| Applies to | designsbyduhart.org, NEURAL//RUN at designsbyduhart.org/neural-run, and the live demos shown on designsbyduhart.org/demos from demo.designsbyduhart.org |
| Version | 1.0 (the page footer shows the exact text checksum) |
| Effective | 20 October 2026 |
| Laws this is written for | UK GDPR and the Data Protection Act 2018; the Privacy and Electronic Communications Regulations 2003 (PECR) as amended by the Data (Use and Access) Act 2025; the EU General Data Protection Regulation (EU GDPR); the ePrivacy Directive 2002/58/EC as implemented in each EU country |
Part 1. Privacy notice
1. The short version
- This is a portfolio site. Most visitors just read pages, and we keep almost nothing about them.
- We only collect what you send us (a contact message, an order, a sign-in) and the technical data any web server sees.
- We do not sell your data. We do not run advertising, ad pixels or third-party analytics on this site.
- The live demos store their state in your own browser. Nothing you type into the Vitals demo leaves your device.
- If you are in the UK, the EU or Switzerland, we ask before using any cookie or storage that is not strictly needed, and saying no is as easy as saying yes.
2. Who is responsible for your data
The controller is Designs by Duhart (operated by Matriarch Solutions Inc, a Georgia corporation, Control Number 24108657), 8735 Dunwoody Place #4412, Atlanta, GA 30350, United States.
| Privacy questions and rights requests | admin@designsbyduhart.org |
| Data Protection Officer | Carina Frey. Write to admin@designsbyduhart.org, marked for the attention of the Data Protection Officer |
| UK representative (UK GDPR Article 27) | Carina Frey, Sauerbruchstraße 31, 68723 Schwetzingen, Germany |
| EU representative (EU GDPR Article 27) | Carina Frey, Sauerbruchstraße 31, 68723 Schwetzingen, Germany |
| Swiss representative | Carina Frey, Sauerbruchstraße 31, 68723 Schwetzingen, Germany |
We have appointed Carina Frey as our Data Protection Officer. We have no establishment in the European Economic Area, so no single lead supervisory authority applies to us; you can complain to the authority in your own country (Section 6).
3. What we collect, why, and on what basis
| What you do | Data | Why | Legal basis | How long we keep it |
|---|---|---|---|---|
| Visit any page | IP address, browser user agent, page requested, time, country derived from IP, and Cloudflare request data | Deliver the page, keep the site secure, diagnose faults | Legitimate interests (Article 6(1)(f)): running a secure website | Cloudflare Workers Logs and our trace data are kept for 7 days, then deleted |
| Send a contact message | Name, email, subject, message, any files you attach, IP address and country | Read and answer your message | Legitimate interests in answering people who write to us. If your message is about buying something, steps before a contract (Article 6(1)(b)) | The message arrives by email at admin@designsbyduhart.org. We keep it for 3 years after the conversation ends. It is not stored in our database |
| Contact form security check | A Cloudflare Turnstile token and its result. If the check fails, your IP address is written to our logs | Stop automated spam | Legitimate interests; the PECR and ePrivacy exemption for storage strictly necessary for a service you asked for | Logs as above |
| Buy from the store | Name, email, items, amount, currency, order status, Stripe checkout session and payment reference, whether the payment was live or test, timestamps | Take payment, deliver the download, keep tax and accounting records, handle refunds and faults | Contract (Article 6(1)(b)); legal obligation (Article 6(1)(c)) for accounting and tax records | Order records are kept for 10 years after the end of the financial year, as tax law requires. Your card details go to Stripe, never to us |
| Leave a tip | Whatever you enter on Stripe's payment page | Take the payment | Contract | Stripe keeps its own records. We receive the payment confirmation and keep it with our accounts for 10 years |
| Sign in to NEURAL//RUN with Google | Google account ID, name, email address, profile picture, game progress, mission scores, time taken, hints used, achievements | Run your account and save your progress | Contract (the game you signed up for) | Until you delete your account, then 30 days for backups to roll over |
| Join the NEURAL//RUN leaderboard | Your chosen handle and scores, shown publicly | Show the public leaderboard | Consent (Article 6(1)(a)). The leaderboard is off unless you switch it on, and you can switch it off any time | Until you switch it off or delete your account |
| Use a live demo | Whatever you enter stays in your browser's storage | Make the demo work | Strictly necessary for the demo you opened; nothing is sent to us | Until you clear your browser storage |
| Sign in to the operator console | Google account ID, name, email | Staff access only | Legitimate interests in securing our own tools | Session up to 30 days |
| Security and fraud checks (planned, see Part 3) | Device and network signals at form submit, checkout and sign-in | Stop spam, fake orders and account abuse | Legitimate interests; PECR and ePrivacy strictly-necessary exemption | Signal hashes 90 days |
We do not collect special category data, such as health, ethnicity or sexuality. The Vitals demo lets you type in body and food data, but it stays in your browser and we never receive it.
We do not make decisions about you by automated means that have legal or similarly significant effects. If the planned security checks hold an order or sign-in for review, a person reviews it.
