Privacy Policy

1. Who we are and what this covers

kittyShark LLC ("kittyShark," "we," "us," or "our") is a Michigan limited liability company operating as an independent brand and motion design studio. We are the controller of the personal information described in this policy.

This Privacy Policy explains how we collect, use, share, and protect information when you visit kittyshark.studio, kittysharkcreative.com, their subdomains, and any other site we operate that links to this policy (together, the "Sites"). It also covers information we receive through our profiles on Facebook, Instagram, LinkedIn, YouTube, Behance, Dribbble, Etsy, and Creative Market, though those platforms have their own privacy policies that govern their handling of your data.

By using the Sites, you acknowledge this policy. Where consent is required by law, we ask for it separately rather than treating your visit as agreement.

2. Information we collect

Information you give us

• Contact and project inquiries. Your name, email address, company or organization, and whatever you choose to put in the message field.
• Email list signups. Your email address and, if you provide it, your name.
• Purchases of digital products. Your name, email address, billing details, and order history. We do not receive or store full payment card numbers. Payments are processed by our payment provider, which handles card data directly.
• Anything else you send us. Files, feedback, or correspondence you share by email or through the Sites.

Information collected automatically

When you visit the Sites, limited technical information is collected automatically:

• IP address (which may be truncated or anonymized by our analytics provider), general location inferred from it, browser type and version, device type, and operating system
• Pages viewed, time on page, referring URL, and outbound links clicked
• Date and time of access, and server and edge network logs generated by Cloudflare, our hosting and network provider
• Bot-detection signals collected when you submit a form, described in section 5

Information from third parties

If you buy a digital product through a marketplace or a hosted checkout, that provider passes us limited order information, typically your name, email, and what you purchased. We may also receive aggregate, non-identifying statistics from social platforms about how content performs.

Categories of personal information collected

We do not knowingly collect sensitive personal information, including government ID numbers, precise geolocation, health data, biometric data, racial or ethnic origin, religious beliefs, or sexual orientation, and we ask that you not send it to us.

3. How we use information

• To reply to your inquiry and discuss potential or ongoing work
• To deliver digital products you purchase, and to provide receipts and support
• To send emails you asked to receive, such as studio updates or new work, with an unsubscribe link in every one
• To understand how the Sites are used, in aggregate, so we can improve them
• To maintain security, prevent spam, fraud, and abuse, and troubleshoot technical problems
• To meet legal obligations, resolve disputes, and enforce our Terms of Use

We do not use your personal information to build advertising profiles, and we do not use it to train machine learning or AI models.

4. Legal bases for processing (EU/UK visitors)

If you are in the European Economic Area, the United Kingdom, or Switzerland, we process your personal data on the following bases:

• Consent for non-essential cookies and analytics, and for marketing emails. You can withdraw consent at any time; withdrawal does not affect processing carried out before it.
• Contract to respond to a project inquiry you initiated, and to deliver a product you purchased.
• Legitimate interests to keep the Sites secure and functioning, to protect our forms from automated abuse, and to understand aggregate usage. We balance these interests against your rights and use the least intrusive option available.
• Legal obligation to retain tax and transaction records, and to respond to lawful requests.

5. Cookies and tracking

A cookie is a small text file a site stores in your browser. We use a limited set, in two groups:

• Strictly necessary. These keep the Sites working: security, network routing, bot protection on our forms, and remembering your cookie choices. They load without consent because the Sites cannot function safely without them.
• Analytics. These help us count visits and see which pages are useful. They load only after you accept them in our cookie banner.

We do not use advertising, retargeting, or cross-site tracking cookies.

Bot protection on our forms

Our contact and signup forms are protected by Cloudflare Turnstile, which checks that a submission comes from a person rather than an automated script. To do that it processes signals from your browser, including your IP address, user agent, and a TLS fingerprint, and it may set a strictly necessary cookie. Cloudflare acts as our processor for this and states these signals are used solely to detect and block bots, not to identify, profile, or target individuals. See Cloudflare's Turnstile privacy policy.

Managing your choices

The first time you visit, our cookie banner lets you accept or reject non-essential cookies. You can change your choice at any time by clicking the cookie icon in the bottom corner of any page. You can also block or delete cookies in your browser settings, though blocking strictly necessary cookies may break parts of the Sites.

Global Privacy Control and Do Not Track

We honor the Global Privacy Control (GPC) and other recognized universal opt-out signals. If your browser or extension sends one, we treat it as an opt-out of non-essential tracking for that browser and, where applicable law requires, as an opt-out of any sale or sharing of personal information.

Browsers also offer a "Do Not Track" setting. Because there is still no common standard for how sites should respond to it, we do not respond to DNT signals specifically. We honor GPC instead, and we don't track you across other websites regardless.

6. How we share information

We share personal information only in these situations:

• Service providers. Vendors that run parts of the Sites on our behalf, under contracts that limit them to processing data for us. These currently include:
  • Cloudflare for hosting, content delivery, network security, processing of form submissions, and routing of email sent to our addresses
  • Google Analytics and Cloudflare Web Analytics for aggregate site statistics
  • Google, which holds messages you send us in our Gmail inbox
• Professional advisors. Accountants and legal counsel, where needed.
• Legal and safety. When required by law, subpoena, or legal process, or to investigate suspected fraud, protect our rights, or protect someone's safety.
• Business transfer. If kittyShark is involved in a merger, acquisition, or sale of assets, information may transfer as part of that transaction. We will notify you before your information becomes subject to a different privacy policy.

