Emán Estudio (“Emán Estudio,” “the studio,” “we,” “us”) is a digital design studio operated as a sole proprietorship by Cosette Rosales in Maryland, United States.
This policy explains what personal information the studio collects, why it collects it, who it is shared with, how long it is kept, and what rights you have over it. It applies to:
It does not apply to websites the studio designs or builds for its clients. Those sites are owned and controlled by the client, and the client’s own privacy policy governs them.
If you have any question about this policy, write to studio@eman-estudio.com.
Project inquiries. The inquiry form at eman-estudio.com asks for: your first and last name, email address, brand or company name, your current website (optional), your location (city and country), your industry, the stage your brand is at, the services you are interested in, your budget range, your timeline, and a description of your project.
Correspondence. If you email the studio, book a call, or message it on social media, it keeps the message, your contact details, and anything you choose to include.
Client project information. If you become a client, the studio holds the material needed to do the work and to run the engagement: contact details for you and your team, brand assets, copy, images, product information, feedback, contracts, invoicing details, and — where you choose to provide them — credentials or delegated access to platforms such as Webflow, Shopify, Klaviyo, or a domain registrar. See Section 8 on how access is handled.
When you visit the site, the studio’s hosting platform receives standard server and usage data: your IP address, browser type and version, device type, operating system, the pages you viewed, the page or search that referred you, and general location inferred from your IP address (usually city or region level, not precise).
This is what any website receives in order to serve pages and stay secure. The studio also uses Google Analytics to measure how the site is used. See Section 5.
The studio researches and contacts brands it would like to work with. For this it collects business contact information that is already published — a founder’s or team member’s name, role, business email address, the brand’s website and public social profiles — from the brand’s own website and public sources, and stores it in the studio’s CRM alongside notes on why the brand is a possible fit.
The studio does not buy contact lists, does not use email-guessing or enrichment tools, and does not fabricate details about a prospect. Where no public contact path exists, the record is left without one.
If you received outreach from the studio and want your details removed, write to studio@eman-estudio.com and they will be deleted. See Section 10 on your right to object.
The studio does not collect or store payment card numbers. Invoices are paid through Stripe, which handles card details directly on its own systems; the studio sees only that an invoice was paid. It does not knowingly collect information from children. It does not collect biometric data, precise geolocation, or special category data as defined by UK and EU law, and asks that you do not include such information in the inquiry form or in email.
If you are in the UK, EU, or EEA, the list below sets out the lawful basis for each use under the UK GDPR and EU GDPR.
Where the studio relies on legitimate interests, it has considered whether those interests are outweighed by your rights. You can object at any time — see Section 10.
The site uses the cookies its hosting platform needs to work: keeping pages loading correctly, remembering form state so a submission is not lost, and protecting against spam and abuse. These are strictly necessary cookies, and under UK and EU law they do not require your consent.
The site also uses Google Analytics 4 to measure how it is used — which pages are visited, how visitors arrive, and where they leave. This is measurement, not identification. If you are in the UK, EU, EEA, or Switzerland, Google Analytics is configured to run without cookies and without storing any identifier on your device: your visit is counted in aggregate, nothing persists between visits, and that is why you are not asked to accept anything. Everywhere else, Google Analytics sets its own cookie so that a returning visit can be recognised.
The site does not use advertising cookies or tracking pixels. There is no Meta or Facebook pixel, no LinkedIn or Pinterest tag, no Google advertising tag, and nothing that follows you to other websites or builds an advertising profile of you. Google Analytics' advertising features are switched off, so what it collects is not used to target advertising to you.
You can block or delete cookies through your browser settings, though blocking strictly necessary cookies may stop parts of the site working. To opt out of Google Analytics on every site you visit, Google publishes a browser add-on at tools.google.com/dlpage/gaoptout.
If the studio adds advertising tools in future, this policy will be updated before they go live, and consent will be requested where the law requires it.
