Legal

    Privacy Policy

    This policy explains how Code & Canvas processes personal data, the legal bases used under GDPR, which processors are involved, and how you can exercise your rights.

    Last updated: 11 October 2026

    1. Data Controller

    This website is operated by:

    • Name: Code & Canvas
    • KVK: 99849526
    • Registered address: Bannewaard 150, 1824EG, Alkmaar, Netherlands
    • Legal contact: legal@codeandcanvas.eu

    2. Data We Process

    2.1 Contact Form Data

    When you submit the contact form, we process the data you provide, such as name, email, selected package, and message text so we can respond to your inquiry.

    2.2 Optional Analytics (Consent-Based)

    Website and blog analytics run only after you explicitly enable analytics consent. Until then no analytics script is loaded and no analytics request leaves your browser, and we also honour your browser's Do Not Track setting. For website analytics we use Plausible Analytics, which we host ourselves on a server in Germany. Plausible sets no cookies and stores no IP addresses. It records the page visited, the referrer, browser, operating system, device type and country, plus clicks on contact and booking buttons and contact form submissions (never their content). Blog analytics events may include a post identifier, event timestamp, pseudonymous IP hash, a short-lived pseudonymous fingerprint, and a sanitized referrer URL (origin and path only).

    2.3 Business Outreach

    We contact small businesses about our services by email. For this we collect, from public Google Maps business listings and the businesses' own public websites: business name, website, public business email address, phone number, city, business category, public rating and number of reviews, plus public measurements of the website (speed, https, languages, metadata, page weight). Our crawler is described at /bot. We email businesses in the Netherlands, and in Belgium only companies (legal persons) at role addresses such as info@. We never email businesses in Germany. We keep this data for six months after our last contact with the business and then delete it, except for the domain name, which stays on a permanent suppression list so that we never contact it again. You can object at any time by replying "stop" to any email from us or by writing to jonah@codeandcanvas.nl; we process this within 30 minutes.

    2.4 Essential Browser Storage: We store essential values in your browser for core functionality, including:

    • cc_cookie_consent to remember your analytics consent preference.
    • selectedPackage (session storage) to prefill the contact form when selecting service packages.

    3. Legal Bases (GDPR)

    • Consent (Art. 6(1)(a)): optional website and blog analytics.
    • Steps prior to contract / legitimate interest (Art. 6(1)(b)/(f)): handling contact requests and providing requested services.
    • Legitimate interest (Art. 6(1)(f)): business-to-business email outreach to companies, with a permanent opt-out (section 2.3).
    • Legal obligations (Art. 6(1)(c)): where retention or disclosure is required by law.

    4. Processors and Service Providers

    We use the following processors to operate the website and process data:

    • Vercel - website hosting, server infrastructure, and blob storage services.
    • Neon - managed PostgreSQL database.
    • Hetzner - server hosting in Germany for our self-hosted Plausible Analytics instance and our outreach server.
    • Cal.com - scheduling of calls you book with us.
    • WhatsApp (Meta) - messages you send us through WhatsApp.
    • Spacemail (Spaceship, Inc.) - sending and receiving our outreach email. Spaceship is a US company and may scan message content for spam, including through OpenAI's moderation tool.
    • Apify - collecting public Google Maps business listings for outreach.
    • Google - PageSpeed Insights tests of business websites for outreach.
    • Postmark - delivery reports about our outreach email domain (no message content).

    5. International Transfers

    Several providers are US companies, including Vercel, Neon, Cal.com, Meta, Spaceship and Google, so data may be processed in the United States. Where required, we rely on the safeguards set out in each provider's own terms, such as Standard Contractual Clauses or the EU-US Data Privacy Framework.

    6. Data Retention

    • Contact inquiries are retained only as long as needed to handle the request and follow-up.
    • Analytics data is retained only for operational reporting and should be periodically cleaned up.
    • Outreach data about businesses is deleted six months after our last contact; the domain name stays on a permanent suppression list.
    • Essential consent storage remains until you change your choice or clear browser storage.

    7. Your GDPR Rights

    You may have the right to:

    • access your personal data
    • request correction of inaccurate data
    • request deletion (right to erasure)
    • restrict or object to certain processing
    • data portability where applicable
    • withdraw consent at any time for consent-based processing

    To exercise your rights, contact legal@codeandcanvas.eu. You also have the right to lodge a complaint with your local supervisory authority.

    8. How to Withdraw Analytics Consent

    You can withdraw analytics consent at any time on the Cookie Policy page at /cookies by selecting Disable Analytics.

    9. Changes to This Policy

    We may update this policy as our processing practices or legal obligations change. The date at the top indicates the latest update.