Privacy
Effective date: October 24, 2026
This site is run by Quiles Studio ("the studio," "we"). This page explains — in plain terms — what information this site handles, where it goes, and what we never collect. If anything here is unclear, write to privacy@quiles.studio and a human will answer.
The short version
- The only personal information this site collects is what you type into the contact form — and the form’s only job is to turn your message into an email to the studio inbox.
- We run no analytics: no analytics scripts, pixels, or beacons on any page, and nothing to opt out of.
- We keep no server-side copy of your message. Our server logs contain four technical fields per form request — never your name, email, or message — and expire after 30 days.
- Fonts are self-hosted; no third-party font service ever sees your visit.
- If you text the studio's phone number, we use your number and your texts only to reply to you. See "Text messages" below.
What the contact form collects, and why
The contact form asks for your name, email address, and message, plus an optional company field. That’s the entire set — the form’s contract accepts nothing else.
We collect these for one reason: to read what you wrote and reply to you. Your name and message become the body of an email; your email address becomes the Reply-To so a reply from the studio inbox goes straight back to you. The optional company field is just extra context in that email.
Where your message goes
When you submit the form, your browser sends it over HTTPS to our API,
hosted on Render. The API checks the submission (including the spam
checks described below), composes a single email — From
contact@quiles.studio, Reply-To you — and sends it through Resend, a
transactional email service, to the studio inbox.
Two things worth stating plainly:
- There is no database, queue, or stored copy of your submission on our server. Your details exist in the server’s memory only for the moment it takes to send the email.
- The email itself is processed and delivered by Resend and lands in the studio inbox. Mail sent to the studio’s addresses travels through Porkbun's email forwarding, which passes it along to the studio inbox.
If the email can’t be accepted by the mail service at that moment, the form tells you honestly that the message wasn’t sent — we don’t claim a message was delivered when it wasn’t.
Text messages
If you text the studio's phone number, we receive your mobile number and your messages through our texting provider, Twilio, and we use them only to reply to you about what you asked. We text only people who texted us first, and we never send marketing texts. Message frequency varies. Message and data rates may apply. Reply STOP to stop receiving texts, or HELP for help.
No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Your text-message opt-in and consent are never shared with anyone, except Twilio, which uses them only to deliver our messages.
What we log — and what we never log
Each form request produces exactly one server log line with four technical fields:
- a request ID (a random reference we can use to look up a specific submission attempt if you follow up with us),
- a timestamp,
- an outcome (accepted, or the general class of failure), and
- a redacted error class (e.g. "rate limited" or "provider unavailable").
These log lines are kept for 30 days and then expire automatically.
We never log your name, email address, message, company, the spam-check values, your IP address, or any provider’s response details. We don’t keep any identifier tied to you in our logs — not even a hashed or partial version of one. If you write to us about a submission, the request ID shown on the form is the only handle we have to find its log line.
Spam protection (Cloudflare Turnstile)
The contact form is protected by Cloudflare Turnstile, plus two quiet first-party checks (a hidden field bots tend to fill in, and a minimum time-to-submit). These exist to keep automated abuse out of the studio inbox.
The Turnstile widget runs on the contact page, where Cloudflare evaluates browser and interaction signals to decide whether a visitor looks human, and issues a short-lived, single-use token. When you submit, our server asks Cloudflare to verify that token; that verification request carries the token and may carry your IP address. Your form fields — name, email, message — are never sent to Cloudflare. Per Cloudflare’s own documentation, Turnstile does not use cookies to track you.
We store nothing from any of these checks: no token, no hidden-field value, no timing value. A failed check appears in our logs only as an outcome class, never with any value attached.
No analytics
We do not run analytics. There is no analytics script, pixel, or beacon on any page of this site, no analytics vendor receives anything, and nothing about your visit is measured by us. Because nothing is collected, there is also nothing to opt out of. If that ever changes, this page will be updated before anything ships.
No booking at launch
This site has no booking or scheduling feature, and no booking provider receives any of your information.
Fonts are self-hosted
The font on this site is served from our own domain, exactly like any other static file. No request goes to Google Fonts or any other third-party font service, so no font provider receives any information about your visit.
The one thing stored on your device
If you’ve seen the site’s intro screen, we store a single timestamp in your browser’s local storage so the intro doesn’t replay for 30 days. That value never leaves your device — it is never sent to us or to anyone else. It goes stale on its own after 30 days, and you can remove it at any time by clearing your browser’s site data. This is not a cookie and is not used to identify or track you.
Who processes data for this site
Five third parties touch information in the course of running this site:
| Service | Role | What it sees |
|---|---|---|
| Render | Hosting (site, form API, and logs) | The connection details inherent to any web request (your IP address, browser, and requested page) when serving the site; your form fields, briefly and in memory only, while sending the email; our four-field log lines |
| Resend | Transactional email (sending only) | The full composed email: your name, message, and optional company, your email address as Reply-To, and the studio’s inbox address; delivery events such as bounces |
| Cloudflare (Turnstile) | Spam protection on the contact form | Browser and interaction signals from the widget, the verification token, and possibly your IP address during verification — never your form fields |
| Porkbun | Domain registrar and email forwarding | Mail addressed to the studio’s addresses, in transit to the studio inbox |
| Twilio | Text messages (only if you text the studio) | Your mobile number, your texts and our replies, and their delivery status |
Each of these handles that information under its own policies and retention practices; we chose them to be the minimum set needed to run the site.
How long we keep things, and how to ask for deletion
- Server logs: 30 days, then automatically expired. They contain no personal information to begin with.
- The email you send us: it lives in the studio inbox (and in Resend’s own sending records, per Resend’s policies) so we can continue the conversation. Correspondence with prospective clients is kept at the studio’s discretion — but if you’d like an email thread deleted, write to privacy@quiles.studio and we’ll delete it.
- Texts: kept in the studio's Twilio account and on the studio's own computer so we can continue the conversation. To have a text conversation deleted, write to privacy@quiles.studio.
- If an email address causes delivery failures, Resend may keep that address on a suppression list (with the reason) to protect deliverability. That entry is removed when the suppression is removed.
Depending on where you live, you may have specific legal rights over your personal information. Whatever your region, the way to exercise them here is simple: email privacy@quiles.studio, tell us what you’d like (a copy, a correction, a deletion), and we’ll take care of it.
A future notification feature
A later phase of this site may add a way to subscribe to updates from the studio’s Lab section. It doesn’t exist today — no newsletter, notification, or subscription information is collected now — and if it ships, it will have its own explicit consent and unsubscribe flow, and this page will be updated before it launches.
Changes to this page
If the way this site handles information changes, this page changes first: we update the copy here before the change ships, and the effective date at the top moves with it. Material additions — like the future notification feature above — get their own consent flow rather than being quietly folded in.
Contact
Questions, requests, or corrections about privacy on this site: privacy@quiles.studio.