Privacy Policy

Effective date: October 26, 2026 · Last updated: October 26, 2026

1. Introduction and acceptance

This Privacy Policy (this "Policy") describes how Note2.Studio ("Note2 Studio," "we," "us," or "our") collects, uses, discloses, retains, and otherwise processes Personal Information in connection with our website located at note2.studio and any related subdomains (the "Site"), our client account area and dashboard (the "Dashboard"), our live chat, our text-message and email communications, and the web design, web development, hosting, maintenance, search engine optimization, and marketing services we provide (collectively, the "Services").

Please read this Policy carefully. By accessing or using the Site or the Services, creating an account, submitting a project brief, communicating with us, or otherwise providing Personal Information to us, you acknowledge that you have read and understood this Policy. If you do not agree with this Policy, you must not access or use the Site or the Services. Where applicable law requires your consent for a particular processing activity, we will request that consent separately, and nothing in this Policy shall be construed as consent where such consent is required to be obtained separately.

This Policy is incorporated into, and forms part of, any Terms of Service, proposal, quote, statement of work, or services agreement between you and Note2 Studio (each, an "Agreement"). In the event of a conflict between this Policy and a signed Agreement regarding the processing of Client Data (as defined below), the signed Agreement shall control to the extent of the conflict.

2. Who we are

The Site and the Services are operated by [LEGAL ENTITY NAME], a [STATE] [ENTITY TYPE, e.g., limited liability company], doing business as Note2.Studio, with its principal place of business in New York, New York. For purposes of applicable data protection laws, Note2 Studio is the "controller" or "business" with respect to Personal Information collected through the Site and the Services for our own purposes, and may act as a "processor" or "service provider" with respect to Personal Information we process on behalf of our clients, as described in Section 15.

3. Scope of this policy

This Policy applies to Personal Information we collect: (a) through the Site and the Dashboard; (b) through our communications with you, including by text message, email, telephone, video call, live chat, and social media, including direct messages sent to our Instagram account; (c) in the course of providing the Services to our clients; and (d) from third parties as described below.

This Policy does not apply to: (i) websites, applications, or services operated by our clients, even where we designed, built, host, or maintain them, each of which is governed by the client's own privacy policy; (ii) third-party websites, platforms, or services that may be linked from or integrated with the Site, including Instagram, Stripe, and Google; or (iii) information that has been de-identified or aggregated such that it can no longer reasonably be used to identify an individual or household.

4. Definitions

For purposes of this Policy: "Personal Information" means any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual, household, or device, and includes "personal data" and "personal information" as those terms are defined under applicable law. "Sensitive Personal Information" has the meaning given under applicable law. "Client" means a business or individual that engages us to provide Services. "Client Data" means Personal Information that a Client provides to us, or that we process on a Client's behalf, in connection with the Services, including information about the Client's own customers or website visitors. "Process" and "processing" mean any operation performed on Personal Information, including collection, recording, organization, storage, use, disclosure, and deletion.

5. Information we collect

5.1 Information you provide to us

• Account information. When you create an account, we collect your full name and either your mobile telephone number or your email address. We use passwordless sign-in; we do not ask you to create or store a password. We generate and send one-time verification codes to the number or address you provide.
• Project brief information. When you complete a project brief, we collect your business name, location, industry, current website address, business goals, design preferences, your description of your vision, reference websites you share and your comments about them, required pages, timeline, budget range, any additional details you choose to provide, and your preferred method of communication.
• Inquiry and contact form information. When you contact us through the Site, we collect your name, email address, business name, project type, budget range, and the content of your message.
• Communications. We collect the content of messages you send us through live chat, text message, email, Instagram, or other channels, together with associated metadata such as date, time, and the channel used.
• Billing information. When you pay a deposit, invoice, balance, or maintenance subscription, payment card and bank account details are collected directly by our payment processor. We receive limited information such as your name, billing address, the last four digits and brand of your card, the transaction amount, date, and status. See Section 9.
• Project materials. Logos, photographs, copy, brand guidelines, product information, login credentials for third-party services you ask us to manage, and other materials you provide for use in your project.
• Feedback and testimonials. If you provide feedback, reviews, or testimonials, we collect their content and, with your permission, may publish them together with your name and business name.

