safeguards those providers offer, such as Standard Contractual Clauses. Typefaces on this site are self-hosted and served from this domain, so loading a page makes no request to Google Fonts.

How long it is kept

Contact enquiries are kept as email for as long as the conversation is useful, and deleted once it plainly is not. Analytics data is aggregate and retained by Vercel on a rolling window. Server logs are short-lived and managed by the host. You can ask for your enquiry to be deleted sooner at any time.

Your rights

Under the EU General Data Protection Regulation you have the right to access a copy of your data, to have inaccurate data corrected, to have your data deleted, to restrict or object to how it is used, and to receive it in a portable form. Because this site collects so little, most requests amount to finding and deleting an email thread — which will be handled promptly and without fuss.

Email kris@yorkstudio.io to make any of these requests. If you are unhappy with the response, you can complain to the Spanish data protection authority, the Agencia Española de Protección de Datos, at aepd.es — or to the supervisory authority in your own EU country.

Other sites

This site links out to places like LinkedIn and GitHub, and to products in the portfoliothat run on their own domains. Once you follow one of those links you are covered by that service’s privacy policy, not this one.

Children

This site is aimed at a professional audience and is not directed at children under 13. No data is knowingly collected from them.

Changes

If this policy changes, the revised version will be posted here with a new date at the top. Material changes to how data is handled will be described rather than quietly substituted.