Privacy policy

This site is run by me, Kaspar Kuus, an independent product designer, through my company Polaround OÜ — a private limited company registered in Estonia. Polaround OÜ is the data controller for the personal data described here: it decides what is collected and why. For anything in this policy, including any request about your data, email me at hello@kasparkuus.com.

I do not sell your data, and I do not share it with anyone beyond the service providers listed further down, who act on Polaround OÜ’s behalf.

When you subscribe or download a resource. If you sign up for my notes or ask for a resource like the bad-day audit PDF, I collect your email address. My email provider also records the time you confirmed and the IP address you used, as proof that you opted in. I use this to send occasional notes on product design and to deliver the resource you asked for. Sign-up is double opt-in — you confirm by clicking a link in a first email — and every email has a one-click unsubscribe.

When you book a call. The booking page uses Cal.com. To schedule a call it collects your name, email address, time zone and anything you type into the booking form. I use this only to arrange and prepare for our conversation.

When you email me. If you write to me directly, I keep your email address and the content of your message so I can reply and, if it goes somewhere, discuss working together.

When you simply visit. The site is hosted on Cloudflare, which processes standard technical data, your IP address, browser type and the pages requested, in server logs, to serve the pages and keep the site secure. Any visitor analytics I use is cookieless: it counts page views and clicks in aggregate, stores nothing on your device and does not identify you or follow you to other sites.

If you arrive from an advertisement. I sometimes run ads, and I want to know which ones bring people who go on to book a call. Measuring that needs cookies set by the advertising platform, so it never happens unless you accept it first: a bar asks, declining is one click, and your choice is remembered. Decline and nothing on the site is withheld or degraded. If you accept, the platform records that a visit and a booking came from a given campaign.

Consent — for the notes and downloads. You choose to sign up, and you can withdraw at any time by unsubscribing; that does not affect anything sent before you did.

Consent — for advertising cookies, separately. Nothing is set until you accept, and you can withdraw by clearing this site’s data in your browser, which makes the bar ask again.

Your request and steps toward a contract — for bookings and enquiries. You are asking me to do something (schedule a call, reply to you), so I process what I need to do it.

Legitimate interests — for replying to you and for keeping the site available and secure, balanced against your privacy.

A few trusted providers process data on my behalf, only to provide their part of the service:

MailerLite (EU, Lithuania) — stores the subscriber list and sends the notes and confirmation emails.

Cal.com — powers the “book a call” scheduling and the details you enter there.

Cloudflare — hosts and delivers the website and processes the server logs described above.

Advertising platforms (currently Google and Meta) only if you accept advertising cookies. They then receive that a visit or a booking came from one of their campaigns. Decline, or ignore the bar, and their tags are never loaded at all.

Each acts under an agreement that limits them to processing the data for these purposes only. Links to their own privacy policies are on their websites.

My email provider is in the EU. Some other providers (such as Cal.com and Cloudflare, and the advertising platforms if you accept their cookies) may process data outside the European Economic Area. Where that happens, the transfer relies on appropriate safeguards, typically the European Commission’s Standard Contractual Clauses or an adequacy decision, so your data keeps a comparable level of protection.

Subscription data stays until you unsubscribe or ask me to delete it, after which it is removed from the list.

Booking and email conversations are kept while we are in contact and for as long as needed for any work that follows, plus any period I am legally required to keep records, and are then deleted.

Server logs are short-lived and kept only for the periods my host applies for security and diagnostics.

Under the GDPR you can ask me to give you a copy of your data, correct it, delete it, restrict or object to its use, or provide it in a portable form. Where I rely on consent, you can withdraw it at any time. To do any of this, email hello@kasparkuus.com — for the notes, the unsubscribe link in any email is the fastest route.

If you think I have handled your data badly, please tell me first so I can put it right. You also have the right to complain to a data protection authority — in Estonia, the Data Protection Inspectorate (Andmekaitse Inspektsioon), or the authority in your own EU country.

This site sets no advertising or cross-site tracking cookies unless you accept them. If advertising measurement is switched on, a bar asks before anything loads, both answers are one click, and the answer is remembered in your browser so you are not asked again. Declining withholds nothing: every page, download and the booking flow work exactly the same.

Visitor analytics, where used, is cookieless. It counts page views and clicks in aggregate and builds no profile of you.

The booking page embeds Cal.com, which may set its own cookies when you use it to schedule a call; if you never open the booking page, those are never set. Fonts are served from this site, not a third party.

If this policy changes, the “last updated” date at the top will change with it. For anything at all about your privacy or your data, write to me at hello@kasparkuus.com.