5.2 Information we collect automatically

• Device and browser information. Such as device type, operating system, browser type and version, screen size, language settings, and whether your device supports touch input. The Site uses this information to adapt its layout and animations to your device so that it loads quickly and displays correctly.
• Usage information. Such as pages viewed, links and buttons clicked, the referring URL, time spent on pages, and the date and time of your visit.
• Network information. Such as IP address and an approximate location (for example, city or region) derived from it.
• Local storage. The Site stores certain information in your browser's local storage, such as your sign-in session, Dashboard preferences, and whether you have already viewed the introductory animation during your current session. See Section 13.

5.3 Information from third parties

We may receive Personal Information about you from: our payment processor (such as payment status); communication providers (such as message delivery status); Instagram and other social media platforms when you interact with our accounts; referral partners and existing clients who refer you to us; and publicly available sources such as your business's public website, Google Business Profile, and public business registries, which we may review when preparing a quote or proposal.

5.4 Sensitive Personal Information

We do not intentionally collect Sensitive Personal Information, and we ask that you not provide it to us through the project brief, live chat, or other channels unless it is strictly necessary for your project. We do not use or disclose Sensitive Personal Information for purposes of inferring characteristics about you.

6. How we use information

We use Personal Information for the following purposes:

1. To create and administer your account, verify your identity, and send one-time sign-in codes;
2. To review your project brief, prepare quotes and proposals, and communicate with you about them;
3. To provide, perform, and support the Services, including design, development, hosting, maintenance, SEO, and marketing;
4. To process payments, deposits, invoices, refunds, and recurring maintenance subscriptions, and to send receipts and billing notices;
5. To respond to your inquiries, provide live chat support, and notify our team when you request a chat or leave a message;
6. To send transactional and service messages by text and email, such as quote notifications, project updates, payment confirmations, and security notices;
7. With your consent where required, to send marketing communications about our Services;
8. To operate, maintain, secure, and improve the Site, including adapting the Site to your device and diagnosing technical problems;
9. To understand how the Site and Services are used and to develop new features and services;
10. To detect, prevent, and respond to fraud, abuse, security incidents, and other harmful or unlawful activity;
11. To comply with legal obligations, including tax, accounting, and recordkeeping obligations, and to respond to lawful requests from public authorities;
12. To establish, exercise, or defend legal claims and to enforce our Agreements; and
13. For any other purpose disclosed to you at the time we collect the information, or with your consent.

We do not sell Personal Information for money. We do not "share" Personal Information for cross-context behavioral advertising, as that term is defined under California law, except as described in Section 14 and subject to your right to opt out.

7. Legal bases for processing

Where applicable law, such as the General Data Protection Regulation (EU) 2016/679 or the UK GDPR, requires a legal basis for processing, we rely on the following: (a) performance of a contract, where processing is necessary to provide the Services you request or to take steps at your request before entering into an Agreement; (b) legitimate interests, such as operating and securing the Site, improving the Services, and communicating with prospective clients, where those interests are not overridden by your rights; (c) consent, such as for marketing messages and non-essential cookies, which you may withdraw at any time without affecting the lawfulness of processing before withdrawal; and (d) legal obligation, where processing is necessary to comply with applicable law.

8. How we share information

We disclose Personal Information only as described in this Policy or as otherwise disclosed to you at the time of collection:

• Service providers. We use vendors that process Personal Information on our behalf under written contracts that restrict their use of it, including providers of website hosting and content delivery, databases, payment processing, text messaging, email delivery, live chat, customer support, analytics, cloud storage, and professional services such as accounting and legal advisors.
• Collaborators on your project. Where necessary to deliver your project, we may share relevant project information with independent contractors, such as designers, developers, copywriters, or photographers, who are bound by confidentiality obligations.
• Platforms you ask us to use. If you ask us to set up or manage third-party accounts on your behalf, such as a domain registrar, Google Business Profile, social media accounts, or your own payment processor account, we will share information with those platforms as needed.
• Legal and safety. We may disclose Personal Information if we believe in good faith that disclosure is required by law, subpoena, court order, or other legal process, or is necessary to protect the rights, property, or safety of Note2 Studio, our clients, or others.
• Business transfers. In connection with an actual or proposed merger, acquisition, financing, reorganization, sale of assets, or bankruptcy, Personal Information may be transferred to the successor or acquirer, subject to this Policy or protections at least as protective.
• With your consent. We may share Personal Information for other purposes with your consent or at your direction, such as publishing a testimonial.