The studio is a one-person business. Your information is not sold, rented, or traded. It is shared only with the service providers that make the studio run, each of which processes it on the studio’s instructions:
Information may also be disclosed to a client or a collaborator where a project requires it and you have been told; to professional advisers such as an accountant or a lawyer where necessary; where the law requires it, in response to a valid legal request, or to protect the studio’s rights or someone’s safety; and in a business transfer, if the studio is ever sold or restructured — in which case you will be told before your information becomes subject to a different policy.
The studio is based in the United States, and the providers listed above are mostly US-based. If you are in the UK, EU, or EEA, your information will be transferred outside your country.
Where that happens, the studio relies on the appropriate safeguards available under UK and EU law — the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum, as incorporated into its providers’ data processing terms, and the EU–US and UK–US Data Privacy Frameworks where a provider is certified under them.
You can ask for details of the safeguards applying to a specific transfer by writing to studio@eman-estudio.com.
The studio protects information with measures proportionate to its size: accounts secured with strong, unique passwords and two-factor authentication where available, encrypted connections, and access limited to the founder and, where a project requires it, a named collaborator bound by confidentiality.
Where a client gives the studio access to their platforms, the studio’s standard is to work under a named user account with the minimum role the work requires, rather than shared login credentials. Where a client provides shared credentials anyway, they are stored in a password manager and the client is asked to revoke them at the end of the engagement.
No method of transmission or storage is completely secure, and the studio cannot guarantee absolute security. If a breach affects your personal information and the law requires notification, you and the relevant regulator will be told without undue delay.
Where information is no longer needed, it is deleted or anonymised.
If you are in the UK, EU, or EEA, you have the right to: be told what personal information is held about you and receive a copy; have inaccurate information corrected; have information deleted; restrict how it is used; receive it in a portable format; object to processing based on legitimate interests, including profiling; object to direct marketing at any time, absolutely; and withdraw consent where consent is the basis.
If you are in California, you have the right to know what personal information is collected, used, and disclosed; to receive a copy; to have it corrected; to have it deleted; and not to be discriminated against for exercising these rights.
If you are in Maryland, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, or another state with a comprehensive privacy law, you have broadly equivalent rights of access, correction, deletion, and portability.
Most of these laws apply only to businesses above a certain size, and the studio is below those thresholds. It honours these requests regardless.
The studio does not sell your personal information, does not share it for cross-context behavioural advertising, does not use it for targeted advertising, and does not profile you. There is accordingly nothing to opt out of, but if the studio’s practices change this policy will be updated first and an opt-out provided.
How to exercise any of these rights. Write to studio@eman-estudio.com. The studio will respond within 30 days (UK/EU) or 45 days (US states), and will tell you if it needs longer. It may ask for information to confirm your identity, and will not use that information for anything else. Exercising your rights is free unless a request is manifestly unfounded or excessive.
An authorised agent may make a request on your behalf with written proof of authority.
If you are unhappy with the response, please raise it with the studio first. You also have the right to complain to a regulator: in the UK, the Information Commissioner’s Office (ico.org.uk); in the EU, your national supervisory authority; in California, the California Privacy Protection Agency or the Attorney General.
The studio does not currently operate a marketing email list or newsletter. The email it sends is either a reply to something you sent, the automatic confirmation of an inquiry you submitted, correspondence about a live project, or a first approach about working together.
You can ask the studio to stop emailing you at any time by replying and saying so, or by writing to studio@eman-estudio.com.
The site and the studio’s services are for businesses and are not directed at anyone under 16. The studio does not knowingly collect information from children. If you believe a child has given the studio personal information, write to studio@eman-estudio.com and it will be deleted.
The site links to other websites, including client work, social platforms, and press coverage. The studio does not control those sites and is not responsible for their privacy practices. Read their policies before giving them information.
This policy may be updated as the studio’s services and tools change. The “Last updated” date at the top will change. If a change materially affects how your information is used, you will be told directly where the studio has your contact details, or by a notice on the site.
Emán Estudio
Cosette Rosales, doing business as Emán Estudio
PO Box 5764
Bethesda, MD 20824
United States
Email: studio@eman-estudio.com
Emán Estudio is the data controller for the personal information described in this policy. The studio has not appointed a Data Protection Officer, and is not required to.