We may share aggregated or de-identified information, meaning statistics that cannot reasonably identify you, for any lawful purpose, and we do not attempt to re-identify it.

7. We do not sell or share your personal information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising or targeted advertising, as those terms are defined under California, Colorado, Connecticut, Texas, and other state privacy laws. We have not done so in the preceding twelve months. We also do not use or disclose sensitive personal information for purposes that require a right to limit under California law.

We do not knowingly sell or share the personal information of anyone under 16.

8. How long we keep information

We may keep information longer where a law requires it or where it's needed to resolve a dispute or enforce our agreements. When information is no longer needed, we delete it or de-identify it.

9. Security

We use reasonable safeguards appropriate to the size of our operation: encryption in transit (HTTPS) across the Sites, bot protection on our forms, access controls and multi-factor authentication on the accounts that hold personal information, and vendors selected in part for their security practices. We collect as little as possible, which is itself a safeguard.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a breach affects your personal information, we will notify you and any required regulator within the timeframes the applicable law sets.

10. U.S. state privacy rights

Twenty U.S. states now have comprehensive consumer privacy laws in effect. Most of them apply only to businesses above certain size or data-volume thresholds, and a studio our size generally falls below them. We extend the following rights to every U.S. visitor anyway, regardless of where you live or whether a law technically requires it:

• Know and access. Ask what personal information we have collected about you, where it came from, why we collected it, who we shared it with, and get a copy in a portable format.
• Correct. Ask us to fix information that's inaccurate.
• Delete. Ask us to delete personal information we hold about you, subject to legal exceptions such as tax records.
• Opt out. Opt out of any sale of personal information, sharing for targeted advertising, or profiling with legal effects. We don't do any of these, but the right stands.
• Limit sensitive information use. We do not collect sensitive personal information for these purposes.
• Non-discrimination. We will not deny you service, charge you a different price, or give you a lesser experience because you exercised a privacy right.

Authorized agents

You may use an authorized agent to submit a request on your behalf. We will ask for written proof of their authority and may ask you to verify your identity directly.

Appeals

If we deny your request, you may appeal by replying to our decision or emailing us with "Privacy Appeal" in the subject line. We will respond in writing within 45 days with our decision and the reasons for it. If we deny the appeal, you may contact your state attorney general to submit a complaint.

11. Additional California disclosures

These disclosures are provided under the California Consumer Privacy Act as amended by the CPRA, the California Online Privacy Protection Act, and California's "Shine the Light" law.

• The categories of personal information we collect, our purposes for collecting it, and the categories of third parties we disclose it to are listed in sections 2 and 6 above.
• We disclose personal information to service providers for business purposes only. We do not sell personal information or share it for cross-context behavioral advertising.
• Under Shine the Light, California residents may request information about disclosures to third parties for their direct marketing purposes. We make no such disclosures. Requests may be sent using either method in section 17, and we will respond within 30 days.
• You may designate an authorized agent to make requests, and we will not discriminate against you for exercising any right.

12. EU/UK rights and international transfers

If you are in the EEA, the UK, or Switzerland, you have the right to access your personal data, correct it, have it erased, restrict or object to its processing, receive it in a portable format, withdraw consent at any time, and not be subject to decisions based solely on automated processing (we do not make any).

You also have the right to lodge a complaint with your local supervisory authority, or, in the UK, the Information Commissioner's Office, though we'd appreciate the chance to resolve it with you first.

International transfers

kittyShark operates from the United States, and our hosting and service providers are primarily located in the United States. If you contact us or use the Sites from outside the U.S., your information will be transferred to and processed in the U.S., where privacy laws may differ from those in your country. Where we transfer personal data out of the EEA or UK, we rely on the European Commission's Standard Contractual Clauses or another approved transfer mechanism in our agreements with providers, and your data remains protected by this policy.

13. How to submit a request

The fastest way is our contact form. Choose "Privacy request" as the subject and tell us what you'd like us to do. You can also email [email protected] with "Privacy Request" in the subject line.

• We will confirm receipt within 10 business days.
• We will respond substantively within 45 days. If we need more time, we'll tell you why and take up to 45 additional days.
• We may ask you to verify your identity, usually by confirming details we already have, such as replying from the email address on file. We use verification information only for that purpose.
• There is no charge for a request unless it is manifestly unfounded or excessive, in which case we'll tell you before doing anything.

14. Children's privacy

The Sites are intended for adults and are not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us with personal information, contact us and we will delete it promptly.

15. Third-party sites and platforms

The Sites link to other websites, including client work, marketplaces where our digital products are sold, and our social profiles. We don't control those sites and aren't responsible for their content or privacy practices. Review their policies before sharing information with them.

Anything you post publicly, a comment on a social post for instance, can be seen, collected, and used by others. We don't monitor those disclosures and can't take responsibility for them.

16. Changes to this policy

We may update this policy as our practices, the Sites, or the law change. When we do, we'll revise the "Last updated" date at the top. If the changes are material, a new category of data, a new purpose, a new recipient, we'll give notice on the Sites before they take effect, and where the law requires it, we'll ask for your consent. Your continued use of the Sites after an update means you accept the revised policy.