9. Payments

Payments made through the Dashboard are processed by Stripe, Inc. or another reputable third-party payment processor (the "Payment Processor"). When you make a payment, you are redirected to, or interact with a secure form hosted by, the Payment Processor, and your full payment card number, security code, and bank account details are collected and stored by the Payment Processor, not by us. The Payment Processor's use of your information is governed by its own privacy policy. We retain records of transactions, including amounts, dates, descriptions, and the last four digits of the payment method, for accounting, tax, and dispute-resolution purposes.

Recurring maintenance plans. If you enroll in a monthly maintenance plan, you authorize us, through the Payment Processor, to charge your selected payment method on a recurring monthly basis until you cancel. You may cancel at any time from the Maintenance section of your Dashboard with a single click. Upon cancellation, no further charges will be made, and coverage continues through the end of the billing period already paid. We will send a confirmation of enrollment, of each renewal charge, and of cancellation to the contact method on your account.

10. Text messages (SMS)

If you provide a mobile telephone number, you consent to receive text messages from Note2 Studio related to your account and the Services, including one-time sign-in codes, quote notifications, payment confirmations, project updates, and replies to your chat messages. Message frequency varies based on your activity. Message and data rates may apply. You may opt out of non-essential text messages at any time by replying STOP, and you may reply HELP for help. You may also turn text notifications off in the Account section of your Dashboard. If you opt out, you may no longer be able to sign in with your telephone number and may need to use an email address instead. Carriers are not liable for delayed or undelivered messages.

We will not send you marketing text messages using an automated system without your prior express written consent, and consent to receive marketing text messages is not a condition of purchasing any goods or services. Mobile telephone numbers and text-messaging opt-in data are not shared with third parties or affiliates for their own marketing purposes.

11. Email communications

We send transactional emails related to your account and the Services, such as sign-in codes, quotes, receipts, and project updates. Where permitted by law, we may also send you emails about our Services, studio news, or offers. Every marketing email includes an unsubscribe link and our postal address, in accordance with the CAN-SPAM Act. Opting out of marketing emails will not stop transactional emails that are necessary to provide the Services. Our emails may include technologies that tell us whether an email was opened or a link was clicked, which we use to improve our communications.

12. Live chat and Instagram

When you request a live chat from your Dashboard, we notify members of our team by text message and/or email so that someone can join the conversation. If no one joins within approximately five minutes, you may leave a message for us or contact us through Instagram. Chat transcripts are stored with your account so that our team and you can refer to them later. Please do not share payment card numbers, passwords, or other highly sensitive information through chat.

If you contact us through Instagram, including via our account at instagram.com/note2.studio, your communications are also subject to the terms and privacy policy of Instagram and its parent company, Meta Platforms, Inc. We are not responsible for Meta's data practices.

13. Cookies and similar technologies

We and our service providers use cookies, local storage, pixels, and similar technologies ("Cookies") on the Site. Some Cookies are strictly necessary for the Site to function, such as those that keep you signed in, remember your Dashboard settings, and protect against fraud. Others help us understand how the Site is used or measure the effectiveness of our marketing.

You can control Cookies through your browser settings, including by blocking or deleting them. Blocking strictly necessary Cookies or clearing local storage will sign you out and may prevent parts of the Site or Dashboard from working properly.

14. Analytics and advertising

We may use third-party analytics services to collect and analyze information about the use of the Site. We may also use advertising technologies offered by platforms such as Google and Meta to measure the results of our own advertising and to show our ads to people who have visited the Site. To the extent this activity constitutes "selling" or "sharing" Personal Information, or "targeted advertising," under applicable state law, you may opt out as described in Section 20, including by enabling a Global Privacy Control signal in your browser.