4. Who receives your data
We use these service providers. Each processes data on our instructions, under a data processing agreement, unless we say otherwise.
| Provider | What they do for us | Data involved | Where |
|---|---|---|---|
| Cloudflare, Inc. | Hosting, content delivery, security, Turnstile, email sending, logs, our database and file storage | All website traffic, contact messages in transit, orders | Global network; United States company |
| Stripe | Payments, checkout and tips | Name, email, card and billing details, order | United States and Ireland. Stripe is an independent controller for its own fraud and legal duties |
| Sign-in for NEURAL//RUN and the console | Sign-in data | United States. Google is an independent controller for your Google account | |
| Supabase | NEURAL//RUN database: profiles, progress, scores | NEURAL//RUN account data | Not in use today. If we switch the leaderboard database on, we will name its region here first |
| Email delivery (our Cloudflare mailer, or Resend as a fallback) | Delivers contact messages and order emails | Names, emails, message content | United States |
| Trace collection | Error and performance traces | Request metadata | Not in use today. Traces are only exported if we connect a collector, and we will name it here first |
| esm.sh, StackBlitz, CodeSandbox | Code samples on blog pages. In the UK, the EU and Switzerland they load only when you choose to run one | Your IP address and browser data, as with any website you visit | United States. Independent controllers |
We share data with authorities only when the law requires it, and we push back on requests that are not lawful.
5. International transfers
Some providers are in the United States or other countries outside the UK and the EU. When your data goes there, we rely on one of these:
- the EU and US Data Privacy Framework and its UK extension, where the provider is certified (Cloudflare, Stripe and Google are certified);
- the EU Standard Contractual Clauses (2021/914) for EU data;
- the UK International Data Transfer Agreement or the UK Addendum to the EU clauses for UK data;
- an adequacy decision where one exists.
You can ask us for a copy of the safeguards at admin@designsbyduhart.org.
6. Your rights
If UK or EU law applies to you, you can:
- get a copy of your data (access);
- correct it (rectification);
- have it deleted (erasure);
- limit how we use it (restriction);
- take it with you in a common format (portability), where we rely on consent or contract;
- object to anything we do on the basis of legitimate interests, including security processing. We will stop unless we have compelling reasons that override yours, or we need it for legal claims;
- withdraw consent at any time, without affecting what happened before;
- not be subject to a solely automated decision with legal or similarly significant effects.
Write to admin@designsbyduhart.org. We answer within one month, or tell you within that month if we need up to two more months for a complex request. We may ask you to confirm who you are. We do not charge, unless a request is plainly unfounded or excessive.
Complaints. Please tell us first, and we will try to fix it. You can also complain to a supervisory authority:
- in the UK, the Information Commissioner's Office (ico.org.uk, 0303 123 1113);
- in the EU, the authority where you live or work, or where the problem happened. We have no establishment in the EU, so there is no lead authority for us.
7. Children
This site is not aimed at children. NEURAL//RUN is for people aged 16 and over. If you think a child has given us data, write to us and we will delete it.
8. Security
- Traffic is encrypted with HTTPS.
- Console access is limited to named staff accounts.
- Card data never touches our systems.
- We keep logs only as long as Section 3 says.
No system is perfectly secure. If a breach puts your rights at risk, we will tell the regulator within 72 hours and tell you without undue delay where the law requires.
9. Changes
When we change this policy, we update the version and date at the top.
- If a change affects how we use data you already gave us, we tell you before it takes effect.
- If a change needs new consent, the cookie banner asks again.
Part 3. Security and fraud prevention (planned)
We plan to run our own fraud detection system, called Sentinel, on this site before it is used anywhere else. It is built and hosted by us. No third-party fraud vendor is involved.
| When it runs | Only when you do something that could be abused: send a contact message, start a checkout, or sign in. It does not run when you just read pages |
| What it reads | Device and browser characteristics: graphics and audio rendering results, screen, time zone, language, fonts, hardware information, browser features; how the form was used (timing only, never what you typed); network information from your connection; and a random security ID stored on your device |
| What it does | Works out a risk score. A normal score changes nothing. A high score may add a short automatic check, or hold an order or sign-in for a person to review. It never blocks you automatically for good |
| Legal basis | Legitimate interests (Article 6(1)(f)) in stopping fraud and spam, which is also in your interest. For storing and reading from your device, the exemption for storage strictly necessary for the service you asked for |
| What it is never used for | Advertising, profiling your interests, tracking you on other sites, or sharing with anyone else |
| How long | We store hashes of the signals, not the raw values, for 90 days. Links between a device and an account are kept longer only where an account was closed for fraud or abuse, and only to stop it coming back |
| Your rights | You can object (Section 6). You can ask a person to review any hold. You can ask what kinds of signals were used. We will not publish exact thresholds, because that would help fraud |
This section takes effect only when Sentinel goes live. Until then, the only security check is Cloudflare Turnstile on the contact form.
Part 4. Contact
Designs by Duhart, admin@designsbyduhart.org. 8735 Dunwoody Place #4412, Atlanta, GA 30350, United States.