Privacy policy.

Summary

twopercent is a small US-based studio (Art Circle LLC d/b/a twopercent™, registered in Michigan). We only collect the data we need to respond to inquiries, schedule calls, send the studio newsletter when you ask for it, and understand how the site is being used. We do not sell personal data, we do not run ad targeting, and analytics are off by default until you opt in. You can ask us to delete your data at any time by emailing twopercentstudio@gmail.com.

Who we are

This site is operated by Art Circle LLC d/b/a twopercent™, a Michigan limited liability company. References to “twopercent,” “we,” “us,” or “our” in this policy mean Art Circle LLC. We are the data controller for any personal information we collect through twopercentstudio.com and twopercent.co.

Privacy questions and data-rights requests should go to twopercentstudio@gmail.com. We respond within 30 days as a default and faster when we can.

What we collect

We collect personal information in three contexts:

When you contact us

The contact form on /contact collects your name, email, optional company and role, the type of project you are exploring, an optional budget bracket and timeline, and the message body. Booking a discovery call through Calendly collects your name, email, timezone, and any answers you provide on the scheduling form.

When you subscribe to the newsletter

We collect your email address, the source of the signup (footer form, contact-form checkbox, etc.), the timestamp, and the consent version in effect when you signed up.

When you visit the site

Our hosting provider (Vercel) records standard server-log information: IP address, user-agent string, requested URL, response status, and timestamp. We also run cookieless visitor analytics through Vercel that count page views without setting cookies or identifying individual users.

If you accept analytics on the cookie banner, we additionally load Google Analytics 4 and Microsoft Clarity. These collect aggregate session data, scroll depth, click events, and (in Clarity’s case) anonymized session recordings to help us understand how the site is used. Both are denied by default until you opt in, and revoking consent halts further collection.

How we use it

We use personal information only for the purpose it was collected:

• To respond to your inquiry and discuss a possible engagement.
• To deliver the services you contract us for.
• To send the studio newsletter when you have explicitly subscribed.
• To understand how the site is used in aggregate, but only after you opt in.
• To meet our legal, tax, and accounting obligations as a US business.

We do not use your personal information for advertising, do not sell or rent it to third parties, and do not combine it with third-party data sources for profiling.

Subprocessors

We use a small set of third-party services to run the studio. Each of them processes personal information on our behalf and is bound by their own privacy policy:

Rows marked planned are integrations in flight; we disclose them in advance so this policy is accurate when each goes live in the coming weeks. No data is shared with a planned provider until the integration ships.

When payment processing goes live, Stripe will be added to this list. Stripe holds payment-card data directly; we only see the last four digits and the billing name.

Cookies and tracking

The site sets the following first-party storage:

• Consent choice— one cookie storing your accept/decline answer for 180 days so we do not re-prompt you on every visit. This is set whether you accept or decline.
• UI state— small amounts of localStorage for non-essential preferences like remembered form drafts. These never leave the browser.

When you accept analytics on the cookie banner, Google Analytics 4 sets its standard set of cookies (typically _ga and one or two property-scoped variants) and Microsoft Clarity sets its session and replay cookies. When you decline or later revoke, those scripts do not load and previously set cookies stop receiving updates. We honor the Global Privacy Control signal as the equivalent of declining analytics.

You can re-open the cookie banner at any time using the “Cookie settings” link in the site footer.

How long we keep it

• Inquiry messages (contact form + Calendly): up to 24 months from your last contact, then deleted.
• Newsletter subscriptions: kept until you unsubscribe. After you unsubscribe we keep your email on a suppression list indefinitely so we do not accidentally re-add you.
• Consent choices: 180 days, after which we re-prompt.
• Analytics data (when consented):up to 14 months in GA4 (Google’s default user-data retention) and up to 13 months in Microsoft Clarity (their stated maximum).
• Server logs (Vercel):up to 30 days. Vercel’s log-drain retention varies by plan; this is the maximum window we treat as live.
• Engagement records (signed contracts, invoices, project files): retained for the duration of the engagement plus 7 years for US tax and accounting compliance.

Your rights

If you are in the EU, UK, or EEA

Under the GDPR you have the right to:

• Access the personal data we hold about you.
• Have it corrected if it is wrong.
• Ask us to delete it.
• Restrict or object to certain processing.
• Port your data to another provider in a machine-readable format.
• Withdraw consent at any time without affecting prior processing.
• Lodge a complaint with your local supervisory authority.

Email twopercentstudio@gmail.com to exercise any of these rights. We respond within 30 days.

If you are in California

Under the CCPA/CPRA you have the right to:

• Know what personal information we have collected about you.
• Delete it.
• Correct inaccurate data.
• Opt out of the sale or sharing of personal information. We do not sell or share personal information as those terms are used in the CPRA. We also treat the Global Privacy Control browser signal as a preference to keep optional analytics off.
• Limit our use of sensitive personal information — we do not knowingly collect any.
• Not be discriminated against for exercising these rights.

We respond to verifiable consumer requests within 45 days as the CCPA requires.

International transfers

twopercent is based in the United States and most of our subprocessors operate primarily from the United States. If you are accessing the site from outside the US, your data will be transferred to and processed in the US. Where applicable law requires a transfer mechanism for personal data leaving your region, we rely on whichever the receiving provider offers — typically the European Commission’s Standard Contractual Clauses, the UK addendum, the EU-US Data Privacy Framework, or another lawful mechanism made available by that vendor.

Security

We protect personal information with the standard practices a serious small studio uses: TLS everywhere, environment-variable separation per deployment environment, principle-of-least-privilege on credentials, parameterized database queries, secret rotation on a regular cadence, and access restricted to the people directly working on an engagement. No system is perfectly secure, and we cannot guarantee absolute security, but we will notify affected individuals and competent authorities promptly if we ever experience a breach that warrants it.

Children

twopercent does not offer services to children and we do not knowingly collect personal information from anyone under 16. If you believe we have inadvertently collected information from a child, email twopercentstudio@gmail.com and we will delete it.

Changes

We may update this policy as the studio evolves, when we add or remove subprocessors, or to reflect changes in applicable law. The “last updated” date at the top of the page reflects the most recent change. Material changes will be flagged in the studio newsletter (if you are subscribed) and on the site footer.

Contact

For privacy questions, data-rights requests, or to report a concern, email twopercentstudio@gmail.com. For everything else, the regular contact channels work too — /contact for inquiries, or the discovery call link on /pricing.