Privacy Policy

Last updated: 3 August 2026

This notice explains how NR Studio handles personal data collected through this website, the 70M guide funnel, the free-edit application, and related communications.

1. Controller and contact

The controller is José Nuno Costa Rebelo, NIF 197195067, Rua Padre António Caldas, Porta 17, 4810-275 Guimarães, Portugal. For privacy questions or to exercise your rights, email geral.nrstudio@gmail.com.

2. Personal data we collect

  • Main contact form: name, email, project type, message, and technical delivery metadata.
  • Guide funnel: name, email, content type, submission ID, timestamps, and limited source fields such as utm_source and utm_medium.
  • Free-edit application: social handle, current and desired publishing frequency, editor status, expected editing budget, preferred contact method and details, the email address you apply with, whether you applied from the thank-you page or from the link printed inside the guide, application timestamp, application status, and lead_score.
  • Communications: messages and information you send when we reply to an enquiry, deliver the guide, assess an application, or manage a client relationship.
  • Consent records: whether marketing consent was given, its date and notice version, and any unsubscribe date.
  • Security logs: limited technical records needed to secure the website, investigate incidents, and prevent abuse.

The guide carries a link to an application page that asks for your email address. We use that address only to find the record created when the guide was sent. If no record matches it, we create a new record from that address and your application answers, so that we can assess the application and reply to it. A record created this way carries no marketing consent, and we do not send you marketing unless you later give that consent.

Providing information through these public forms is not a statutory requirement. The following explains what is required, what is optional, and what happens if you do not provide it:

  • Main contact form: name, email, project type, and message are required. Without them, you cannot submit the form and we cannot answer the enquiry or prepare a quote.
  • Guide funnel: name and email are required to deliver the guide. Content type is required only to finish the enhanced funnel and may be absent without affecting guide delivery. Marketing consent is optional, and refusing it does not affect delivery of the guide. Source fields such as utm_source and utm_medium are recorded only when available; their absence does not affect delivery.
  • Free-edit application: the social handle, publishing answers, editor status, budget range, and contact method are required. An email address is also required when you apply through the link inside the guide, because it is the only way to connect the application to you and to answer it. A WhatsApp number is required only if you choose WhatsApp. Without the required information, you cannot submit the application and we cannot assess it.
  • Further communications: extra information is optional unless it is needed to answer your request, perform an agreed service, or comply with law. If you do not provide information needed for one of those purposes, we may be unable to respond fully or provide the relevant service.
  • Operational records: submission IDs, timestamps, consent records, and limited security logs are generated or recorded automatically where needed to operate and protect the forms and document your choices.

3. Why we use data and our legal bases

  • We answer enquiries, prepare quotes, deliver the requested guide, assess free-edit applications, and take other requested steps before a possible service relationship under Article 6(1)(b) GDPR. This includes an application sent through the link inside the guide, and creating a record for an applicant we do not already hold one for, since we cannot assess or answer the application without it.
  • We manage and perform established client engagements, including project delivery, client communications, billing, and payment administration, under Article 6(1)(b) GDPR.
  • We create, retain, and provide invoices, accounting records, and supporting tax documents where required by law under Article 6(1)(c) GDPR.
  • We send optional video and editing tips only after affirmative consent under Article 6(1)(a) GDPR. The guide is delivered whether or not marketing consent is given.
  • We use limited first-party source information, prevent duplicate records, deliver and protect the website, and investigate abuse under Article 6(1)(f) GDPR, based on our legitimate interests in operating a secure and effective website and enquiry service.
  • We measure how the website is used, using privacy-preserving analytics and form counters that do not identify visitors, under Article 6(1)(f) GDPR, based on our legitimate interest in understanding how many people visit the site, which pages they read, and whether our forms can actually be completed.

4. Recipients and service providers

Web3Forms is the main contact-form recipient and forwards contact-form submissions to us. The guide and application flows use Google Apps Script and Google Sheets. We use consumer Gmail for email and consumer Drive for associated files and records.

Cloudflare, Inc. operates the authoritative DNS for this domain and delivers the whole website as a reverse proxy and content delivery network. Every visitor request passes through Cloudflare, which terminates the encrypted connection, receives your IP address and request metadata, and may serve pages from its cache. This applies to every visitor and every page, not only to the analytics described in section 7, which Cloudflare also provides. Our hosting provider stores the site files behind that network and may process limited technical data needed to deliver and secure them. The forms on this site submit directly to Web3Forms and to Google, and not through our own Cloudflare configuration. Web3Forms uses Cloudflare as its own delivery provider, so a contact-form submission reaches Cloudflare's network on that separate route.

