What we collect and why.

drexelstudios.com is a static site. It has no accounts, no forms, no analytics and no advertising. We do not run tracking scripts and our web server does not keep access logs.

The site stores one value in your browser's session storage so the opening animation plays once per visit. It is not a cookie, it identifies nothing and it is gone when you close the tab.

The contact link opens your own email app. Anything you send us by email is kept in our mailbox for as long as we need it to answer you and to keep a record of the conversation.

The portal is for clients we already work with. Accounts are created by invitation only. When you use it we collect the following.

• Account details. Your name, your email address, your role and the client business your account belongs to.
• Sign-in records. There are no passwords. Each time you sign in we email you a one-time code and a link. We record the IP address and browser of each session so we can spot misuse. A session lasts up to 30 days.
• Terms acceptance. When you accept the terms of service we record which version you accepted, when you accepted it and the IP address and browser you used.
• Work you send us. Requests, comments, feature descriptions and any files you attach. This is the material we need to do the work you asked for.
• Billing records. Your plan, its add-ons, the status of your subscription and a record of each invoice and payment: amount, currency, date and status. We never see or store card numbers. Stripe handles card details on its own pages.
• Activity log. A record of actions taken in the portal, such as a request being opened or a plan being changed, so we can support you and keep an accurate account of the work.

• To do the work you asked for and to communicate with you about it.
• To run the portal, sign you in securely and keep your account safe.
• To bill you for your plan and keep the records that tax and accounting rules require.
• To answer support questions and investigate problems.
• To meet legal obligations and to protect our rights and yours.

We do not sell personal data. We do not use it for advertising. We do not profile you.

We use a small number of service providers. Each one receives only what it needs for its job.

• Stripe processes payments and hosts the checkout and billing pages. When we set up your billing we send Stripe the name of your business, a billing email address and our internal reference for your account. Card details go straight to Stripe and never pass through us. Stripe's own privacy policy applies to the data you enter on its pages.
• Resend delivers the portal's emails: sign-in codes, invitations, payment links and updates on requests and features. It receives the recipient address and the content of each email.
• Cloudflare stores the files you attach to requests and features and our database backups in its R2 storage.
• Anthropic powers the optional Polish tool in the portal. When you press Polish on text you are writing, that text is sent to Anthropic's API to be rewritten for clarity and returned to you. Nothing is sent unless you choose to use it, and only the text you are editing is sent.
• GitHub holds the private issue tracker we plan work in. The title and description of a request you file may be copied into it.
• Hetzner provides the servers in Finland that run the portal and its database.

Some of these providers are in the United States. Where data leaves the country you are in, it is protected by the provider's standard contractual terms.

The portal sets only the cookies it needs to work: one that keeps you signed in and one or two that protect the sign-in flow against forgery. There are no third-party cookies and no advertising cookies. If you block these cookies you cannot sign in.

• Account details and the work you send us: for as long as you are a client, and afterwards for as long as we need them to keep a record of the work we delivered.
• Billing records: for as long as tax and accounting rules require.
• Sign-in sessions: 30 days, or until you sign out.
• Delivery logs for emails and payment notifications: 180 days, then deleted automatically.
• Files you started uploading but did not finish: one day, then deleted automatically.

Ask us at hello@drexelstudios.com and we will delete your personal data or send you a copy of it within 30 days, except for records we are required to keep.

Everything travels over HTTPS. There are no passwords to steal, and sign-in codes expire after ten minutes. Accounts exist by invitation only. Sign-in attempts are rate limited. The links that let a client pay for a plan are stored encrypted and expire after 30 days. Access to the servers is by key only, and the administration console is not reachable from the public internet.

You can ask to see the personal data we hold about you, to correct it, to have it deleted or to receive a copy of it. You can object to a use you disagree with. Write to hello@drexelstudios.com and we will answer within 30 days. If you are in a jurisdiction with a data protection authority you also have the right to complain to it.

This site and the portal are for businesses. They are not directed at anyone under 18 and we do not knowingly collect data from children.

When this policy changes we update the date at the top of the page. If a change affects how we use data we already hold about portal users, we email those users before it takes effect.

Drexel Studios LLC. Email hello@drexelstudios.com.