15. Client websites we build

When we design, build, host, or maintain a website, application, or marketing campaign for a Client, we may process Client Data, such as form submissions, bookings, orders, or analytics data collected from visitors to the Client's website. In those cases, we act as a service provider or processor on behalf of the Client, we process Client Data only on the Client's documented instructions and as necessary to provide the Services, and the Client is responsible for providing any required notices to, and obtaining any required consents from, its own customers and visitors. Each Client uses its own payment processor account for payments made on the Client's website, and we do not receive or store the payment card details of a Client's customers. Individuals who wish to exercise rights regarding Client Data should contact the relevant Client directly; we will assist the Client in responding as required by our Agreement and applicable law.

We may display designs we create for Clients, including concept designs, in our portfolio, but we will not publish a Client's confidential information or Client Data without the Client's permission.

16. Data retention

We retain Personal Information for as long as reasonably necessary to fulfill the purposes described in this Policy, unless a longer retention period is required or permitted by law. In general: account and Dashboard information is retained while your account is active and for up to three (3) years after your last activity; project briefs, quotes, and project files are retained for the duration of the engagement and for up to seven (7) years afterward to support warranty work, future projects, and legal and tax obligations; payment and transaction records are retained for at least seven (7) years for tax and accounting purposes; chat transcripts and messages are retained for up to three (3) years; and inquiries from prospective clients who do not engage us are retained for up to two (2) years. When Personal Information is no longer needed, we delete it or de-identify it in a manner designed to prevent re-identification.

You may delete your account at any time from the Account section of your Dashboard. Deleting your account removes your profile and Dashboard data from active systems; we may retain certain records as required by law or for legitimate business purposes such as resolving disputes and enforcing our Agreements.

17. Data security

We maintain reasonable administrative, technical, and physical safeguards designed to protect Personal Information against loss, theft, and unauthorized access, use, alteration, and disclosure, consistent with the New York Stop Hacks and Improve Electronic Data Security Act (the "SHIELD Act") and other applicable laws. These safeguards include encryption of data in transit using TLS, passwordless authentication using time-limited one-time codes, restricting access to Personal Information to personnel who need it, use of reputable service providers with strong security programs, and regular review of our practices. However, no method of transmission over the internet or method of electronic storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping access to your email account and mobile device secure, as these are used to sign in to your account.

18. Security incidents and breach notification

If we become aware of a breach of security affecting your Personal Information, we will notify you and the relevant authorities as required by applicable law, including New York General Business Law § 899-aa, in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement and any measures necessary to determine the scope of the breach and restore the integrity of our systems. Where we act as a service provider to a Client, we will notify the Client in accordance with our Agreement.

19. Your choices and rights

Depending on where you live, you may have some or all of the following rights with respect to your Personal Information, subject to certain exceptions and limitations under applicable law:

• Access and portability: to confirm whether we process your Personal Information and to obtain a copy of it in a portable format;
• Correction: to correct inaccurate Personal Information. You can update your name and notification preferences directly in your Dashboard;
• Deletion: to request deletion of your Personal Information. You can delete your account directly from your Dashboard;
• Opt out: of the sale or sharing of Personal Information, targeted advertising, and profiling in furtherance of decisions that produce legal or similarly significant effects;
• Restriction and objection: to restrict or object to certain processing;
• Withdraw consent: where processing is based on consent; and
• Non-discrimination: not to receive discriminatory treatment for exercising your rights.

To exercise these rights, contact us using the details in Section 29. We will verify your request by confirming control of the email address or telephone number associated with your account, and we will respond within the time required by applicable law (generally within forty-five (45) days). You may designate an authorized agent to make a request on your behalf where permitted by law; we may require proof of the agent's authority. If we deny your request, you may appeal by replying to our decision with the subject line "Privacy Appeal," and we will respond to your appeal within the time required by law. If your appeal is denied, you may contact your state Attorney General.

20. U.S. state privacy rights

California. If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA"), provides you with the rights described in Section 19. In the preceding twelve (12) months, we have collected the following categories of Personal Information: identifiers (such as name, telephone number, email address, and IP address); customer records and commercial information (such as project details, quotes, and transaction records); internet or other electronic network activity information; approximate geolocation; and professional or employment-related information (such as your business name and industry). We collect this information from the sources described in Section 5, for the purposes described in Section 6, and disclose it to the categories of recipients described in Section 8. We do not sell Personal Information for money and do not knowingly sell or share the Personal Information of consumers under sixteen (16) years of age. California's "Shine the Light" law permits California residents to request information about disclosures of Personal Information to third parties for their direct marketing purposes; we do not make such disclosures.

