Privacypolicy

01The short version

AM Studio collects only what it needs to answer you, do the work and run the client portal. We don't sell your information, we don't use advertising cookies, and you can ask us to see, fix or delete what we have about you at any time.

02Who we are

AM Studio (am.studio) is a small web design and software studio run by Adrian Mustafa in Chicagoland, Illinois. When this policy says "we" or "us", it means AM Studio. Questions go to adrian@am.studio or (847) 343-0291.

03What we collect

When you contact us or ask for a free audit:

• Your name, business name, email address and phone number, if you give them.
• Your website address and anything you write in the message.

When you use the client portal:

• Your name and email address, which we use to set up your login.
• Your password, stored only as a scrambled (hashed) version that can't be turned back into the password. We never see it.
• Sign-in records: when you signed in, your IP address and your browser type, so we can keep your account safe and let you sign out other devices.
• If you choose Sign in with Google or Microsoft, your name, email address and profile photo from that account. We never receive your Google or Microsoft password.
• What you add to the portal: requests, approvals and notes, business details, files, the teammates you invite and your email notification choices.

When billing is turned on:

• Payments are handled by Stripe, our payment processor. Your full card or bank details go straight to Stripe and never touch our servers.
• We keep a copy of your invoices, payments and plans, plus the card brand and last four digits so you can see which card is on file.

Automatically, when you visit the site:

• Our host, Cloudflare, handles basic technical details such as your IP address, browser and the pages you ask for, to deliver the site quickly and protect it from attacks.
• Our forms use Cloudflare Turnstile, which looks at technical signals from your browser to tell people from bots. It's built to do this without tracking you across other sites.
• On the public website only (not the client portal), Google Analytics and Microsoft Clarity record how the site is used: which pages people visit, where they came from, roughly where they are, their device, and how they scroll and click. Clarity can replay a visit as a recording, with anything typed into forms hidden. We use this only to improve the site.
• Cloudflare Web Analytics counts visits and page speed without cookies.

04How we use it

• To answer your message and prepare your free audit.
• To plan, build and support your project, and to run the client portal.
• To send emails you need: portal invites, password resets, sign-in alerts, request and approval updates, invoices and receipts. You can switch off most portal emails on your Account page. Emails about payment problems and account security always go out.
• To bill you for work you've agreed to.
• To keep the site, the portal and your account secure, and to stop spam and abuse.
• To meet legal, tax and accounting requirements.

We don't add you to a newsletter and we don't send marketing email you didn't ask for. If we reach out about a website you own, it's a one-off note and you can tell us to stop.

05AI tools

We may use AI tools, such as Anthropic's Claude, to help draft replies, summarize requests or prepare reports. A person reviews anything before it's sent to you, and these providers handle the information under their business terms for that purpose. We don't use AI to make decisions about you that have legal or similar effects.

06Cookies and browser storage

• One sign-in cookie, only if you use the client portal. It keeps you signed in and expires after 30 days, or when you close your browser if you didn't choose to stay signed in.
• Security cookies that Cloudflare or Turnstile may set to tell people from bots.
• A few settings saved in your browser, like a collapsed sidebar or dark mode. They stay on your device.
• Analytics cookies from Google Analytics and Microsoft Clarity, on the public website only, so we can see how the site is used. If you visit from the EU, the UK, Switzerland or Albania, they only load after you click Accept. Anyone can turn them off with Cookie settings at the bottom of every page, and the site works the same without them.

That's all. No advertising cookies and no selling or sharing for ads.

07Who we share it with

Only with services that help us run AM Studio, and only what they need to do their part:

• Cloudflare: website hosting, database, file storage, email sending and security.
• Google Workspace: our email and documents.
• Google Analytics (through Google Tag Manager) and Microsoft Clarity: how the public website is used.
• Stripe: card and bank payments.
• Google or Microsoft: only if you choose to sign in with them.
• AI providers, as described above.

We may also share information if the law requires it, to protect someone's safety or our legal rights, or if AM Studio is ever sold or merged, in which case this policy keeps applying to your information. We never sell your personal information.

08How long we keep it

• Messages and audit requests that don't turn into a project: up to 3 years after we last heard from you, then deleted.
• Client records, invoices and project history: while you're a client, then up to 7 years for tax and legal reasons.
• Sign-in sessions end after 30 days. Password reset links expire after 30 minutes and invite links after 7 days.
• If you ask us to delete something, we do it unless the law requires us to keep it.

09Your choices

You can ask us to show you, correct, export or delete the information we have about you, or to close your portal account. Email adrian@am.studio and we'll answer within 30 days. We may need to confirm it's really you first. Depending on where you live, including California and the EU or UK, you may have more rights under local law, and we'll honor them.

If you're in the EU or UK, we use your information to take steps you've asked for and to carry out our agreement with you, for our legitimate interest in running and protecting the business, to meet legal requirements, and with your consent where we ask for it. You can complain to your local data protection authority.

10Security

The site and portal only work over a secure connection (HTTPS). Passwords are hashed, sign-in attempts are rate-limited, and each client can only ever see their own business's information. No system is perfectly secure, so if we ever learn of a breach that affects you, we'll tell you promptly.

11Where it's stored

We're based in the United States and our providers mostly store data in the US, though Cloudflare runs a worldwide network to keep the site fast. If you're outside the US, your information may be handled there.

12Children

AM Studio is for businesses. The site and portal aren't meant for children under 13, and we don't knowingly collect their information.

13Changes

If we change this policy we'll update the date at the top. If the change matters to how we use your information, we'll also email portal users before it takes effect.