Consumer Gmail and Drive are consumer services, not Google business services covered by a business data-processing agreement. For those consumer services, Google may act as an independent controller under its own terms and privacy notice.

5. International transfers

Web3Forms: Web3Forms states that it operates from India and uses infrastructure providers that may process data in multiple regions. Its published policy says that transfers of personal data from the EEA are made under appropriate safeguards, including the Standard Contractual Clauses set out in its data processing agreement. See the Web3Forms Privacy Policy.

Google consumer services: Google states that it maintains servers around the world. Google LLC and its wholly owned US subsidiaries, unless explicitly excluded, participate in the EU-US Data Privacy Framework. Google also states that it relies on Standard Contractual Clauses where required for transfers not covered by an adequacy decision. See Google's data transfer frameworks.

Cloudflare: Cloudflare, Inc. is established in the United States and operates a global network. Because Cloudflare delivers this website, every visitor request is handled by that network and may be processed outside the European Economic Area. Cloudflare states that its standard data processing addendum incorporates the Standard Contractual Clauses, and that it relies on its certification under the EU-US Data Privacy Framework for transfers of personal data from the European Economic Area to the United States. See Cloudflare's GDPR information.

Our use of consumer Gmail, consumer Drive, Google Apps Script, and Google Sheets does not mean that NR Studio has a Google business data-processing agreement. To request details or a copy of the safeguard applicable to a particular transfer involving any of these providers, email geral.nrstudio@gmail.com.

6. How long we keep data

  • Enquiries, guide leads, and unsuccessful free-edit applications are normally kept for 12 months after the last interaction or application decision, unless the person becomes a client.
  • Client project records are kept for the contract and only as long afterwards as needed for claims, professional obligations, or another stated lawful purpose.
  • Invoices, accounting records, and supporting tax documents are kept for 10 years where Portuguese law requires it.
  • Security logs are kept for no more than 90 days unless they are needed to investigate an incident.
  • Marketing consent evidence is kept while marketing continues and for a reasonable compliance period. After an unsubscribe, we retain only the minimal suppression information needed to honour the opt-out.

7. Cookies, browser storage, analytics, and YouTube

This website does not use non-essential cookies. The 70M funnel uses essential sessionStorage only to preserve the active multi-step form and submission ID during your browser session. It is not used for cross-site tracking and normally expires when the browser session ends.

We use Cloudflare Web Analytics, provided by Cloudflare, Inc., to count page views and see which pages are read. It sets no cookies and stores nothing on your device. Cloudflare receives your IP address as part of the ordinary web request that loads the analytics script, as it already does when it delivers the page itself, and uses it to derive the country shown in our reports. Cloudflare states that the address is discarded at the receiving data centre and is not stored in its core databases or logs. Visits are counted from the referring website, not from IP addresses. The analytics do not identify you, do not build profiles, and do not track you across other websites. We see only aggregated counts.

We also count how our own forms are used. When you first type into a form, when you try to send it, when a field is not accepted, and when it is sent, your browser reports that step to our Google Apps Script endpoint. Only names are reported: the name of the step, the name of the page, and, for a rejected field, the name of that field. What you type is never reported. These counters set no cookies, store nothing on your device, and create no visitor or session identifier, so a counter cannot be linked to you, to another counter, or to anything you submit. Google receives your IP address as part of the ordinary web request that carries the report. We use the resulting totals only to compare how many people begin a form with how many finish it, so that we can tell whether the form itself is getting in the way.

The showreel uses click-to-load YouTube. No YouTube iframe loads until you choose to play the video. Playing it connects your browser to YouTube, and Google's privacy terms then apply.

8. Sharing, sale, and automated decisions

We do not sell personal data. We disclose it only as described in this notice, when needed to provide a requested service, or where the law requires it.

NR Studio does not make solely automated decisions about you. The application lead_score supports manual sorting and review only. A person makes every selection decision.

9. Security

We use proportionate access controls and security measures designed to prevent unauthorised access, loss, alteration, or disclosure. Access to lead records is limited to the people who need it, and lead data is not shared through public links.

10. Your GDPR rights

Depending on the circumstances, you may request access, rectification, erasure, restriction, portability, or object to processing. Where processing is based on consent, you may withdraw that consent at any time without affecting processing carried out before withdrawal.

Email geral.nrstudio@gmail.com to make a request. We may need to verify your identity. We respond without undue delay and normally within one month, subject to any extension permitted by law.

11. Complaints

You may complain to Portugal's supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD), through its official website at www.cnpd.pt. We would also welcome the opportunity to address your concern directly.

12. Changes to this notice

We may update this notice when our services, providers, or legal obligations change. The date at the top shows the latest revision.