Other states. Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, New Hampshire, New Jersey, Nebraska, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Rhode Island, and other states with comprehensive privacy laws may have similar rights, as applicable to us under those laws.

New York. We comply with applicable New York laws governing the privacy and security of Personal Information, including the SHIELD Act and New York General Business Law § 899-aa and § 899-bb.

21. Visitors outside the United States

The Site and Services are operated from the United States and are intended primarily for businesses in the United States. If you access the Site from outside the United States, your Personal Information will be transferred to, stored in, and processed in the United States and other countries where our service providers operate, which may have data protection laws different from those of your country. Where required, we rely on appropriate safeguards for such transfers, such as the European Commission's Standard Contractual Clauses. If you are located in the European Economic Area, the United Kingdom, or Switzerland, you also have the right to lodge a complaint with your local supervisory authority.

22. Children's privacy

The Site and Services are intended for businesses and adults. They are not directed to children under the age of sixteen (16), and we do not knowingly collect Personal Information from children under sixteen (16). If you believe that a child has provided us with Personal Information, please contact us, and we will take steps to delete it. Clients whose websites are directed to children are responsible for complying with the Children's Online Privacy Protection Act and other applicable laws on their websites.

23. Third-party sites and services

The Site contains links to, and integrations with, third-party websites and services, including Instagram, Stripe, and websites displayed in our portfolio or shared as references in project briefs. We do not control and are not responsible for the privacy practices of third parties, and we encourage you to read their privacy policies. The inclusion of a link does not imply our endorsement.

24. Automated processing and AI tools

We may use software tools, including artificial intelligence tools offered by reputable vendors, to help us draft copy, generate design concepts, summarize project briefs, and improve the efficiency of the Services. When we do, we use vendors that contractually agree not to use your information to train their models for other customers, where such terms are available, and we review outputs before they are delivered to you. We do not make decisions based solely on automated processing that produce legal or similarly significant effects concerning you.

25. Do Not Track and Global Privacy Control

Some browsers transmit "Do Not Track" signals. Because there is no common industry standard for interpreting these signals, the Site does not currently respond to them. However, we treat a Global Privacy Control ("GPC") signal sent by your browser as a valid request to opt out of the sale or sharing of your Personal Information and of targeted advertising for that browser, as required by applicable law.

26. Accessibility

We are committed to making this Policy accessible to individuals with disabilities. If you have difficulty accessing this Policy, please contact us, and we will provide it in an alternative format.

27. Changes to this policy

We may update this Policy from time to time to reflect changes in our practices, the Services, or applicable law. When we make changes, we will update the "Last updated" date above. If we make material changes, we will notify you by email or text message, through a notice in your Dashboard, or by posting a prominent notice on the Site before the change takes effect, and we will obtain your consent where required by law. Your continued use of the Site or Services after the effective date of an updated Policy constitutes your acknowledgment of the updated Policy.

28. Governing law and disputes

This Policy is governed by the laws of the State of New York, without regard to its conflict of laws principles, except to the extent that the data protection laws of your jurisdiction of residence apply and cannot be waived. Any dispute arising out of or relating to this Policy shall be resolved in accordance with the dispute resolution provisions of the applicable Agreement or, if none, exclusively in the state or federal courts located in New York County, New York, and you consent to the personal jurisdiction of those courts. To the fullest extent permitted by law, nothing in this policy creates any contractual or third-party beneficiary rights, and this policy shall not be construed to expand any liability of Note2 Studio beyond that which is imposed by applicable law or a signed agreement.

29. Contact us

If you have questions about this Policy or our privacy practices, or wish to exercise your rights, please contact us:

[LEGAL ENTITY NAME] d/b/a Note2.Studio
Attn: Privacy
[BUSINESS MAILING ADDRESS — use a business or P.O. box address, not a home address]
New York, NY [ZIP]
Email: [privacy@yourdomain]
Instagram: @note2.studio